hxxps://mail[.]google[.]com/

Analysis

max time kernel
149s
max time network
145s
platform
windows10-1703_x64
resource
win10-20240214-es
resource tags

arch:x64arch:x86image:win10-20240214-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
19/02/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mail.google.com/

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528347405166874"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\NumberOfSubdom = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{73DA1FDA-8A6F-4EAD-9E7D-1C3AEDD02DE1} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\accounts.google.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000c97bc992698f0640939062ac22d904db591b2b44ad0001f9be4c555b8274c67c31d9589e3217604a3d19bfec62967e002c4028e28417aa04d46d	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 607366d75263da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\accounts.google.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 99dc97d05263da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\accounts.google.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3408	MicrosoftEdgeCP.exe
3408	MicrosoftEdgeCP.exe
3408	MicrosoftEdgeCP.exe
3408	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	224	MicrosoftEdge.exe
Token: SeDebugPrivilege	224	MicrosoftEdge.exe
Token: 33	4276	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4276	AUDIODG.EXE
Token: SeDebugPrivilege	1920	firefox.exe
Token: SeDebugPrivilege	1920	firefox.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1920	firefox.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
224	MicrosoftEdge.exe
3408	MicrosoftEdgeCP.exe
2436	MicrosoftEdgeCP.exe
3408	MicrosoftEdgeCP.exe
1920	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3408 wrote to memory of 3388	3408	MicrosoftEdgeCP.exe	78
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 3336 wrote to memory of 1920	3336	firefox.exe	82
PID 1920 wrote to memory of 2592	1920	firefox.exe	83
PID 1920 wrote to memory of 2592	1920	firefox.exe	83
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84
PID 1920 wrote to memory of 2132	1920	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://mail.google.com/"
1⤵
PID:4404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:224

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.0.412080848\1779426762" -parentBuildID 20221007134813 -prefsHandle 1680 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b3c98ca-eb5f-45d2-a946-372bc01eaead} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 1760 26fa44d7b58 gpu
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.1.805544452\355036806" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68db7ff3-b062-48da-9064-e2c0af23b03b} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 2116 26f99472558 socket
    3⤵
    - Checks processor information in registry
    PID:2132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.2.594101905\1140758218" -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 2836 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9cc5ca9-3dcd-4685-bd9b-29728c6de99f} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 2852 26fa86dee58 tab
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.3.580524887\1976188816" -childID 2 -isForBrowser -prefsHandle 3404 -prefMapHandle 2860 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad70f9f3-01b0-4d8c-be93-dcd47baf3436} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 3468 26f99462558 tab
    3⤵
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.4.88700296\1620662787" -childID 3 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6407bc5f-b621-4331-9f14-2cdd8edd4ba3} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 3840 26fa9aba858 tab
    3⤵
    PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.5.2074682482\1161444787" -childID 4 -isForBrowser -prefsHandle 4852 -prefMapHandle 4856 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed4d068e-b6f8-417f-8b4a-346862fc43d7} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 4868 26fa9abab58 tab
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.7.1432062076\199532374" -childID 6 -isForBrowser -prefsHandle 5204 -prefMapHandle 5208 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a7fe8fe-ffc6-4343-a757-d60e00b39d7d} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 5196 26faaaa7858 tab
    3⤵
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.6.1209046217\631840028" -childID 5 -isForBrowser -prefsHandle 5024 -prefMapHandle 5028 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2474a239-a202-43b8-85c7-5f54ec74f9c8} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 5016 26faaaa7e58 tab
    3⤵
    PID:1576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.8.753239329\1775999455" -childID 7 -isForBrowser -prefsHandle 5616 -prefMapHandle 5620 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae01d9bc-6945-4c58-a965-4fb5e2b47a61} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 4520 26faa5eee58 tab
    3⤵
    PID:2508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcea999758,0x7ffcea999768,0x7ffcea999778
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1692 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:1
  2⤵
  PID:496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:1
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4544 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:8
  2⤵
  PID:196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5064 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4888 --field-trial-handle=1852,i,11872773367729543378,16524424668782820183,131072 /prefetch:1
  2⤵
  PID:2920

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
a98b52c91dfe373df7b4cfb769daa9e4

SHA1
c18a2a2176a978cb198aa4e4b87a77dda390691f

SHA256
f78a9914b4d20665903f8f0531e021eef9d126941dc1ed20ba91c36654354faf

SHA512
5029fc5d2dbe250063db6846b1398ec02712454f86fc9ad362e8f4bdda981531293bb1a6bed7ca5b018af4758b2d92101b894d337e3598a2c784abf04b624329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
9ba9d9d9d7cc9ca0b623553ecc2a12ab

SHA1
fed79df6b227a53385a030ebf5d0b3bd7947d9cf

SHA256
d9844d281f02ba4820606da06e85806dbdc611d843c4ae37838e8fda708aa983

SHA512
e945bab57622475c0dbc7cf26974cac16600fe89eb890f8e3e3f83babc1f1ddfa9c479da206822bb4f7fa8698f3f68ab33d697bbc8ee5e8724a12fdcbfa412e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
edcb127b995693e773abe3f299eb9ce8

SHA1
13fa4cd24f45646846e69b9c8c58606a898eb016

SHA256
ef889628bf39c6e588e89f0e03d3f839a41a9540804d17d302000ade1dfc4f2f

SHA512
09bbfefc8e66a018f560cd868dee5e4898fdd8a2dd9aff58ffb2fa663c53510131259c775983768bb4a0a45d672e07ffcbdc6fcf48a84d594ac6680358f88e00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
310094cf032bbec283c58c4643fe1951

SHA1
f18f77c8bab8bd74901e906e4d2c757e6ac11ae8

SHA256
ac32af4239bb89fdb0a147026150bd07b18254076a1d5cf91fc90d08c6e35ddb

SHA512
8ca61c3ed904f4e59f5f978279e63b53976892323b124305545a0a0e0fa444fe41abe850eb6845bb84dd8f7c1f0ecb6f2a2f768de18894bcbedf860dd0e8050a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f6dd79eb7ff6692860c4cf899932ca1d

SHA1
38cd09c06527fc3ff4bf429acbf89bbc88cd03b2

SHA256
9241f3121d7f62b7979bfd9dee16c4f81fdcb4e5205182be282b732040f7ec5e

SHA512
920d7f8931cacf9573da8cd215999b7d00382415c09f97d21f59e1997153b1b7440b4532e4cdaec7ec84a2d440c89fb29fb615e2d40a3689cf6e82f71d2ed093

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
7fb31a9ad4b0cd97d9c4a7ab2854264d

SHA1
ccebd6cc8f9632ad1b249e4af4ae7439d4f391b0

SHA256
cce24a3661da9f1f43b051480c98e195fb5f25cd8b57c079e58992465e893e20

SHA512
15e984ae4643955c04b556edbecac9a004cae85e823df56d0dc81d737ac008895a9cbd5732a94852a8a69fb8996991ee5d1ac8829cd8c8534614173065891608

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
342bb27f7bb9b2d09b7655808b3a83b3

SHA1
80df5c7d12eefc3ff0e3194285de732c2a885d23

SHA256
8d66d4fed4b9c55dd18b8f58a81a9d71df6fe397da4083aace732447150a1cad

SHA512
2131c6dd20721baddc0472c6daa93f94fcc73d99e91641562f1f1a06addfb75674396d62a42f2c549cea09ea8e6da6b3ab4f2b42691dde31ca81f33c23bd6569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\9PDJBXB1\accounts.google[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2S9ML3D9\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF2B89A9E8C23A4692.TMP

Filesize
20KB

MD5
187bfe541d1d5d19a1c02ef02ceb3f86

SHA1
5863c526910b903685b9d9feded36784408635dd

SHA256
211a5f8b1ececb072132afd17a9606f1af182c1250d10e288010a2b0d3f88cfd

SHA512
444f7c6a26d88bfcbdf2419e8c2c116d8f9b11b5c2bb00d087a0745b05b35a91af3e084507c4e6a8096bb07e0018033f80482edb4dc873df2a4209a09775131d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
060a7bab2486721d46a9c84fa37dee31

SHA1
31d77130d5f64f0358d1f689c42e599aed94e57e

SHA256
90064d8132d0b7731fe4400e199a088bbe733b9390d8d84f921a475a2b44b2a9

SHA512
69004626d6af874d56be723debc6b60ddd0471df5e808bbb237924a384d370218bca09de5b32e4d7b55338ab323e6794c16641c1c4b5089fa0d675873b19cc74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\datareporting\glean\pending_pings\3d7463f6-d076-41fb-8dd0-33567854f72e

Filesize
746B

MD5
3ca5f06e8a90ed5301586e8926254386

SHA1
8af96751e45499a37c5dd03d6fbe39f9839639fa

SHA256
4a21f91a4b110345c6c9a8270ac0c67819302890df5944178c5fa87146616ace

SHA512
d4b6b8e7a040738477ff6d2d7125e2da2e44c9f65ec726c9631762370f4f5b60ebd99d9ba55dc0f79e246519537e536bebdaafc35a2b30cebbc8c0cc279ccbba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\datareporting\glean\pending_pings\9ebf6b95-d204-455a-84e9-227a922a98f1

Filesize
11KB

MD5
ea6b373c6b1aedc4dad9b3e6ee5f5bba

SHA1
6f947bde57ef600bdb7d3677d9a932f556d0cd43

SHA256
0217c4f00af1703f87eb4fd0018a8a7047a3997c528634f3e167d36a0d702228

SHA512
31d1ce491b6c30d60a53a6c9327620ab2c984503729012f96a9958a68990c97771982907db15e077b4184b5512496119ee614bfa8070ae665cca3ae039ca3b05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\prefs-1.js

Filesize
6KB

MD5
0fc31e09b12310668723c7e94386c0d3

SHA1
fbd4a082caf0be228b40d54a7474ad6e6c6bfc16

SHA256
0fdaef985a592cc195395cb70d99c50bfdddbc285bc0f649cab0772fc21eb130

SHA512
84984324620022c491e9c6939b45fd8e0f642824856d1f11d61e8348402c80b96f3c108312fa09ca3adc98069df4cfd9db18b162b3188400df5bc53f333c47a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\prefs.js

Filesize
6KB

MD5
3827a7adf40babc4bb05d534611094d1

SHA1
231009ce25f63ff1c398a0763d6794d2be29312b

SHA256
2e53f2f1196203dd31da08b8aa868bc1f1af858162e29f26df4a0a5c5b38d30e

SHA512
45cfca25f4302359db631e9c7adff543b2482c5077eda205795f3a45477c7f1f932df99c8e095e76608f682484662e31a2517947762146c589e5c16cf0c6038a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\prefs.js

Filesize
6KB

MD5
c0c98e36183fad680eb5abe512d1c7d9

SHA1
d9e0a2a6acda4bfc6cf176f76f2a9ad6b61a26ba

SHA256
52ec5bcdb87a79cf00839f803fedd3ac6514311c0821810a56bc975b92f73103

SHA512
fd5ac16084af02d84ba683006d0af477d470cee8b681497b8f4d550f46677e1316cf6894b07967930ebacf475b6e13a1134cbb952b0b8a5b9d80e4eb2f8ef0c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
fd062d716c19c95dc64b1af15ec8dd12

SHA1
bcd1cbdccc3a84e809940be54ad0735be0788a86

SHA256
8556aff59f33e63462ab2d4ea018a2f190f5d1154b0fee861af865aac5a4f8b8

SHA512
2ae43b99120ab9ed12429800ab5cfde8adfd8137dfd4f5c34eb233c5b67c054fa0c52459820612ce809ac52288b7858ccb1ea7a62cb49184f9e9c7f3af263bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
604fdca5657e4237159b5474a86fd8d6

SHA1
8b62765ed382f1e1773ac11f21574d6d7080f777

SHA256
34791cd9b6a93884a984941a5edf97e2af16ba5430f72ad83a3dced3747a47cb

SHA512
4202cdc6dc157f61c4d98186de6d3dc74996f4dedd1cac6d20cba63f7a71943e280111c9ca29eb01e9baec204004715d6629d7c5d7a09a69eda661f0ba2ba66e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1zsiigt9.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
59226428b29180b5796589ff01e5ce19

SHA1
7071c242d0c636b500533dfa12e153564a104f5f

SHA256
c7fc3bb4ad834976b42d9d592941bcae6ed392ac2193b06e1b9658166da27d81

SHA512
b754e42a72f8161c792ae4a25bafed3ac0d7b05dc2f6b1ce4d2063c8f3961e0c38bd1792f1d80aee9ea19aa043ce14a590ad84448b6069ccef9e106639d60ea8

Download Submit
memory/224-35-0x00000215075E0000-0x00000215075E2000-memory.dmp

Filesize
8KB

Download
memory/224-0-0x0000021508320000-0x0000021508330000-memory.dmp

Filesize
64KB

Download
memory/224-16-0x00000215085E0000-0x00000215085F0000-memory.dmp

Filesize
64KB

Download
memory/3388-133-0x00000205210C0000-0x00000205210C2000-memory.dmp

Filesize
8KB

Download
memory/3388-365-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-358-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-357-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-356-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-355-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-354-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-353-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-352-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-351-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-363-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-364-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-366-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-367-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-368-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-362-0x000002050FF50000-0x000002050FF60000-memory.dmp

Filesize
64KB

Download
memory/3388-265-0x0000020528A00000-0x0000020528B00000-memory.dmp

Filesize
1024KB

Download
memory/3388-267-0x0000020526F00000-0x0000020527000000-memory.dmp

Filesize
1024KB

Download
memory/3388-264-0x0000020528A00000-0x0000020528B00000-memory.dmp

Filesize
1024KB

Download
memory/3388-148-0x0000020524200000-0x0000020524300000-memory.dmp

Filesize
1024KB

Download
memory/3388-130-0x0000020521080000-0x0000020521082000-memory.dmp

Filesize
8KB

Download
memory/3388-127-0x00000205261D0000-0x00000205261D2000-memory.dmp

Filesize
8KB

Download
memory/3388-124-0x00000205261A0000-0x00000205261C0000-memory.dmp

Filesize
128KB

Download
memory/3388-123-0x0000020526180000-0x00000205261A0000-memory.dmp

Filesize
128KB

Download
memory/3388-122-0x0000020525CC0000-0x0000020525CC2000-memory.dmp

Filesize
8KB

Download
memory/3388-120-0x0000020525900000-0x0000020525920000-memory.dmp

Filesize
128KB

Download
memory/3388-109-0x0000020521B10000-0x0000020521B12000-memory.dmp

Filesize
8KB

Download
memory/3388-105-0x00000205214F0000-0x00000205214F2000-memory.dmp

Filesize
8KB

Download
memory/3388-77-0x0000020520C70000-0x0000020520C72000-memory.dmp

Filesize
8KB

Download
memory/3388-75-0x0000020520C50000-0x0000020520C52000-memory.dmp

Filesize
8KB

Download
memory/3388-71-0x0000020520C30000-0x0000020520C32000-memory.dmp

Filesize
8KB

Download