hxxps://lycx[.]nidami[.]biz/BygVTpUgiRxxTrsjgJxFeMHkiDirNJtDeqw

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lycx.nidami.biz/BygVTpUgiRxxTrsjgJxFeMHkiDirNJtDeqw

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
408	msedge.exe
408	msedge.exe
3332	identity_helper.exe
3332	identity_helper.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	firefox.exe
Token: SeDebugPrivilege	2492	firefox.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
2492	firefox.exe
2492	firefox.exe
2492	firefox.exe
2492	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
2492	firefox.exe
2492	firefox.exe
2492	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 2356	408	msedge.exe	84
PID 408 wrote to memory of 2356	408	msedge.exe	84
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 2576	408	msedge.exe	86
PID 408 wrote to memory of 4536	408	msedge.exe	85
PID 408 wrote to memory of 4536	408	msedge.exe	85
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87
PID 408 wrote to memory of 4540	408	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lycx.nidami.biz/BygVTpUgiRxxTrsjgJxFeMHkiDirNJtDeqw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc82e846f8,0x7ffc82e84708,0x7ffc82e84718
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3139159646508316035,9286799914969588164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4140
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.1625453199\1184620144" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e89cbe3e-52fa-47a0-81b9-4c79d136333f} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1948 1b0338ef458 gpu
    3⤵
    PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.1.803989963\122531865" -parentBuildID 20221007134813 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23b94b52-39da-4a45-a05f-334d93c7332e} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2352 1b01fb72558 socket
    3⤵
    PID:1644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.2.1550680509\1908268919" -childID 1 -isForBrowser -prefsHandle 3044 -prefMapHandle 3144 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a978aa75-973f-4af9-8d15-7bf8fa440402} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2912 1b0378ce058 tab
    3⤵
    PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.3.718983838\2004387329" -childID 2 -isForBrowser -prefsHandle 3604 -prefMapHandle 3600 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a85018d9-3119-4679-9946-5abaee916737} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3612 1b01fb6eb58 tab
    3⤵
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.4.594997427\741377648" -childID 3 -isForBrowser -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {031fc6c1-04b3-4638-97d9-0839ce0cede3} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3796 1b0360f4b58 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.5.1932185514\1599405226" -childID 4 -isForBrowser -prefsHandle 5344 -prefMapHandle 5340 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {749115ae-e46c-4dbf-b27c-5617846caf50} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5356 1b039e54a58 tab
    3⤵
    PID:2996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.7.180603618\1631425983" -childID 6 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {886c124f-4a8d-4464-b352-bed99b5e4fdc} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5592 1b039f63058 tab
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.1245057696\1680052958" -childID 5 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6610bdaf-0e9a-4624-ba85-88a1703c6adb} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5384 1b039f62a58 tab
    3⤵
    PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
42fb11f2102b4e1681287f6456d52ceb

SHA1
0257f08f18fbf74d6239a005d23311bdcf5a1373

SHA256
47f0d98f61d2c8db3c277b7be3e87b7b7d7823c4adc3fdacdc576892e2f19091

SHA512
9df4c96ba36456bcf5040b25900a4552320ba4fd86f3da6bd393323bebe9fc1890e6290644e3f83ed0ee0eadd95ae4dbb3027e308b80bb36f994668186499fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1091796ae0d03702b096594a6de7de36

SHA1
67e745ffdbc2204cad4421e658eaf1ecac56f6ad

SHA256
5805b3ef485604aa934dcf1d57e94f4717a6ac490343faf88954cdd43c3bf62e

SHA512
dcee50d4561e1d5132ad24060e9ce62f696d78de7dd3d3f10bddca7c5fa27b3deb1e56dd69845f59739188b0fb16caf8fc1b7e76a264b0c7743fbd904bcadb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9692cb79a364937d82db6204d22c49d4

SHA1
4e38ce43ea6d5530b0787dd1edd3f5a6ceecbcca

SHA256
a35f90859700576ecab973878545295e1bdbaed1495496c95917c36c6c2ca67d

SHA512
f961d7ab1ae0c8f225c59bcf59de1bee5d9465071b497bbf832d85e7800cbce397c2f1b7ab535bdca09586bbfdef6f49b496d6c6f2d45b7f280e914d7936da04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f49dce216af53236ab8281e47fc079ab

SHA1
3fb2bf7033ecc386aa4c11cfe44fec620609e14f

SHA256
466c37602c02450ab347464655d71e34e92af5fbf8ae982c7be801864a41825a

SHA512
54c0650c84a904b2a32953174e4fad202dc66be3e2fd578ec6716ddf32d6877e0bc0aacab94060a63543755051172b2456638001a132ea2c0332f4f765e5fbd6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
290f2f44d5be3b7c14f747d4d569e100

SHA1
e6006c0a150def859af3c6ce4af7bafe9d861ea1

SHA256
0a3c3e5c6b0bbd3a10add666042a3e68d5b335730d53c916d858adf8597fbcaa

SHA512
0dc19303431aa02d50d112f58e0d16f61418735156138b3d11e0ba042c72cbbf0e151944f6ebc79bf96d19bc2846dfbe728e7ff98b0406bcc856d70f120e7921

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\pending_pings\bb150ef1-1c63-4a5c-8bc7-30ac4415f8dd

Filesize
746B

MD5
a3f3274c6f8e3e8d71b1f289ea2d1dd3

SHA1
c0abfa5d6337cbb2aa52c5182d6d82c5f5c12fc7

SHA256
1ca23eeb8c4fa5cd9b456445a905085707ab19e2704521d75f0c70c6db88aae8

SHA512
539fcec4f12a6ba404787a50a2eddbef2704e6755145db34ee8292bd1cfd5a106cd7cf7fad906a77f3e3a4a03d99c3bbd9967ff677ce64f408cc574abd2dfc05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\pending_pings\d8e03961-cf0d-4a6a-bdcd-534d7f8a2c7e

Filesize
11KB

MD5
0cbb5f9cf2bfd1b8b50b42ccce021b55

SHA1
4007d3657af0faa83d102a5c1b5e5034dfc25131

SHA256
5343786d7eb46ea51a526f0b57e1f4110eb1d886f93b41099b4cd67204501631

SHA512
4dc6a3ccca24d079198bdd67d76d5d002068797520855619747c08ab4a3efd819b856b057ea3c61ecff9294be981d724411a6690f8b6168d1cec6020a58b6500

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs-1.js

Filesize
6KB

MD5
843cea443956dfa0dec1b4e1163b6576

SHA1
3149f588a30ebb5c72a6ce1eb7dd0fa863918613

SHA256
13fdf4c52e11decb7b0e3c7de8a48d3e568bc2a2bd1d34c076e04702ef73b9dd

SHA512
3075ebe005aa56aa92629d7a7b3c9f0a2204667995bb6a6f1fe6dc1a278a85551673f66ac42091b12b85bec997b975e1e14f9628c4102ebb891cc8481de8ba64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
90fb6c24822889975d449dcbb154075c

SHA1
46adf03f9b591ce214c11399768a24d118b22b3b

SHA256
559ca04573b5ceda11748a4a2fa52e5189a449a6984621635c487a27c99a387c

SHA512
1f745f7a672777ca7cd0541d9b7f4506785947cccce85e245f48710e8efd028d130698b81c37f876f71a8f059a6046f18f99d8df3b76ed8151dfbd528389392d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
17482b11a2d4181059be41f73d4c9456

SHA1
aab8bea99229db62af319e3ef55aaf5f2cfd1a49

SHA256
7ce5cdfd5747072339efdd9c019f83f711ee241a9c25f774aae733fa605aa6e8

SHA512
275e5b4539fb455cf485fced079a6244334ce7eb7c57535087d8dd783a916d7199f494ca4dc3e4724f6095f954ac3e906780a728fe71832210c1e3fc1ea0c538

Download Submit