hxxps://surveys[.]enalyzer[.]com/?Pid=n53ren6s&Rid=qecder7g

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://surveys.enalyzer.com/?Pid=n53ren6s&Rid=qecder7g

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
648	msedge.exe
648	msedge.exe
1808	identity_helper.exe
1808	identity_helper.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	firefox.exe
Token: SeDebugPrivilege	2488	firefox.exe
Token: SeDebugPrivilege	2488	firefox.exe
Token: SeDebugPrivilege	2488	firefox.exe
Token: SeDebugPrivilege	2488	firefox.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
2488	firefox.exe
2488	firefox.exe
2488	firefox.exe
2488	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
2488	firefox.exe
2488	firefox.exe
2488	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2488	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4408	648	msedge.exe	82
PID 648 wrote to memory of 4408	648	msedge.exe	82
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 560	648	msedge.exe	83
PID 648 wrote to memory of 2892	648	msedge.exe	84
PID 648 wrote to memory of 2892	648	msedge.exe	84
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85
PID 648 wrote to memory of 1644	648	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://surveys.enalyzer.com/?Pid=n53ren6s&Rid=qecder7g
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f3d646f8,0x7ff8f3d64708,0x7ff8f3d64718
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,991927545169564299,12447260183909669415,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4868
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.0.270832563\833703424" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1d1c5c-f6b0-42a3-85c0-91e9229f4642} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 1980 1878bdd8658 gpu
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.1.614754704\335077347" -parentBuildID 20221007134813 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f7f3ad8-2308-4f9d-b67a-ae70d8b843f5} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 2396 1878bcfa558 socket
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.2.17045990\2001859124" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 3156 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49c81326-80a2-4f1c-9e07-6cb9c0f74cf3} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 3096 1878feb1b58 tab
    3⤵
    PID:5324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.3.51059080\265053329" -childID 2 -isForBrowser -prefsHandle 3888 -prefMapHandle 3884 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84582d4f-22dd-4cc7-b0e8-1f7f807c7b51} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 3896 18790d1b658 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.4.1656276682\290964793" -childID 3 -isForBrowser -prefsHandle 4016 -prefMapHandle 4040 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce881146-2ef0-456e-80f6-a7c6ce0de642} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 3884 18790e13858 tab
    3⤵
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.5.1910860398\1108074080" -childID 4 -isForBrowser -prefsHandle 5068 -prefMapHandle 5064 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60592467-b6ea-400a-85a3-d9484db97947} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 5000 18792066158 tab
    3⤵
    PID:6020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.6.962055809\1782771369" -childID 5 -isForBrowser -prefsHandle 4936 -prefMapHandle 5088 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02252465-31ba-44e4-8d8e-eb8bf70c0bc3} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 5188 187921f3e58 tab
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2488.7.702177700\1328622407" -childID 6 -isForBrowser -prefsHandle 5372 -prefMapHandle 5368 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27da7297-e7ba-48c0-940f-998a94f3ce1a} 2488 "\\.\pipe\gecko-crash-server-pipe.2488" 5376 187921f5c58 tab
    3⤵
    PID:6060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b74411c53a6730ff89e752ccd95d5ea4

SHA1
f9ce750b9f9d76370d34a8dccaf105c95e38bac3

SHA256
bfc43c2557f30128261ffcacf05469dd8cfcf10621c759e0d0603ad8d034ea0c

SHA512
23a609facd11773d2848782a6491c2bd2135c6d9d72987d0f1a1bbf1474b9a2b0cb654b71fcac9cd70edb63ad634857bd075b715cc3e81f06340c6cedfe38c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
9f62f88e3c89c5972c5135ae94f37ca9

SHA1
b99b71481d7b7c797d08a7f4f9d29dc11e6acabf

SHA256
e2122f1d3af520605f66dc341b7a34875571494bf2b066ab23278e0cd2403054

SHA512
318cf6144624c2c137fe5dee4c964ef06174d49ca93ce31c1745aa40051692d44ac53b9cb3dd1ef78af8b6cee5bed5326699b7303d00b62a1cd3d3269e48630e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6803b7559187fa4295b9ae1ede6b0736

SHA1
1c3259a2d098b888e44c5d9787612e6376ff17f5

SHA256
26535105ce2783c3ed52fd02dc77ebde6fb69ad8b7b69d20a356e6c4059bd09e

SHA512
3f748da9ebe5bca03de390eb4109758f020fe58530d6cccf68fd5a6bccc0ebfbf6acf090fb58cbf6c7b4cde6d65de91200415bf59c50cccc46f00ea943d19cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6817675acce462fff50cd270788321cd

SHA1
62e0f365797887e6964963fbda241b511d4c385e

SHA256
da55a9587f2749c2efd0b25ef6295f127da7fce14f2340e467c4a868db77fd37

SHA512
85b80b98150b193d5a773f196be52c27b5e0716c214d45feb831296905946fa6b75dce783cb6c7b228b9a6bfb2b0168a92d1ffa5b0a67b659ee7b180229da5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e3162034e693715caac7b486a7ff3b0

SHA1
f3b76d8d93343f9b2249a38c7700806a3c231a6d

SHA256
57f34bcfc5a06a880104160363cced2dac37b98c10735335be7698dba7099ead

SHA512
9b5832bf12c6a691bf2ab29e67f5da255f55554b4e17402feb582d64bd6a60bf6cd847c334d487d09cad59a96c339c7b0fe2ac2c89cc206772d0f0758d19a976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b5e1c8b366c55dc0a04857aa5f2b170

SHA1
d1638afdde9d0b76396c18878b78406cff42a438

SHA256
e9f19b09ecb740ead192aab396d527d6715ac0267c2c097e79c99d35fa03e6a2

SHA512
35d327553490664deab9373a8bc7fd32e1f4fb1e9c53d9dd1d04db6be14a66d7bc49e44d3e3b9bdb6253703183dfdff3553a270bc98d4ff0b01aafb13740619e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
c447d3b61c81d4169a0beb8ddc3d4e4b

SHA1
5dc6672e0e0daf9f01c0580b17307a423764ba59

SHA256
226e81fa1fa828d4a44584e97d485c5b4ab9895b78126a9c5868af8c1f16835d

SHA512
fa68b2966e0936b8c3f2687213a2adadecc4db863873bec4cb9c5a52a7dc6a8af63fd1f646074d074eb236e43320d26933f646854551037fab29a15594c2af5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586f30.TMP

Filesize
203B

MD5
d14851a01570bf955d5e36dfe52be41d

SHA1
e6c889d1c8925080f3a8c7eb977a5728bd851b79

SHA256
2e0662ee0197ae0a6b029e4f4a9687761c0d67b39d5609ab040eefec6f4cf5df

SHA512
ba705ba63431ae19e553ac6f635c8d647e69e3fc3cde7d4501cec0da9a6c04920961c0b14e661f09f2a6c67b4cf2760faf7d7c22e3066c86c11138d844bbc111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e43ea48bc4511a6d98b048d1a609b7c6

SHA1
2661d7916e6e013adfeb8d24edc043a61852f58c

SHA256
a4a53b01c035d6d70e67d97107a66a5ae91646a174bf35e00510b6326507dca7

SHA512
ecc72e430faa8ad7b186d7ffc0102639503271bac4520a2edd1ecef32fbbbeaa205a97b31dca35c2ff1744945dad2f6770cac9fcc204d994ce8e51b346edbea2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\activity-stream.discovery_stream.json.tmp

Filesize
134KB

MD5
035806b47a6fdcff4af85995474bf356

SHA1
6076ac28fc14823ef96a0b06c351f937f8acebfc

SHA256
c3bfa72456c86428158f204c9ad72b9242b30e55c0895f3c4152409d2f3f7991

SHA512
f80235dc849af126fff8a62140c8215f9b7b2f61323d3d50d1fbfa6d25467420984862338c4f684819d429104318dfe86d40e5b1206e37dc6997adfd14a0656d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\cache2\entries\ED9826654AE8BD972BDE17A9E0A449D3F881E430

Filesize
14KB

MD5
373ed1ffa20b0d47af4fb2af37709fe8

SHA1
39a9c4705a251954f79f831a9a34e7cd4b4f7224

SHA256
2cc19d7d8451f09fa5969be42e0540a607f154ff210f8477ad47eb68ef1ff35a

SHA512
d8b454ce814222f705f5d54b8c0dc1176760e2cf4900180f5de0c487832542ef9375798744fb52405e0460a697dbfa872e5e165e80f74042bcac6d8b7af42710

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs-1.js

Filesize
7KB

MD5
d892db55e4ae4b19eabbd1c92bed56d1

SHA1
af2d2abd789a311bfaaeda140ca6652a7272b403

SHA256
0e71512ab2844883fd381a419793a44b14d2213e45f9629f759629c44400bfb6

SHA512
1e9f989aa17f3be4fe0d78b5b92005810d4e53016c0bcfacd49fc533505311cb794fd4bead75a80311deab63d7e75d1714c2834ec7f5d54433baaa41c0850d22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs-1.js

Filesize
6KB

MD5
8a888e839ca3db6d414e4039493b807d

SHA1
5ea9dce8622a9db4fdab938fc8cd91d5761f3984

SHA256
41c25615eb1c9794d73b13e27fcc2254f99d5fbba8feb603a8488667c08cf306

SHA512
f6ad5d94b294254fafe5857a28e16c99a3107bfca4f80d15c37280ec990fc3d4df76049a39719a26a92b4cbf561a7341af4867e1a812bc07c58ae40f588c59d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
512726bcc5d14470b23a0e8648b8e04c

SHA1
c3878001725177955f8b8a32c8c3abdca5588eae

SHA256
697aaccf3bc5804b5f8ffe48f1147925da5249e5ab5055a5726f6b8d2b082370

SHA512
28f76293a9c8a0c1e2d08f5f70227e4a7517894d01d6ec02c9f0c48c3b5eaae6b9554e1f530b79b7cd809e4af20533a5ed9cbc8de75503b8bd721a744455b82a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.3MB

MD5
7870592019ce861dd109762dbf168d11

SHA1
f1de9556015f0bcda651a229213c965cb16a4e48

SHA256
0224767d01a4ab732b1ab1650fdaf04c9935bb6a0af2ee77389e3e92f96e7d8c

SHA512
32234bed0e769055d8b00d4b450e50b76bebc120675f865d56a8e904158a0129ab3512cf4cf8f753b1e51ed6752fe9e0c6978b26d47b6dea6882d8a2332f4fd0

Download Submit