6bcc1b10e0f06f6bd0e894de8491f6f27b490845376618a361a1c0d997540b34

Analysis

max time kernel
69s
max time network
76s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27/06/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Beyond Launcher.exe
Size

42.1MB
MD5

1ad4d72f15334859b11376940e945d70
SHA1

3abbf8a55ad3d3c3652718bc6c999be25c5b9fc1
SHA256

6bcc1b10e0f06f6bd0e894de8491f6f27b490845376618a361a1c0d997540b34
SHA512

4014a4f59f31d10d8e827080c9ce1bd3b55af61c06e7f2e19a20dfe8343e1538ef8f5a70a7c775af0d5afef579075d30a687bd26a4a55943a49367b1f26c7219
SSDEEP

786432:UIMMNMTaaQqd/4snzaws0uXEUkpB9EgzWZGvHBYE7p1tVjriK+FA5WaPZZ:BFrW/46+KuEU01tVjrxvZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	Beyond Launcher.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ffd5cd7feac8da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1338ef7feac8da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0c710980eac8da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\AskToCloseAllTabs = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3424	MicrosoftEdgeCP.exe
3424	MicrosoftEdgeCP.exe
3424	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	3456	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3456	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3456	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3456	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4308	MicrosoftEdge.exe
Token: SeDebugPrivilege	4308	MicrosoftEdge.exe
Token: SeDebugPrivilege	1336	firefox.exe
Token: SeDebugPrivilege	1336	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
4308	MicrosoftEdge.exe
3424	MicrosoftEdgeCP.exe
3456	MicrosoftEdgeCP.exe
3424	MicrosoftEdgeCP.exe
1336	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 3272 wrote to memory of 2084	3272	firefox.exe	76
PID 2084 wrote to memory of 2960	2084	firefox.exe	77
PID 2084 wrote to memory of 2960	2084	firefox.exe	77
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 5056	2084	firefox.exe	78
PID 2084 wrote to memory of 4164	2084	firefox.exe	79
PID 2084 wrote to memory of 4164	2084	firefox.exe	79
PID 2084 wrote to memory of 4164	2084	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Beyond Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Beyond Launcher.exe"
1⤵
- Checks computer location settings
PID:292

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.0.897520018\189823517" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {580d718c-dee2-49e9-b565-e4f7677520df} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 1776 2a8380f5258 gpu
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.1.2006758925\1957162745" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e26622e-3550-4bb6-8895-cbd4155feaa7} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 2132 2a837c30858 socket
    3⤵
    - Checks processor information in registry
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.2.896060336\1729193124" -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2920 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93993d82-abd4-486a-b31c-477ea144ccc5} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 2624 2a83c29be58 tab
    3⤵
    PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.3.819684916\1546430345" -childID 2 -isForBrowser -prefsHandle 3180 -prefMapHandle 3068 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e72776af-9c41-4d28-a189-f2243124e50a} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 3580 2a825c62e58 tab
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.4.1260604876\1018785932" -childID 3 -isForBrowser -prefsHandle 4304 -prefMapHandle 4308 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2bc3880-64a7-4146-a1d5-38a767864fe9} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4272 2a83e0d1558 tab
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.5.461424137\1526587018" -childID 4 -isForBrowser -prefsHandle 4748 -prefMapHandle 4664 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {244955bf-ce43-4752-afb2-5f35d23d26f6} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4756 2a83e0d0058 tab
    3⤵
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.6.1877396733\924838736" -childID 5 -isForBrowser -prefsHandle 4904 -prefMapHandle 4908 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cc3e64f-e26d-4406-b0d5-bc9307fc56c9} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4896 2a83e6d2558 tab
    3⤵
    PID:4084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.7.295269578\107223671" -childID 6 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8f14189-322d-4b29-9d2b-369ea68be786} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 5076 2a83e6d3a58 tab
    3⤵
    PID:984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2960
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.0.2056455681\927658121" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1700 -prefsLen 20747 -prefMapSize 233491 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30471c1e-cccf-4cec-9544-687c11967fd6} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 1828 22e601d1558 gpu
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.1.1399323116\192534667" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 20828 -prefMapSize 233491 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d0950bc-4c39-43ed-87ed-52f8288a780d} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 2184 22e600f9858 socket
    3⤵
    PID:848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.2.914094535\994729048" -childID 1 -isForBrowser -prefsHandle 2664 -prefMapHandle 2816 -prefsLen 20866 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4af23696-e2ee-4c7f-8062-ee9b69c75253} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 3180 22e6447ea58 tab
    3⤵
    PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.3.882117377\1809008259" -childID 2 -isForBrowser -prefsHandle 3508 -prefMapHandle 3504 -prefsLen 26109 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa996ac-1f8b-4965-ade4-4ec32b00d868} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 3520 22e62cabd58 tab
    3⤵
    PID:348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.4.694516612\1260190645" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4308 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5218701b-98b0-44e2-80d0-fcb417154b4b} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4324 22e6664b858 tab
    3⤵
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.5.1840459296\2068041282" -childID 4 -isForBrowser -prefsHandle 4796 -prefMapHandle 4792 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c27a02-e95a-4eaa-a82a-2c46900f5d1d} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4488 22e62761558 tab
    3⤵
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.6.2034760639\1276001364" -childID 5 -isForBrowser -prefsHandle 4936 -prefMapHandle 4940 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1860b07-e6b3-4edb-9056-3d0ec311fe42} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4680 22e6664d358 tab
    3⤵
    PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.7.1787925672\6180982" -childID 6 -isForBrowser -prefsHandle 5108 -prefMapHandle 5112 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78366f5c-76f2-428d-ad4c-7ff108f86ea1} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4924 22e6664e858 tab
    3⤵
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.8.1571327950\515811998" -childID 7 -isForBrowser -prefsHandle 3244 -prefMapHandle 4000 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7044d9c6-f69c-4ac8-a8d4-44676054aa22} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4464 22e63ec8c58 tab
    3⤵
    PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
f0d273d4d3e015c23f8e162f1495c98a

SHA1
32317b355d10ff7a7bc246f64b4f5618c55280f4

SHA256
c7e92660f49184323e7924195c1dfa53a27cd9d141a62eb0ad46a69fda488b16

SHA512
d569c804ddb74fc10bf82f40fb8df872fe5bf361249e869dabe81a28c23e3676e71190fd9c3fb3fa87a9fb820814e518be367b67babc33450f4b9b097cc5655a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
7KB

MD5
3701a9aeb6a09e22e8fa423d1555866d

SHA1
63c0e865930c4c2e6b9909cf4bed4a383e8921c3

SHA256
e67721da273c499e60a27005a369ac08b9511864bcf76086fee2fe5dbfafe67e

SHA512
821d9bc8da000f6d7e336eeb9aef4356c7004ac68b0e6e0a83d49f80f33319eaa16f25f73b9efa8c2a033ad34ebf37fabbe8fb08e8e10773262fba75e4f7b40f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\startupCache\scriptCache.bin

Filesize
7.7MB

MD5
f0832224967733af8f5b9beb0daef776

SHA1
8efc7c92fb7bf2e0e33a718a8d6f2b34bc44f2ae

SHA256
ecd1224278eec0e3ae4faf1a03e01716c28891873057afdd840424ecee333677

SHA512
3460ccb889d72b7aac5f9904fe05f1616d482742ee3281eb6edf12af5f728a4c3b49ddea405bb5e845c5accd4b33980863380ed7db46d063057ad7dee0ff0108

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
5a3e1cca06569a3abad215db82b0b76c

SHA1
18ecdf820ea13771e7b56bdb6ef306f0c0c13334

SHA256
503d2ae1b9e57f6b33593b6013152cc3a6b60b7697366416192d205673bf481f

SHA512
fd2b7fc449db397f5a8c23484a369a5ab7ebded5f2e21a594fe7a5faa314f185453c31650fd6bba83a66c4405a50f49748c1e79bde3a0bc69bceb6d069d2a8e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFCB8BA4ECEBE6A493.TMP

Filesize
16KB

MD5
f6be7347c23af2b3f2c11de87b499b19

SHA1
47fee0cf76a4e8219126f2a1c6f30672fda58c19

SHA256
0b6158cb0ffcc8749dd7d9ebd07b5ad3f3658c11fe8d50ca22420c19fe7d7f80

SHA512
0c2b5b01b126bc21b7e55b4e06e67e93214b101e21a0c1ad504b5fa079bcdce634c08664e706b922c8201b39bf4897dd155c80f04c100c6e5b700220e554395a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\AlternateServices.txt

Filesize
163B

MD5
c7fcf528fe6ebe3737c855f943de0712

SHA1
6f6b6a6ad77a8fd9b3c53a0ea0268ab48d0b9edb

SHA256
ac8379e21033b862f27a4de8e0aa723c5b71eee6e6a89d85b94fc02a21273951

SHA512
be1ba76be74079179ff45aab245f593b405ad803f722a09c59f4d23a2cd8b0afb7096abd677d3b8b8b9093a67bf7fc8b0d76faa7ca7bcdfb6b9e2d95c4d04c09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\SiteSecurityServiceState.txt

Filesize
324B

MD5
281966321dc0cf0b74704a241a33bfa6

SHA1
e2b36b4e433b727e2ab03f17e1c9895be69a8f41

SHA256
260d7cb3bd8511c9cd9f4738da393d232ba75a0b2462bc50024ab058d4706ef4

SHA512
7fa593e54a3af44a2f0d05b401d60c6825a8e8dd568559c54e41e7d51d23cd0203a4e317625e03fb11be21e4a4edd98a065107aa29feaa2960f3ab02d404c8d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\cert9.db

Filesize
224KB

MD5
67bd6f220bc212b26e287a270674fa0b

SHA1
064d74b1102ad6378a3c9989091ce3429c37814f

SHA256
61663c7e22cec45a26dd929c80516e34eba70745d41ed80448755294f10e5d78

SHA512
7dc2a99812caa4cac849e2513494fd5621f64af54a7be8aed8361764e69fc1cba788c7b57b9371434979eb7c196a9c5a81cb2e0bb8ef1fcee74da2590121d09c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
3bc1d3d94586ad9c11c4f92d8b4bd7d3

SHA1
bf8d156bed3a868d8368a2087a4ed540f30c61c4

SHA256
bf6e34127caeec207d09c77ab5d89a686db5a1e3ed10e3153d53ee4a4825fa21

SHA512
28e377c1796d4a4a94d2c9db92a93b5318966494506a54fb7fa93e207408deb18d293b61a335895378f1d9b0ed31699d3448ddcba0594655bd0ae8afb2d42d92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
aeb902fa5fa4e8b33a28ae97f65245e4

SHA1
58b67ca0f0146c89cacd8dd7cfdd4692f69f7ed9

SHA256
e0d3b1d598a0b3eb352fad74c5e89d5913cf66cd05a5e814e120b24b6dda5324

SHA512
5d2a77088a05a3731882097477d63114dd2032e7559df3b5fa26f08de34a1386f28fb41eca0a2c0c5e832cfd2077d68f0d42dbf2bb3fccaf88438e0b7ba11fbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\806a8fc6-2b38-48d8-9b38-89789738b57c

Filesize
657B

MD5
c2028ac5eaf6eef394320acbc0c55f41

SHA1
f15f67f4ccfff686feface95f6df7de5062760bd

SHA256
0b70d4a66820cf61b4ec11ceacc010ecd2dbc957a7c582ba3eac6a73d4023db0

SHA512
b8e5f47344eea721afb0732c37d99eb04a9ff5b00fa2d664ac3dced88836bc588df4f732e8fd6d9307dff941404e31ad83972443b31c6378b05937bd354b6007

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\98e5a667-e17c-4f6b-ac82-2e2c143f321c

Filesize
9KB

MD5
29f225e14ffd9b2c8250b21e8e1d5556

SHA1
70185f89c0d4d6434043438c18afa1a5a500e583

SHA256
4c3e62e8774ae36cbdd0c0cd009fca550b77a042ee6a25d3580e4516872a5a58

SHA512
3b487ed7561718c2254f2fee5bed504a0e01f9e1a3e2e0ad5696f1163ce84f1f5464fdf159674a8ea5545770915a66e85018f9cae68f11c0531743cb239e949f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\b60db904-5b5c-498d-a5b0-815c84e73ab0

Filesize
746B

MD5
fd19d01c6cca389f915ed44fc10a725f

SHA1
9e86f05c0cf48627fd18dc755c509793ababf137

SHA256
195d834b47075afffcff9a98a1384c6ff115fe2dfa17936e9cbc1e55e640f4a3

SHA512
81b6a3361a6d67015b2c5c099c4edb29cb7b84cafc7ab2ee5f6cfbb75b1a34d2767161e526533c83cf397bdb94cae9734f7e82913d1a98704788b2f74770250c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
eb675138b09cdf220e02c9c39787103e

SHA1
6c841b9dda34ab2ca7f65a35e1bd1cdbcf9c24a5

SHA256
ac6bd3fb18dab1e013ac6eba371607393a1a022269806d9d1ac94db9c02576fc

SHA512
41287ea28e95183681ab0947ca20750919ef81865fc2a2942297fe82777583735da7cf3353293d8fbbd895b94dfd75d3d271d63de3375a3685a6aaed05e3753f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
fb186f9834b99970cbe3b846a14b42f1

SHA1
e55e417d1f33e071a2a0856220de84cd027e64f0

SHA256
0163d7e8a99a62e9f450c4f80a695fda911fa1974e7ec1214353f56a00c7f704

SHA512
d816facba053e377189fe00af2b51841a21c6274b32f3daf424987be9931a736d7d9d2a9088df4df62c5559e2b6a177a8f0b1753d27b43cb9d3efbacabaf5e74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
5d5fe25d74abd5ed970cdb2c1d287127

SHA1
da8c99e4d43044e0e874cf7dc6f312829e75d8b6

SHA256
d79627955799bf25731bac233ae6ada1143bbb176136816fbe718321800040a1

SHA512
eb8a13fd0ab4767c2e74e71c0cef806369c84d9d2d8dd05e8bea128d96a6a3b6e4a8cfcf3fffd50c80bfa4d13a3aab7a3b658076734df5daee04c9edab8654df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js

Filesize
6KB

MD5
fa8bf577de360865034f41b980ed394b

SHA1
49a6ad36ab6d66cc15852f398fdf4ee25171ef1b

SHA256
338177eb53c29a111facb65209d9b4fd66aca62fb505a9a3b017a1fb2272baa1

SHA512
869243c0cd03d73cc49f0c934cc7a0cc348798af83975dc17d3beae231d97900eb2b8692632e7166327b034c0dae1cedb642eadd3da0e8b17628d5ee9f9b3fe5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
f203ce0d097b3d865709d96dffdf62f7

SHA1
887c29f8ae1ab5b0ccf8eb0d60027020c7c74425

SHA256
d9ad74c3b113ab24234ceba6c6b1bec339827f56ec32b00aa5721c49a18e1c6a

SHA512
19b4e54b2f0df09a7001df8bbadc9afb044f39bcd285944fe9bff76477d9fd31e27fa354d8bc24ef50adbcb94e6dd36767ebade7ae3ad676a08f0b4e9160ef19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a685d8d289d702c113fe783e2d52df30

SHA1
2a581ef4f21270b872f5a826d56621b9c4ae4b5d

SHA256
265605d16964482395c20f99a99f32b894c9588fef4831daa1a06f7e5b5d1883

SHA512
b5fdc8166e959c282e757e1cf39c66897f9da7d0c7c50339391fda8592a905a7845c1c1f98f87fade3eade2cb991ce6e80c5ef2837450e6ec640c35f15e8bddc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore.jsonlz4

Filesize
880B

MD5
50fabd5b20597a5eb32e59d50b546487

SHA1
ef2f8e4ee71655eabf770abdbff458d05c0d74aa

SHA256
2fa9f5b17e1f4eeef4ef2cd253dc1eeb94c2435bff401597b87605193a9b3627

SHA512
5696c741ade45c67f1bbe640be29e0244a7cafc348deeaad39d6c38b4acae223f8db76f4794cc996b3f866dc0afe48c419f4cb034eee298ea08c9b88ca28a1bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
9ca4ba8b4c3cab6422782bd1563d4bf7

SHA1
361f1228ab07211a0824b85642010f9af1c34633

SHA256
4427adcb116ea07c3c68e6fcd84b5b574607defc389b94f2acee838725aee83f

SHA512
ed9a10bc908a267cf79a9174cb17ac6e9b8eba41354a9b400784d8baef39910256a51f58cd7319756be792def0e1285d7193cec8a38625bdf0868950a3e53ca8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
f72c2c8a738f1bdd4a5e24326ff248df

SHA1
d60277881f6b36509d709948fcf7ed3ec3da74a6

SHA256
06575a0a693c9e0f265fcf03ee5b6ced4dd922ac999f5d767a9a7d92fb199082

SHA512
7fa2cc3e4f6e6f9c77fc12e188a0ef4e5dfd9079e1ddd2d689669513bd2e512136ac4485b34aa0ed8587c8cd519572d31eb2496b4091e229b6c339bf25c27d6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\xulstore.json

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
memory/3456-199-0x000002281C600000-0x000002281C700000-memory.dmp

Filesize
1024KB

Download
memory/3456-200-0x000002281C600000-0x000002281C700000-memory.dmp

Filesize
1024KB

Download
memory/4308-190-0x0000021B58020000-0x0000021B58022000-memory.dmp

Filesize
8KB

Download
memory/4308-256-0x0000021B58010000-0x0000021B58011000-memory.dmp

Filesize
4KB

Download
memory/4308-252-0x0000021B5D020000-0x0000021B5D021000-memory.dmp

Filesize
4KB

Download
memory/4308-249-0x0000021B5D170000-0x0000021B5D172000-memory.dmp

Filesize
8KB

Download
memory/4308-171-0x0000021B58F20000-0x0000021B58F30000-memory.dmp

Filesize
64KB

Download
memory/4308-155-0x0000021B58E20000-0x0000021B58E30000-memory.dmp

Filesize
64KB

Download
memory/4404-219-0x000001BDA8170000-0x000001BDA8172000-memory.dmp

Filesize
8KB

Download
memory/4404-221-0x000001BDA8190000-0x000001BDA8192000-memory.dmp

Filesize
8KB

Download
memory/4404-223-0x000001BDA81B0000-0x000001BDA81B2000-memory.dmp

Filesize
8KB

Download
memory/4404-216-0x000001BDA8140000-0x000001BDA8142000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads