hxxps://bitly[.]ws/3eZcj

Analysis

max time kernel
113s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2024, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bitly.ws/3eZcj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579324588265101"	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
2456	msedge.exe
2456	msedge.exe
5012	chrome.exe
5012	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3588	1840	msedge.exe	81
PID 1840 wrote to memory of 3588	1840	msedge.exe	81
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 3564	1840	msedge.exe	82
PID 1840 wrote to memory of 4664	1840	msedge.exe	83
PID 1840 wrote to memory of 4664	1840	msedge.exe	83
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84
PID 1840 wrote to memory of 1808	1840	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bitly.ws/3eZcj
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef4e43cb8,0x7ffef4e43cc8,0x7ffef4e43cd8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,8826876595936199531,14822570322220720690,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffee3c6ab58,0x7ffee3c6ab68,0x7ffee3c6ab78
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4816 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4744 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3324 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3340 --field-trial-handle=1928,i,4221328293295732541,17045792672765434549,131072 /prefetch:1
  2⤵
  PID:2004

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90494d90-0a29-400e-88ad-c10c16e29990.tmp

Filesize
6KB

MD5
11f6932b8c4915452fc3f83aa24c9ee5

SHA1
cafd113cf1d4bc423294998af6e0c906abdd804a

SHA256
c49bd009cd9b2741742552a462250a235722636427abb02c6b8e5e615a55df37

SHA512
8bd84d6bad28ead811d477a0744f91f318009247e3e87cfdff473cd7e4eb4c806ec5151dadf7ea6d71e2168f4bace13fffc8df2dd9cd3a25ce4c87b8d2bcb047

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
e4f86eb2909b12eae09c58dbda014301

SHA1
2e4a0a8e19953186041957ccc13e39b6ef61baaa

SHA256
e252d63e07a112d3119c0d57083e1f1b76f74af70f841c4e7c5256eee18169b2

SHA512
cf60fe4a6ab5ec8a997e74372abb72a6b989d956ed9bc0d60f2cc78bcedd43fa99438f9e70c85972653f1f77e2669f338df3d427207d83782f3f20e085500193

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
653098d40391b982c1db19ca5d417fac

SHA1
b593a34e05f98295f34aff311e6f5a83d046859e

SHA256
703790421d513f50711bc5f9ced72a93c4f99846a0c56c9b6a6e059e72e94027

SHA512
7332d43c90d84a2c0d2aae0df89997ca69c752f9176f9283342963507ff8cf5b1772f8ecfa42966adbfca2659f5bcf45a8c382d669ff09fc85ac8bc79f0396a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
4840a3d911fec7827f41ef4d6b2f6920

SHA1
4b9cd3ec5889c0f512f0122b9cc98105a2fa4724

SHA256
d86d0687f440f767a94f629fd8aa6e44ae8b2f2013fc74683395a7323ff950ac

SHA512
847ec074aebfaf842c544c7d8716f80a3f9d8ad93f5e388099820b096d6a946af937939484799e4c7476ce50f820c2e884fdaf499e671000a87ee9f5e1badd07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
127KB

MD5
771e951f169e5a6773e8fc9582e80cc3

SHA1
c0aa1e5e70a34ea736080c88842f4845f5ca146c

SHA256
2d1467e77033bc5900ce33a33c81d2bfa1ddbdfb2f45123260f2c496cd82312a

SHA512
5c5e80f1aadf8d2d1a03f05dcd048e036ed8848dc93ec30a018abcfc81b207f20421e341ef6ecd8288b904e8ec75d03f51398355def00fdaf50b7473bb86fed7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
252KB

MD5
e7146e1d5a0f6448d2aa5c2d69050fbd

SHA1
3d6f7101b517599ad2ef53ac9775a46f3336ca9c

SHA256
b2bd2860dc2e1d858e7e27bccda8334565e3c543087b96dbe7926eb59bb5f780

SHA512
edda0083276e2be2e3e70ca391509a0c2269829d263122f7e8814067416c15c248563ac027bb64ebe46687f29dc376bbbdb5955d75abd6b9f50bc775ef10bb95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e51956799fa67379ea02ed281264a0e4

SHA1
e8f9403225aedfc94b27d902b72ca6591858d643

SHA256
6f3fd42d136b90c98ace40fb6b1522f1b9a1076b431e5290f89cabb4948c3a57

SHA512
c5e017b2b06bf486daa64612f8bbe5dd9f28633d6dfc434f1605c2f36cc08ae6ae40c187316fe1ff998ed7346deef35a66cbc445f2adbb273ac928175e735391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0d0271cd8394035d3f04a57c4376225

SHA1
6ef25cb6b29467e6a659b8dbc28b52006778dabb

SHA256
1c8016ee1208109e59206f98b68b821b61f1cff2ab3852042379b3287674c42d

SHA512
b856d97096d0288fe0547b484abddce5fd100c080a7992709b0158b7e2d498c9820ba54f99b6b71056bdff7f0d6ceeac87793ab074f126e506aee2c83d2523ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b9d100113e7e59c89a97d8a6cb12474

SHA1
1a06d25d345a063cdbdd20654cfda2906dc6f607

SHA256
3658e15cb7ac80abe23ebb249ebf10d4beccfd995d9e449c07066aba8ef2acdd

SHA512
91de07f1d79c1c922466dc835bf1203745df3ff8e6379b67e3aadebf00fc63fa42544bfb72285590f68954d52341857e165e6eac509178b68e6c575f894f9b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
627d12b80179a9efd4b56cd92f368eef

SHA1
057ddb1502e221fa4c1a52016e9438be9a111663

SHA256
36ce8fb67e8207348445e6e54b578b75b82c5a8fa93044decc056f1893a92590

SHA512
d3316a9bcab83fb5b43cd342b2ba13a9acf0ee4197ea6319aa1e868b879c159a32f3a8cd00efa521be90c2996eeeba43edbe0150c6f78665f1d00ef386fb24eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8cb48bbfd1829e973c2e11e3ef632e36

SHA1
6cbe7090264d71e9cc38daa4c6b1c85545b80409

SHA256
e9f89208500e23707173bd3933fda3154418b7cd0c852e3e05d2b24dc8cb7c50

SHA512
143a4bb68ee19b19aed3bb53191f51aee8a58a9c88c904ba75c04aa70ecd12926eff7aa12802c5a2d912e56957ac4fcefa23194db17219002ba42956cd95c83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
71b0834ef4e971731562a35970933306

SHA1
8c63ac528270fee321908922243d40ccf41628b9

SHA256
ae2de64e9520b8c3bc313ec17d7f61a5dede85b4046e3598b8b5f084f0fb2cbe

SHA512
6ccf098387759a4185e933ba9651d7e7e5e41058ba62dbfd2e89183eccd8c6c0f00265991fd4ba547dfbe1386c4bafa48da350cd67e74ec11967b62797f5a9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6096b6c2493436d7b137579c8d68dfc8

SHA1
44f0e2cc528511ba552b401581dff00d54fd26d8

SHA256
ec39e4f1574bcd853491546344915ebcb32411b531c8b4f27d5e01f1014ed7d3

SHA512
5263f2e1d8ac5e442814cbbe5f99501161ed39ffdc87f4b484e5be4897b5a3068994c350fcd91f1e0b3a8f8122c4ce85f425a0c2fe963e73678388a01ac0037b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0cc65c831e71f8ebc8056aa5845fde48

SHA1
e58dd477b5d82686c4e5531e77e0445f2794a34e

SHA256
d0ae50ef49760c7fde185e1ff01dea37ec966c895c39b987b138442f678a10f9

SHA512
eb9149f22565b690fb5dcda624221465967f7c8b5d79fc3c8d2de46dc3e3b1cf54b4c86fcccdc9db4d7e4995d6710942c321db02df8794772b615314b51bba34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
29c039b98ec5287b875358f832057552

SHA1
490ce8419033c66d1700ac0919e8b5712b90934c

SHA256
7e60d6b799a1dbd28b4e02a8b2bb235ecfa7bb2fcacc5cb4ebd35b3bdfbf2ae7

SHA512
b82e322be48c210c5b9480117ff24c48e97da0faeb2a387c96811ad94e3af0392c2da7425ed16432ef4bac5d434446fae798b3c8c796c708da125054ff5b2346

Download Submit