hxxps://www[.]roblox[.]com/share?code=2f73a511ac78d641b853a58d45b4ee94&type=Server

Resubmissions

30/04/2024, 05:41

240430-gdw2saec6x 1

30/04/2024, 05:36

240430-ga1wkaeb9w 1

Analysis

max time kernel
50s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com/share?code=2f73a511ac78d641b853a58d45b4ee94&type=Server

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589290513017398"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
116	msedge.exe
116	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
1836	chrome.exe
1836	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
116	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe
Token: SeShutdownPrivilege	1836	chrome.exe
Token: SeCreatePagefilePrivilege	1836	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2156	116	msedge.exe	85
PID 116 wrote to memory of 2156	116	msedge.exe	85
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 1664	116	msedge.exe	86
PID 116 wrote to memory of 2948	116	msedge.exe	87
PID 116 wrote to memory of 2948	116	msedge.exe	87
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88
PID 116 wrote to memory of 624	116	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/share?code=2f73a511ac78d641b853a58d45b4ee94&type=Server
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99d2246f8,0x7ff99d224708,0x7ff99d224718
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2324 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6879664277578608934,1690382096829820413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff98a4bcc40,0x7ff98a4bcc4c,0x7ff98a4bcc58
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1992,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3144,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,14631433726049237571,12086298929042973048,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:5868

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3613d3cb6aa6243f9721c3c224d2f6c1

SHA1
06ed3b9e78ef2d06d76d7231fd8f3a78cba99c72

SHA256
4af1c65c70abeb7eb894019ad4cc69ce7db31cffd1ffd9d0d1d80dba2ed8d8cb

SHA512
d9bedcf0a117d15bcbdb165c29af7f6140f1565dd304e66530fca5bff42bd14f57f09c25d37f27f06dae2a9964e8552322f754195fb13c244551b1514cdc372d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
de330f0fced638346b10c8ac813811c1

SHA1
755b712d83de2702207dd11719533e4770d4ff11

SHA256
2af8d00b0eec673801511692837057bee031f0d0d8c06cc9ad454fedaefd047d

SHA512
24b8a8206c3d5065a755b031f27fda2efe8ceac6826e00542009ed9e3690b86997c7ef01239293080db286445690f5c35ae1045be4ca17f0359e37e115133db0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
77KB

MD5
9abc210892dda533cdcc60a9647a2f56

SHA1
8c9cdb67a4e5b991305164cb4ea8fc0276d11237

SHA256
5c3a45d8d5e560e18b4e2dfed6d764f7d48880a8cb8fdfe45611731aaf674968

SHA512
d34d72c84b461dfeb817ad72b0394dcf065c9d22a41e7c605144ddefdad7117f1990d79e3fddd480d763e110bfd7c6a68b53682c0e7e36070961e346ace750a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b931719bff96039690337e576ffbeaf6

SHA1
e7f4ce029f6d922e6601e827f2eb23d597a77641

SHA256
719cb3d2e7d03d08d1bdf9fa4bab15683530336eab3f7598a0f25628d48c23c8

SHA512
9480ea34537e7246381aca0e0b5b515683736d2ce923ef766df9c0e62df73c12d7de2bf6dc6e44a18c50bed1234ebe715ef6dafbfde3ff2d100c25bfcd844397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dcd946267ef3f58c72463099d1e40df

SHA1
0bf4bd133497995b301c412465609442ffc21c6a

SHA256
66cb726ec4ae6bb62013039cd913221fd07552041b99774c81698a5a3e698b3e

SHA512
efd06698cd4e9f65361df989388e13b4054927f5cdd07047711af8e38ac532c2bea585a1ff355bd710adecb3d516944322ed0a85b0a5a0e3eb9ca4899bfd74c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9f185227bb33c91947dee075f71429ba

SHA1
568ebce7c990c2f81c45d8326a928c2e610341b9

SHA256
70f9a224068d6a741dd296ca4d78ec1cd2f26a604dfe7353af07efd15bf3f749

SHA512
0b79c05986827e9fea154fb905a335955c3561deee8893e36e9efd10257724748c93a17d93313717d5ed2f943c8c30896de188e3e6ceabec9ba162b0a65703d2

Download Submit