Analysis
-
max time kernel
46s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:54
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506753539825824" chrome.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exechrome.exepid process 4860 msedge.exe 4860 msedge.exe 4808 msedge.exe 4808 msedge.exe 4132 identity_helper.exe 4132 identity_helper.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
msedge.exechrome.exepid process 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe Token: SeShutdownPrivilege 3144 chrome.exe Token: SeCreatePagefilePrivilege 3144 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
msedge.exechrome.exepid process 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
msedge.exechrome.exepid process 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
OpenWith.exepid process 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe 3012 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4808 wrote to memory of 944 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 944 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4040 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4860 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 4860 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe PID 4808 wrote to memory of 312 4808 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.libertydoors.com/1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbddb646f8,0x7ffbddb64708,0x7ffbddb647182⤵PID:944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:312
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:4040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3144
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:3952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:2096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:636
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:82⤵PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:1804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:436
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16600937188724419353,4236626397199380059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4892
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3208
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument tel:+1319626-61002⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbcb779758,0x7ffbcb779768,0x7ffbcb7797783⤵PID:4904
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:23⤵PID:4800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:2636
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:2496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:13⤵PID:4500
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:13⤵PID:2276
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4608 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:13⤵PID:5448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:5548
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:5556
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:5880
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:5944
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 --field-trial-handle=1900,i,18338302755306952252,11238401533778695184,131072 /prefetch:83⤵PID:5960
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011Filesize
59KB
MD59b50731a3992eda2801a1cb2f2958cc5
SHA12a055aba7d1fe1b8a0e57e114ff4b6ff874b0d63
SHA2568ecb76e71e2baa5fd4e10f837861a7e8cd00e3e2e481b52d68a1b414d4c3ee06
SHA512500be9c363da620714e4615a41342708092b3a86c939398da065125d1fd8bf6c5ccee528b4f84963166a52d5445db19de7cdac3c4850408fae697d02273f9f5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041Filesize
201KB
MD5c445ab4315d0633d446998c80764cc36
SHA147d3dee9845cc6e29b6771dd6560793b8b93000e
SHA2565635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242
SHA51283a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5baf6eba01b507c8606a95996ed7d7189
SHA13e247d215605b8f58dd20f6e0417b0144cd1cbf5
SHA25618ed0c7f04881e1878b931c512fdb684d67d2d8450fe11108a560fa84471cdfe
SHA512f1d42b2a3f3ada99b8f465f0aefd52e2425a17eadcd6beb34480534bfade729649dc8dc651182e02fecc1293733537a3ba343122329fffc9a948e4f5e36ff0d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5281035d2b0ccb5fac8383670c149888e
SHA1f296da605624a05902ed854eebb58a1af1c66d79
SHA256559ebe7666abc14b7781fa08d5440b98cb49321d1bdf82b196b22385a90446b8
SHA51210c53b9085b53526955c3f738f5103c0f1931aa67a148c8914290910e2e7ef7a44c5c18ec57409e4592e1b114ab4e1a7ada4a977da4c3cb2445aef268d6a0af5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d43c4c8651c179da2422b41cd133a9ba
SHA16d59410a329aaa1e4fb12d1c35be9ee1a29e51b9
SHA256e30c8a4043cc14f78802b62b60e7cbae145e6fd33c09461a69b404fa1a55fa4e
SHA5125bdf800b2d3bc1393ba2853154e6c98ce073dd7e55ac42899bf6fa80c7c556415a91ebaaff8aacbdd08fbd6f3cd4c3e41997882097d47f093d8effcb4d9ce02f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5c989bb3081dd7476246c1417258db06e
SHA1406f6edff990a44fefc8bb6a8b3df194e1f05f29
SHA2569119d42af2c95f1580c48cfceab1f574390e0291a6784140c9cd01c8d2349f05
SHA51264b8eb214c23ab603a5242add6579bdaaa72d99ea891e220193ba2985285b1bfd0c0ba71951ca6589b4b2370eeec7e70a676da8af66a003ec3d4280394bc6757
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD538c7f2d5919b9abf928a1aec7db18048
SHA1d094a29f85ee4a1986666b9e4219f8b168915ee6
SHA256c872bd279fd9f2b564fe479a03367243778e2c6a1e8adc464875aea7a93db3d6
SHA51228fbc5e4a8305ce6c30a236e8393ce0a6c608c8e6668e916212f1de6a87a44579d3ee8d501ec490f10443783a4c27c62f047572c799091935f7126f5def7c7d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5350090224b1a279cdd6ef2e85685aa2d
SHA1aaf2a3270fac7c10c00b3044c494687178ed20bf
SHA25682f167f393fd4c53421a21792462edbf7a081bde5d6636147da147a6b7fb0b7c
SHA5127bc3d5fc2cea2b0e878d711a7c45f0a43344845eab6fd60b11368e464c4ad682ab7b1503439f72b757616db1494f22a609792074e73637a63287b47922c14e16
-
\??\pipe\LOCAL\crashpad_4808_DRFNLQIASSSCRFVUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e