hxxps://aefd[.]nelreports[.]net/api/report?cat=bingth

Resubmissions

05/10/2023, 09:50

231005-lvambsac6w 8

05/10/2023, 09:47

231005-lslxksca93 1

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aefd.nelreports.net/api/report?cat=bingth

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409729479568105"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
4380	msedge.exe
4380	msedge.exe
5092	identity_helper.exe
5092	identity_helper.exe
5144	chrome.exe
5144	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe
Token: SeShutdownPrivilege	5144	chrome.exe
Token: SeCreatePagefilePrivilege	5144	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1656	4380	msedge.exe	83
PID 4380 wrote to memory of 1656	4380	msedge.exe	83
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 1380	4380	msedge.exe	87
PID 4380 wrote to memory of 3572	4380	msedge.exe	86
PID 4380 wrote to memory of 3572	4380	msedge.exe	86
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88
PID 4380 wrote to memory of 5016	4380	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aefd.nelreports.net/api/report?cat=bingth
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffe86d246f8,0x7ffe86d24708,0x7ffe86d24718
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,6141143644323753190,11554682172543484133,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1836 /prefetch:8
  2⤵
  PID:5888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe782a9758,0x7ffe782a9768,0x7ffe782a9778
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:2
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4764 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5232 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4928 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2748 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4912 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3276 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3200 --field-trial-handle=1908,i,8039231402626094543,8806728799137333179,131072 /prefetch:1
  2⤵
  PID:1348

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b0ef61f7a37c04110819442167f07ce5

SHA1
db6f32c18f454ea4ca4cf3d94c18077af63ab2ff

SHA256
10716677fc7275659e57351e3aab65c7961da813b35c40bf17b916a7e06d0171

SHA512
37c927b86fbe7f57891a16bc45415b51c3424391e6e9066a8c31bf1092f2368e97e37ee8773ac12abc19f118bcd4aaeb5164fc16be8027efbb0fa907db80a435

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
ca28a412ef35f3e7ef518fb0f0b2ed2a

SHA1
75d74e20511975eec7d6dc4e661d52bb3667bb47

SHA256
7d9fa487ac7d25b456f0ef766539900d6815fb11e8ef494e392422c44ec0341b

SHA512
281aa54083ee283f90361b8c378ec12e7422eca9c7341fa1179f80d28bf2207c7b50b6727f460c2c8abd4c54c2d687bea1bc7f54fd97c1469084105e9bd5f00e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a3538106e6d8f6f8295ad00ec15e4213

SHA1
d8abe35fef5ba49c179a900e48b705a6bbe1b23d

SHA256
4460aba867ef474f991873d7a8253d7c43dde4fcfe41012005472b55be9721b7

SHA512
1c24a5d92f54ac6567d785b00b3a2b6958c9f297c1cec5f1f6d79a93a3e8e9623777399bb84a254bbc386a79bc00f6b9cff47813a81d8d95e106d03db2ad10eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
af2a7cdc4f82b060cfb757162907ef29

SHA1
c42d8112511d43334236ff61ace9980d7ace65a2

SHA256
b260ec816f131753dc2c6c7804d881b74e5d3aac2bc6fe6ffe6fb32c4b2d3775

SHA512
6233b67dee04bfd78c23d6d04472fea916e7621177acdcebfe96e057babb6fb6a418fe73c6531a54e46ab9881a2eb92bcf54a053ee5a017a1e5761b16f367b33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
39468928f6339e378e45fb0006380948

SHA1
a94bb1a8dfbb7315356f18255ff200ad8750db84

SHA256
6685f7c1c3e52e4d7939864606b02a9086f5b7971abc73aeb367a9eff11c5021

SHA512
f02e9ee667316cf6b0b8c67682925697ec969e7d10b822b5b5c42ac1d75753116ce49fc3083f125bfa3b38084ddb0c1c7411990c414ff8205fa052d037d4db3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
de329b7bb3a28ef9a13fd9dff4f5efb9

SHA1
4a56ef5cc42b10b34263ed5bc8290f89fe77c707

SHA256
b0472772792a8586861d4983804b4ddf5cb09536082f4b42bbee4e7882969550

SHA512
87be66b389bd8dd019d0a121bf78f7b3cbf62cf045b9779a40f00f7a6ebcc984c028e221400c831e73a7fdb1a796730170217f6a90f345adcd03b0b17af2430c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
202KB

MD5
bbe99ee9cfa597d85f4120ae1f0acb1c

SHA1
e8c71b440a05da265a121e4b7d9e919d3ab86190

SHA256
6bdd37350b0b05acd36404d33d420f6617c06424b0ecda09c7875479c258a5d3

SHA512
ded3dcee11d04aa02f5ad075aa616a4a686a2f7a2e48a804d4e179a25206798f7fa56e4241ae0ee5631b28e61cde7b693a7fe1911e49f6fa994636461b2d00b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ab036cbd053c4155921e8bf29f5f97a

SHA1
b88f85694667c2b9a0d26028f72b78688e1896bc

SHA256
113343bc374a508d5c09b9821274dfb310cfc1eb1e49016b2cbd0ec98e65951c

SHA512
98496b65c1656df663529245fc77702f569b22b1bfd055ec5b92a79e89b5a74f3561d98af2a99b99714748b1377d37962e4ffc600acdd25ca4cb854571fa4a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
413dada59022a7f494069282c69b129d

SHA1
ecef53862d04dd65c3553ccaa893430935410035

SHA256
74f8f1333ba062586a421d8147eea19cfd2bdd9344f2f84f2c6357375ea66fdb

SHA512
2e85a0d3705d6214669183cd232799f18b651499b34bca90394d85f4acb477a32652000b0395b5c69879767ab1b19a2a6f6ee7adbe96415b36a6eb9dfcda4be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9df5bd2eda2172da99a335c2e67ef97b

SHA1
fa3cb9dac9f2aeb6953addeef2d507d0bfd54069

SHA256
bf87b8cc99b028c7b18a2280558a2d63ee15b228d1795e9f8146182709dbedfc

SHA512
0985554be361e4b6949e54c92af309725ee97670bce13db3484daa6fffe7df42b987c9b477ebeee9b2d83bc475617e83c24c6db5abdd25559e27e5bf613f3d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
34ed73d9b93da27e741843d7424854fd

SHA1
ee9fbff85e8bbcd398b3aa695db46fe9415825c0

SHA256
02c728ede87c923c73c266dc275fc6fb64819b9f2b668e7d96a6ffd9ac6c9d7f

SHA512
c18aa00cf9006d4affc5ac07950a5984128714158e688bfe157123d85e83dc7adcbdfc238be723b18aa338554e9e6cb1da78b82f0f0f01196ca6b5741a6f0bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7653cfd03c0cced667a70019d433d1d0

SHA1
953c558e7e779643d8fff1bc4896297dfb0f9f1c

SHA256
b035dcc918254bc588bd8e2762dd90e6418295bd255dd7aebe670cdc55a08b0b

SHA512
a88b2e0bed3828fe877b2736ae021269fa5a47554e67fbd66870156a3b6f7789f56eeb11d97b8e116dc8dcd34484b5c992bd830d1dde3453055cae79d58a5b3e

Download Submit