adbfaada11f2ed50e60f9b86b4fc742fec191645c8d27c224314e5e8cc4c50ce

Resubmissions

14/06/2024, 01:30

240614-bw94gazdpg 1

14/06/2024, 01:29

240614-bwc4qstdpn 1

14/06/2024, 01:25

240614-btaktszckh 5

Analysis

max time kernel
1799s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

triage test.txt
Size

9B
MD5

91d3f6850d5f17b54426f57175391aef
SHA1

889cc1b4a445eaae329d1b78c10facd2b76bbda8
SHA256

adbfaada11f2ed50e60f9b86b4fc742fec191645c8d27c224314e5e8cc4c50ce
SHA512

e677401a6c6240bc35f1fe9304b8af415691a7494968c4b19697ed7e234a3d396482bc69b37dfd38b227bac51bdad49278ebe31b070337c859217798f48a0a12

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628022364035169"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5096	chrome.exe
5096	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe
Token: SeShutdownPrivilege	5096	chrome.exe
Token: SeCreatePagefilePrivilege	5096	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe
5096	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3252	5096	chrome.exe	98
PID 5096 wrote to memory of 3252	5096	chrome.exe	98
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 1980	5096	chrome.exe	99
PID 5096 wrote to memory of 2004	5096	chrome.exe	100
PID 5096 wrote to memory of 2004	5096	chrome.exe	100
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101
PID 5096 wrote to memory of 4028	5096	chrome.exe	101

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\triage test.txt"
1⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4604,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
1⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffda2c8ab58,0x7ffda2c8ab68,0x7ffda2c8ab78
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2272 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:3540
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6a919ae48,0x7ff6a919ae58,0x7ff6a919ae68
    3⤵
    PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4900 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4608 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4792 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3176 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3064 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2360 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=244 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1488 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3516 --field-trial-handle=1980,i,18438503303292889358,4139170382110251533,131072 /prefetch:1
  2⤵
  PID:3668

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d17f2ddf4b9ae83671d77bcbe3f393f4

SHA1
b333d69980b16e0bab306ee4d127b2bcba8f6daf

SHA256
cd05f4a5cba198467a2d548e7e09fed222c9f88004fda671757c1ced951363ec

SHA512
0535b78b7a75ac6061b076bb70442605e8ae1d1746b45cb077925c9c842ed0af1203f05141e097edbbf8bb9d325e11e41ceeb1e49ff4b2adb4d2c8875963545b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a301f96c4d49a5bf7fe3e57b0d51ba48

SHA1
1ebf301b9fdef833f24d17b6f7cf06531c84ce47

SHA256
7b2fe84b2d71771af904b8f6f30ddd63360f1047ff10aa9cb0ddfcb114ee0cfc

SHA512
b8f26640cdcd954cfda79b6d6e2374039b33819ed4f607bf37c577d757bc6fc6a9a309902cf7ae3e47c8f91c4a585f17baa1736fb6fdda92d35f2e3d33d414c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
a870efdcabaea7c8a2d9f570a7da8a48

SHA1
ba32be8b4561582141f0cb45a083f72fa3c1bd37

SHA256
95075fc666615d9222dbdaef6010bd82a40d263cd995813c1bbcd3c63e227fe1

SHA512
b7353a0d3009151f8122b61a94d9013e2f455838b7b89444983cc1dfcfbf623f487972a0e5a2b63441fd12c55305e53b1b1cce3ff3de525dc122af5b2a01828d

Download Submit