hxxps://url[.]emailprotection[.]link/?b8HbtdsjeyyYyUMWggHoEDLKEWWr4jPIyGLyCgWAkk8xdQHicDm2hSYmsHwfsT0PEk97S4v-rmH753uDaQlgIWg~~

Analysis

max time kernel
42s
max time network
43s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
19/07/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://url.emailprotection.link/?b8HbtdsjeyyYyUMWggHoEDLKEWWr4jPIyGLyCgWAkk8xdQHicDm2hSYmsHwfsT0PEk97S4v-rmH753uDaQlgIWg~~

Score

10^/10

bankofmontreal phishing

Malware Config

Signatures

Detected bankofmontreal phishing page
phishing bankofmontreal

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133658914347757446"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3666881604-935092360-1617577973-1000\{91434674-EADD-4B92-B3EA-AB3C00FB101C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
3264	msedge.exe
3264	msedge.exe
3188	identity_helper.exe
3188	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
1312	msedge.exe
1312	msedge.exe
4872	chrome.exe
4872	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 936	3264	msedge.exe	82
PID 3264 wrote to memory of 936	3264	msedge.exe	82
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 3512	3264	msedge.exe	83
PID 3264 wrote to memory of 2996	3264	msedge.exe	84
PID 3264 wrote to memory of 2996	3264	msedge.exe	84
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85
PID 3264 wrote to memory of 4536	3264	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.emailprotection.link/?b8HbtdsjeyyYyUMWggHoEDLKEWWr4jPIyGLyCgWAkk8xdQHicDm2hSYmsHwfsT0PEk97S4v-rmH753uDaQlgIWg~~
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcecc13cb8,0x7ffcecc13cc8,0x7ffcecc13cd8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3168229845305777335,17793592197057468654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0x104,0x114,0x7ffcd965cc40,0x7ffcd965cc4c,0x7ffcd965cc58
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1912,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4736,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4916,i,7741285282053180781,3005128034258000188,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:5124

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3499c68daf1d34e7a27b4d55762b2b4f

SHA1
a0f36361cad597531b5279e93e6303e06f46d55a

SHA256
9b00f952155c6f7b4a0bea82e8bc9948504d4285f90e34af58b86dd683681d1d

SHA512
7cd7e82379d3a9cb1cfbfb6029f52cc7173fd961860c76065d09adf0ab0a3a79014050f1df3de48d8935adb809402c93f3ec1e7cb9d94a7c186ba8ee2852a33b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
bce0ed527893c1ff1c05211fe5716b4c

SHA1
0767dc03aba467bb6c90b036c32d9b08b31480fd

SHA256
dc790f57fe498366ccf621162957cbaaa4c869603a93145b26e6d3655583abb8

SHA512
d14bdf57c13ff636c825be70f3596dc8784d2c476b58c2f31b30bdc3988d51c72a5cc143afb183199d8dcb518dcb13836044f975217c19b952170ae976b86e5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
91b0360cd67c19976b6917552b70a1d7

SHA1
64575152c5101d7c14273dfa4fc4580b7269cf14

SHA256
a3986ec0e6e2533d1883c3eab14f8929a76b87f173a83ef6ede30e95faf64cbf

SHA512
71ec0ea04fd9107d0b6da0cebcec3d39e29749e1bcd376137520f5bc5a14513cd99a091e9de065956d36e903d05dd52c75781c5645d22461db2dc84ed4617312

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
51025504e9120f0615d4c9d16327ad35

SHA1
6b443ac5a06d5ae4ccdb141249a515484fc0104f

SHA256
7c15164a790178ae1f82f6c5e63c829e3e65df0ad9fad4f99872de102fe36fbe

SHA512
b91f358e00b2a3548f1c35fb9db38d1cb684862841ad7df6d6580ddc6e628c153183a0eea96dc586c34c4037f5195953da85694ce129a446d59249cdbbe73d41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
185KB

MD5
8369e96b6c1fbaf0b62afe4f2c5bd09d

SHA1
332897acd51e7d66c81f544dcfb83130d27b4592

SHA256
7843fd8a63941375fcdc8893e9456a0b9743fe04255ce1b028bef4e34e680c71

SHA512
3d8a84dd355528ae440919fedebbf928551356630613cac136487503fa8c08818fbeb4313e0f408e9860f34451f2c2cb810a4b0f6caea1c8cf272c65171f594b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaeb604a99d78c4a41140a3082ca660

SHA1
6d9cd8a52c0f2cd9b48b00f612ec33cd7ca0aa97

SHA256
75e15f595387aec18f164aa0d6573c1564aaa49074547a2d48a9908d22a3b5d6

SHA512
1091aa1e8bf74ed74ad8eb8fa25c4e24b6cfd0496482e526ef915c5a7d431f05360b87d07c11b93eb9296fe386d71e99d214afce163c2d01505349c52f2d5d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fe10b6cb6b345a095320391bda78b22

SHA1
46c36ab1994b86094f34a0fbae3a3921d6690862

SHA256
85a627e9b109e179c49cf52420ad533db38e75bc131714a25c1ae92dd1d05239

SHA512
9f9d689662da014dfae3565806903de291c93b74d11b47a94e7e3846537e029e1b61ad2fad538b10344641003da4d7409c3dd834fed3a014c56328ae76983a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
d2a91d9bd81ed1294dfab69d5f6f6834

SHA1
d1705dad3fbb534f7b4924f9d483bccc0b6d5dbc

SHA256
a3eb96e68b8372cc1fbe4dae2008ce0e1f52e3549f9c5e12fe326fa941929db0

SHA512
cfec28d2c8b23f66b9ce65a956fbc77327a76927c1bd3017ccc401be79a7537f3b1151482aafef08d93a94643f789847321cd41a0be488441e6143785d8c40fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fac5e691267d7cc9d97ab5a1613fd5db

SHA1
64b91324ac543db12e9b04655beb96f078dd3c69

SHA256
a92f81a2438f9699c7abb02c7a7d0fcaa6104d6ad860253a84a982fca48fc71a

SHA512
0b11730219fe9a25b3ee07cc3612a08266cbc301ba62aea3b53a982ee04fe49a4fae80b1d5b17f13955904f570bd32235033da334c0b57f91b663f84fd1b8e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2308a577eee66701cd21f94918ea520e

SHA1
7d63ce2130b41c8eca950589dce3b2e3e3f2e9b0

SHA256
f49c1565ecd0317d1173cd8971831f0435eb4d0d68f1b6c085cebced1f3c57da

SHA512
384d41fba3f62683aed3c48e50192c9eb1895738f49ff59339cdcf40b4511893920d3832dd3f5c0e64ff0afa0c1bff20c655316248294067225324888b701c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6df166bfe2898fe85b6fce1068971e7

SHA1
58faeba4bb76e2e8dcf92da8538373db86bce0d4

SHA256
2ed12c85530ec878e078516c15bcf1062b300f001e1661ca11f0692d39f9f81b

SHA512
93f6535e8e9058ed6406ff1e77d528426ef63207d17d1dec996e41002f294c499c0bfdb5db2a7f8a16e2f2ce5304c439a7b37a3f0640c25e06f8024b676a7b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9511b9279d127fb23c53030ecf4b31c3

SHA1
ca3d1960c3ab234a56c6c529aa87b28605308b14

SHA256
be59862a94292bb80d62919dead6e24e18a568329179923587976aff48bab4d8

SHA512
dde6bd822ac30404e3c69c057ff07dda0afea8a5f60b2a7806cc0903ffec56acada35befe8ee5ca40ae84c21c57e118d0c440fe7b2320a5d2061ede9d39313cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580887.TMP

Filesize
2KB

MD5
2599b0dd491d1e017b02b049b4b5f857

SHA1
41f83dc350aef71a68020d67d04ddd37b959e467

SHA256
09d726fe4f09b288efc35f3fbad460de92aeec1c87b9ee4ba195630a29815737

SHA512
9bddd2a93a4172396d8ec046f11a595a6fe204b87562232d99b1b2a2286a147d98688ba5ab4f41b4b30faf845dc1789ca85a08668a00d06f882880721d45e836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ecdf9a21e92ed870db04026cf1362818

SHA1
9c9f9b917c159487edfb7c6c7c79fad7dd60e4bd

SHA256
0e40e8652876bc4c89ee8558d5b1e5a05dfce7e2f4f23fd55ac6172572a84e23

SHA512
8edb17bc1a87bba6349ca968b0eecccdd204af10bf8183d97f8c47bbb710af4a4c4ce36ba7c37b95ab93155dc98ff2117f047af6c97b34c1eae6e445532a35c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb1c0bb8b7a201e0a56a0e3e0230db4b

SHA1
3e0187fbc02544d98b68af23b18ce20d0444f1ce

SHA256
f8257c5b3bf0ccc24e1222c22b3e446655ce82b9098205d3ee8027c3dd52df5b

SHA512
e41f0a4797f2971a73be9f988d21cd32dc75a30a8f0049281311f0091e423957466358d15143af116127e12125fa59f7ea6f07b9897dc0a207779ac85b0e443b

Download Submit