Analysis
- max time kernel
55s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 13:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://telemetr.io/es/channels/1280025157-7mvO0u01FWhjMDAx/posts
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
1800 seconds
General
- Target https://telemetr.io/es/channels/1280025157-7mvO0u01FWhjMDAx/posts
- Sample240618-rab8ba1ark
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133631927559070566" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 668 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeDebugPrivilege 4324 firefox.exe Token: SeDebugPrivilege 4324 firefox.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe Token: SeShutdownPrivilege 4704 chrome.exe Token: SeCreatePagefilePrivilege 4704 chrome.exe - Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4324 firefox.exe 4324 firefox.exe 4324 firefox.exe 4324 firefox.exe - Suspicious use of SendNotifyMessage 27 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4704 chrome.exe 4324 firefox.exe 4324 firefox.exe 4324 firefox.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4324 firefox.exe 4324 firefox.exe 4324 firefox.exe 4324 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4732 4704 chrome.exe 81 PID 4704 wrote to memory of 4732 4704 chrome.exe 81 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 1184 4704 chrome.exe 83 PID 4704 wrote to memory of 3560 4704 chrome.exe 84 PID 4704 wrote to memory of 3560 4704 chrome.exe 84 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 PID 4704 wrote to memory of 2084 4704 chrome.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://telemetr.io/es/channels/1280025157-7mvO0u01FWhjMDAx/posts1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a69ab58,0x7fff0a69ab68,0x7fff0a69ab782⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:22⤵PID:1184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:82⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:82⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:12⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:12⤵PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:82⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:82⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4660 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:12⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3208 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:12⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4692 --field-trial-handle=1964,i,3916345807386841556,5100016260581726476,131072 /prefetch:12⤵PID:5572
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3636
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:220
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4324 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.0.81141530\201002836" -parentBuildID 20230214051806 -prefsHandle 1764 -prefMapHandle 1756 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b888b73f-6a80-4cdf-8d3b-6e913137d77b} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 1872 1e22be0fb58 gpu3⤵PID:4708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.1.1487232044\1927507426" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {360b8256-66f1-46dc-ac6b-8060dabc98e1} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 2420 1e21f086658 socket3⤵PID:4916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.2.698553763\885506548" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d6c3f2e-161d-4fc4-915b-cb5b3b3ed578} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 2980 1e22ec03b58 tab3⤵PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.3.2092687223\714992184" -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4490c36-f257-4352-b60e-5f26d1b553eb} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 3996 1e230eed058 tab3⤵PID:3500
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.4.993386712\2001892208" -childID 3 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74269fb6-41ac-4fe2-be02-9ab78597e0f0} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 2848 1e233943758 tab3⤵PID:4176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.5.818748557\2115396950" -childID 4 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a026d7-6d2d-4a33-ad42-296b1a5b73ee} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 5212 1e233942558 tab3⤵PID:2688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.6.1310827036\569951032" -childID 5 -isForBrowser -prefsHandle 5416 -prefMapHandle 5420 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b89f690-f681-4b00-bfad-5639ca5866cc} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 5404 1e233944f58 tab3⤵PID:964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4324.7.609773818\153827146" -childID 6 -isForBrowser -prefsHandle 5624 -prefMapHandle 5628 -prefsLen 27771 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c990d4c-bf13-4e61-9ee2-3ca408c9cf9d} 4324 "\\.\pipe\gecko-crash-server-pipe.4324" 5416 1e233c29858 tab3⤵PID:5380
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 9d628478ab9f48721d57865a04098c9c4e06d9aa0ed70a722717439f21942b63
- MD5 96d0b5cb687520b4d51fea41c73ed114
- SHA1 66a0b70617f59c15970484fd1d5219e5a1975c8d
- SHA512 8e31282acaf88d205f0198b237cac2248e0d9c59cc6d1c62142e28510dc66feb737d1d8ff03b0251f52380a854b768cba32d6636e8e2aa32e861ceff7507027a
- SSDEEP 192:22dpDTpaJvk1P8syh+FQcsHP5tjEsXtScR:22d2vk1RyqVAtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 255KB
- SHA256 2e61c88538141cbd09e5c21e0f86e49b85777a862834085b2455dfa8bed36fb2
- MD5 d4cab41fa28eba899ba89c3669308582
- SHA1 f6dbf54a549813a28d572ce442e5316208126c76
- SHA512 c2364a22dc4b2610e9c2bdefa605b288fcc16a69da42e4f0ad17ab8388f36dc9bfb8706fd6ade2f93f80715308d93a9244935fc693df622b4be8c19a4139e2bc
- SSDEEP 6144:mZ5IZXqXHjTdCP3y/UQYRPILxZnhLMJjX0EeGzY2rLD:qsqlGSUQ5fnReEFsLLD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\activity-stream.discovery_stream.json.tmp
- Size 23KB
- SHA256 6e0018e7c248b234b4b5a7022a117b2d873027410f6b45eb18ad32c03badeaff
- MD5 c11c2bbcab654cd1670fecd3492eaed5
- SHA1 3a0edc9eda7e05e2ed2a55d94860596a0a1a710e
- SHA512 91f3a235acf55a1c35f723176ac951179a22495c0a387219ad7c1096bd36593fe781931292b1e966b3b516f9d090ac83cfa28d9868ece47ca969e79311cb3a37
- SSDEEP 384:riORJ4/5fqUIDMCWG0cjsoJPvIkFG7SbSuEzRMHJKSkqt7d2kbSZiyaa:rimJ4FsxLTpF844RdSZd7bxy1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js
- Size 7KB
- SHA256 5b81d69c33da1abf0630dbaed13b971339637cfa5cd36468b0645e526ac066e0
- MD5 845a505ba2b66a0c243f93ec5b93905d
- SHA1 5e2a47fd531eac7ac6972cea3c0117c602f15f09
- SHA512 4f13b1715464423145e6f0f68cdfe236331b9047bf7f02d7e809cfdcf0c903374d19ee8954e7b4fd388b71c417f9a5ae97b66402c6d256c9aca29fec4064892a
- SSDEEP 192:55nrRKfl+x20Xbf3IYSm9xzoyBw8HcNS/:o4/IYSisAwDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js
- Size 7KB
- SHA256 90230be47c09f2d1176a9370790af7534afa5362c782e53c763e9bb8b73feccc
- MD5 9c5e88229f0f18dca2733d43ca83c522
- SHA1 ad72374eaf7844595a09b40579d49945860ae854
- SHA512 7f4b1c76cd65a44c50735e5422790adca14fc9f7c58f142a20eb2d87e59f1c98d5ff9a347eb25a09ce3f2adbff170a320c80eac6b623afa4b42cf701c4cfbcea
- SSDEEP 192:5jnrRKfl+x20Xbf3IYSm9xzoyBw8HcnS/:24/IYSisAw5Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 af17d93e223df7bc4e0e2e7776af6f3ac24e604f09a6f3cdee26d59dbfeaa5e5
- MD5 ed0796caa7d595c6e3302ec47ce65bfd
- SHA1 a716a3dfd70379da9f3b7d6c2997ec97257a890c
- SHA512 e68f9cc9f828d04c8849775013c980a7910ffc2a3dd591f5965bc7b1e641b0a38e4d798737c5fefe395e81988f772cd6543667f17be37124356c7e2b134ddfa2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 0b0027b28071847d459363128b85550a827a92ec74e3c58977f4d1129cf98ae9
- MD5 8a7e453cf72aa96a80f5b3f926a23f78
- SHA1 b8447bfc734dfa85aa986d24f3d1e92167e62a17
- SHA512 939b5d98c122776dc9b21ca6c0c33c8d50106db51f7f5b1a63645db169d568ad30363415ab82ffb161b507ab263e2d54d7f3f95be615417e29097c47400760c8
- MD5 SHA1 SHA512