Resubmissions
28-04-2024 11:53
240428-n2lpaafd4w 1028-04-2024 11:46
240428-nxc7caeh86 628-04-2024 11:44
240428-nv8kgaeh63 328-04-2024 11:38
240428-nrq61sfa3v 1028-04-2024 11:36
240428-nqwecaeg48 328-04-2024 11:35
240428-np2vqseh8v 428-04-2024 11:20
240428-nflgdsef8s 628-04-2024 11:19
240428-nexs2aee34 328-04-2024 11:18
240428-nd8txaed99 428-04-2024 11:16
240428-ndgenaed78 4Analysis
-
max time kernel
52s -
max time network
52s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-04-2024 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Challenger_Template_Top.png
Resource
win11-20240419-en
General
-
Target
Challenger_Template_Top.png
-
Size
1.0MB
-
MD5
ab09f1f47da2fa0985db425337d9ad40
-
SHA1
8b517050bca34bb74cf609edefad52ba6f7234c8
-
SHA256
5f120765ecc80b6e65c276515f332e7564ccc22acd162ccaef4ee13f06289a21
-
SHA512
2c3b505512718225a1cd276ecab3fa968dd3efc7889679cdff33caefbd84ef5d14a81cccad3b794fdd40b9fc1baaeb895dceb8d95fe04de0f7ba5c6f70af95cd
-
SSDEEP
24576:uuITarDwiGGs3zWBZ9wcqyOIiAC8WfBqcGBXST:HITiwiGGs3zQZ9wcJ71WfDGBX2
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587767279997706" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exechrome.exepid process 4876 msedge.exe 4876 msedge.exe 876 msedge.exe 876 msedge.exe 2996 chrome.exe 2996 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
Processes:
msedge.exechrome.exepid process 876 msedge.exe 876 msedge.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 876 msedge.exe 876 msedge.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe Token: SeShutdownPrivilege 2996 chrome.exe Token: SeCreatePagefilePrivilege 2996 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
Processes:
msedge.exechrome.exepid process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exechrome.exepid process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe 2996 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 876 wrote to memory of 896 876 msedge.exe msedge.exe PID 876 wrote to memory of 896 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 1712 876 msedge.exe msedge.exe PID 876 wrote to memory of 4876 876 msedge.exe msedge.exe PID 876 wrote to memory of 4876 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe PID 876 wrote to memory of 2192 876 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Challenger_Template_Top.png1⤵PID:2124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffc01d3cb8,0x7fffc01d3cc8,0x7fffc01d3cd82⤵PID:896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:1712
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:82⤵PID:2192
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3200
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:12⤵PID:3648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,98886259139570184,14906430447815828348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵PID:2200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2996 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffadf5cc40,0x7fffadf5cc4c,0x7fffadf5cc582⤵PID:4436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:1472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1772,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2028 /prefetch:32⤵PID:332
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2188 /prefetch:82⤵PID:2216
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:1880
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3508,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4492 /prefetch:12⤵PID:4164
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4896,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:2212
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4544,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:4604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3396,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4368 /prefetch:12⤵PID:3648
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3488,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:2452
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5156,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:1208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4612,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:4876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3352,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4488 /prefetch:12⤵PID:4608
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5244,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:3916
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3348,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:1620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4708,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4868
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4752,i,4547820340938053915,14297272460965066028,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4656 /prefetch:12⤵PID:1380
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:2656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD5244d71272735aa07212f27fef3166c91
SHA10c2dc1994ea399070ba71d43e05382facc7abca5
SHA25653da229cef3aa46f443242256886e5c7c72725b33eb7b712037dcddfa7bf19dd
SHA51247871f0c3d1537f6e1f0833e86a2fa3d3bcc20610575e963bce23999bfefab5075e3a6bbae291ba34c8d51777af486b860b4f9c01203a6a5213b3eae1dd830a4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD503d984901af93e4c5b167b27abdd42a2
SHA11ba6aad159415b2394492b64592b0f2a34c59d04
SHA2560accb44626f193c29e3c9fd04f650dce1f41d7d662c92cd988c4b3f56eefddc9
SHA5126c35cb3c8b07a9b71742b8548e1ff057ec6e5a14879d8b7edf01af6cdbc8ceecace655ea2aeb4ddfd84708a6af25ab20d2f4b7a3be126aa5e46a660e36bbd6f0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD503d2dad3cfb46f599bb67937b966ea1e
SHA1b937c104ee545551240264f53cda48fa3bc30e84
SHA2564e189fffe9ba22a09f903582cf4d4ee5272b3224ee84e7dc1cf690858dd938a3
SHA5122d2848ce964db18906e633fb6ec9a2a0c4b769e007a3b7b784f663b617148a2aa2cd5b4a2da958b2d1d7a87af21a13d2d453a6977537c2b756c541ecfce22a58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD56354d2199e7e5aa457bdc8fdfafa0511
SHA10b2f3f79d1f222f6c1b8f349e4a8c6284526e22b
SHA2566c63b278c3dd106c5d40e019c4d5d693090c8ba23711d37bb9a8c324ca949416
SHA512e214b11488ef2d4a8dc82206aa0d0722e05e1b6a79e6e861ace70e9bdfc6c3c59d4944944695ee46b93830cd5633f6c5c23b2cd523b200e31c66a67aa342922a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD5916c320edf26c061892120b72530522c
SHA1a225cb83a8e6bac2f327a4a9a4176c1c0a818cdc
SHA256d4f58304a8fc6799b24f659458a96b9ac27ba135ba3693cfa2bf36f885678796
SHA512b921181ce300a7f097b44047efebf68fa9a1c3801f0c9071e3c61a21d5056ae76df27b9ffb41b8204648550217c88c081852d708dec6943447df5fadeffa8471
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD58b1b774543c2d4891a27eecd89a3708a
SHA1b70c83da8697c36b0b86eb78914cdb9bab7994a8
SHA2564f343965af2fc03a5a3586ea4a1427adec86eeee8f07da3beaab03db1aa245b7
SHA512764725ed38f747a46fb647ff95f72a23c88d3368d7f2d0fa90ee35c18ad9222b4713d0f10fe1d06abb1211978f20f2d0e12936dbca28cacb7efd5127b0cb1cd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD55a85ad170d758e61ae5648c9402be224
SHA1e6dfce354b5e9719bc4b28a24bb8241fc433e16f
SHA256af0da8b5ad8127ae0ef7773bc9c4b145ed3fe7fbef4c48278649e1e3aa5ce617
SHA512641414d91c993f74b6b71654522359d606c7f94ac0fcca6478d1bc33c30f4a9fdb9ce6f8e281c79a2f9b9670fda8a4ccdd80e7d64347c1f66d8c9ef024bcb09b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD522cececc69be16a1c696b62b4e66f90e
SHA1b20b7f87f8bc64c1008b06a6528fc9c9da449c2f
SHA256d940b85bc83f69e8370a801951eb6b8bb97efbb3aa427664105db76e44707258
SHA5122b2e548f2c8f84d321ef2afdf31128065c3593b884ca8111b05800960b5378b99c7efa6165d02fba4c11e6e4b49b14e419d89f76d55ef574f4ac2b7d6ecb3d48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53d1bcf5f32963b8d76be684b1952bf75
SHA110f6eae5dcbff71d85352e1f1d00f0e09d49fb27
SHA2567c45756d5f465200c3c49a9c95e2188fb2773d09d0b64afda5c14d0a4a3d4557
SHA512038e5af234a4651e388d17d238f02f7fec77546453dcebe24d2024b663c96c9e4d71bfbb9b7e5b7681dafc179af980a8ce30a4fa06ffb0ea4f3677bd80590a1b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD51842b5962f93104603f7a630d27b1776
SHA158067b02000dec6c777a345a08219f8d90edcb98
SHA256578d8528f77aadd10d6427d8c8e409ad7ab29ab971066824cfc8d182695ae73a
SHA512a3027a1331bd7f736293f5c829e9ccf65039a0c3a37795cb990b1ca1b3d9f66b4f07c3d4c73602ef147a3eaa7426fe38daca4fd1d79258369834858f1d233443
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5bec2df067e41a316b99b92cca7626860
SHA17f429c958e6cd6375772d0fbe1d057d0a74e1bf8
SHA2562d4a4f49d317f8a2a5d9b6e6cbe72de5fb5f8421b668d25fd5b8858a456392fd
SHA512224aa95e822df88c7c9ee9834f1a796bcf6f6d1a1062cde974416b54073ad09afcbe2ecd5cb5f9eb989c36f21eb47b0a8663aa7ec8bb7b6bbf2fec2eefd2b505
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
\??\pipe\LOCAL\crashpad_876_NYLTINUTAJIHQEJEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e