Analysis

  • max time kernel
    54s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:06

General

  • Target

    https://deropalert.com/locj912jo4/index.php?brand=Google&model=Pixel%206&clickid=&cep=Gw7hkyODr8odpiGmh3pix0_YNM2MnVYVd-PVzaIUPAuc7QTGZoTqZlXEc1xMbwmCl7ed4IvVvdFecGrVpCeaGEIZqw5AYRZrR8mOqUvv-T7tJQOxN2jHy1PaJZT2BRICuS1TVsVjvVVsgB54B34Oc-UvFSSeYMsJGdmg2foNHu_ef8KiHoPqdDI1Sejh2U70cE6IsOJVI7sAkkxBrjk7Z_zrKQ81z0umBY8dd9u_poWU_n-OJU-kNQcAHLBT2jq43ijmA7pbZ6q7q-GnNQiQiInAY1KVHi63ihXdUwH8pfpp6wFJVWVhMc0EiZVqcvsGOKw-GmycdJkOI1xt9Utu7Q6Ic5gTo5ri_Nxd6RnLdIMFf4hcMmcAetNsaKHQnlKV-B6vBvDjKl7Sazr9x1r90ytsbMGh_Axbx0Xg1-thqCy988ZYe8I_mEeXO0_wdFyAaXpDFqlMR_3uHDBGQws9tXpwWNdy8cawgq-ihNt5zUw8Rrl5lmz0gkodlfQ6CroXwrzMJq3Y762o3oGTEYS3tuLJ7ZT3vVn2lx7gLwGlejZe2UZ7qebL5_XLCzKOpiAOwJ-shgdES4XqaIaBXkBPzZKHc4wSW1kNaqtDODum6pvL4i1EqR0sELEjKbsFqarLTL0JVPeferXNdM4WhMXdSgnVcow4IWst2-OKvy8zrk2wl6OmkRmnzaogoKEMBGHZgx_gQh_8ni_MAZNF5UjKbTFGOibWatORs8dbXG6iBxTABHGxRo7-pIZce-V3m8fW&lptoken=177e31be185080812512&zoneid=6444276&bannerid=22453452&zonetype=%7Bzone_type%7D&campaignid=8818060&device=other&region=tx&isp=att+services+inc.&useragent=Mozilla%2F5.0+%28Linux%3B+Android+10%3B+K%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F130.0.0.0+Mobile+Safari%2F537.36&language=en&medium=PR_061124uspops_6444276&cost=0.001352&visitor_id=879221354438860927# wtf is this website

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://deropalert.com/locj912jo4/index.php?brand=Google&model=Pixel%206&clickid=&cep=Gw7hkyODr8odpiGmh3pix0_YNM2MnVYVd-PVzaIUPAuc7QTGZoTqZlXEc1xMbwmCl7ed4IvVvdFecGrVpCeaGEIZqw5AYRZrR8mOqUvv-T7tJQOxN2jHy1PaJZT2BRICuS1TVsVjvVVsgB54B34Oc-UvFSSeYMsJGdmg2foNHu_ef8KiHoPqdDI1Sejh2U70cE6IsOJVI7sAkkxBrjk7Z_zrKQ81z0umBY8dd9u_poWU_n-OJU-kNQcAHLBT2jq43ijmA7pbZ6q7q-GnNQiQiInAY1KVHi63ihXdUwH8pfpp6wFJVWVhMc0EiZVqcvsGOKw-GmycdJkOI1xt9Utu7Q6Ic5gTo5ri_Nxd6RnLdIMFf4hcMmcAetNsaKHQnlKV-B6vBvDjKl7Sazr9x1r90ytsbMGh_Axbx0Xg1-thqCy988ZYe8I_mEeXO0_wdFyAaXpDFqlMR_3uHDBGQws9tXpwWNdy8cawgq-ihNt5zUw8Rrl5lmz0gkodlfQ6CroXwrzMJq3Y762o3oGTEYS3tuLJ7ZT3vVn2lx7gLwGlejZe2UZ7qebL5_XLCzKOpiAOwJ-shgdES4XqaIaBXkBPzZKHc4wSW1kNaqtDODum6pvL4i1EqR0sELEjKbsFqarLTL0JVPeferXNdM4WhMXdSgnVcow4IWst2-OKvy8zrk2wl6OmkRmnzaogoKEMBGHZgx_gQh_8ni_MAZNF5UjKbTFGOibWatORs8dbXG6iBxTABHGxRo7-pIZce-V3m8fW&lptoken=177e31be185080812512&zoneid=6444276&bannerid=22453452&zonetype=%7Bzone_type%7D&campaignid=8818060&device=other&region=tx&isp=att+services+inc.&useragent=Mozilla%2F5.0+%28Linux%3B+Android+10%3B+K%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F130.0.0.0+Mobile+Safari%2F537.36&language=en&medium=PR_061124uspops_6444276&cost=0.001352&visitor_id=879221354438860927# wtf is this website
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb487d46f8,0x7ffb487d4708,0x7ffb487d4718
      2⤵
        PID:636
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
        2⤵
          PID:2544
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:532
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
          2⤵
            PID:1244
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:2920
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
              2⤵
                PID:2452
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
                2⤵
                  PID:4180
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
                  2⤵
                    PID:388
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2304
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
                    2⤵
                      PID:5612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                      2⤵
                        PID:5620
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
                        2⤵
                          PID:5936
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,12747383673737083514,13806262964959310561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                          2⤵
                            PID:5944
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3492
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2688
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                              1⤵
                              • Enumerates system info in registry
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2596
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb368bcc40,0x7ffb368bcc4c,0x7ffb368bcc58
                                2⤵
                                  PID:3276
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2
                                  2⤵
                                    PID:2284
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2024,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2080 /prefetch:3
                                    2⤵
                                      PID:4536
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2552 /prefetch:8
                                      2⤵
                                        PID:444
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                                        2⤵
                                          PID:5240
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:1
                                          2⤵
                                            PID:5248
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4540 /prefetch:1
                                            2⤵
                                              PID:5456
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4684 /prefetch:8
                                              2⤵
                                                PID:5520
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4668 /prefetch:8
                                                2⤵
                                                  PID:5568
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4416,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5040 /prefetch:8
                                                  2⤵
                                                    PID:5224
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5080,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
                                                    2⤵
                                                      PID:5400
                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
                                                      2⤵
                                                      • Drops file in Program Files directory
                                                      PID:5592
                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff6fec54698,0x7ff6fec546a4,0x7ff6fec546b0
                                                        3⤵
                                                        • Drops file in Program Files directory
                                                        PID:4344
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5188,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
                                                      2⤵
                                                        PID:5600
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5192,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
                                                        2⤵
                                                          PID:4396
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4512,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
                                                          2⤵
                                                            PID:5920
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:8
                                                            2⤵
                                                              PID:5848
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5076,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5100 /prefetch:2
                                                              2⤵
                                                                PID:5432
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5268,i,14777818004369481448,7466284641681577389,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5276 /prefetch:1
                                                                2⤵
                                                                  PID:5520
                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                1⤵
                                                                  PID:5384
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                  1⤵
                                                                    PID:5512

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                          Filesize

                                                                          649B

                                                                          MD5

                                                                          bbe9a0cd0f9452d43b820a7cfdcd8488

                                                                          SHA1

                                                                          38d5b73aba4d5671752e441dd5aae3177041e75b

                                                                          SHA256

                                                                          9a8c186779df46e59bd0257f58699cc15df4b7018e56136b53e40c8f9a410e7e

                                                                          SHA512

                                                                          a4e3f4bdbef02b597a6807b5ad84850bc806966153776651276254b919d8453b9cdde11d1ee9092666b7cfd2124adbcc7ec18dd5a9327e4faec8bdde9c9bc849

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                                          Filesize

                                                                          851B

                                                                          MD5

                                                                          07ffbe5f24ca348723ff8c6c488abfb8

                                                                          SHA1

                                                                          6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                          SHA256

                                                                          6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                          SHA512

                                                                          7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                                          Filesize

                                                                          854B

                                                                          MD5

                                                                          4ec1df2da46182103d2ffc3b92d20ca5

                                                                          SHA1

                                                                          fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                          SHA256

                                                                          6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                          SHA512

                                                                          939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                          Filesize

                                                                          2B

                                                                          MD5

                                                                          d751713988987e9331980363e24189ce

                                                                          SHA1

                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                          SHA256

                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                          SHA512

                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                          Filesize

                                                                          356B

                                                                          MD5

                                                                          577fd35f30dc7d91081cde18701fccef

                                                                          SHA1

                                                                          d3bf58691cbd209e55f48ac3e0053faafc79c3f8

                                                                          SHA256

                                                                          2313c4e5da523d9b2a320e5d59b6d1aff9cb565a3d1e9086c4312cbaf86d009d

                                                                          SHA512

                                                                          ced72e3a0036f86979d8228aa2f02ca30b20c3257ca888968955ece650732c08be51c50d394be0d18724deb4cb5e91a1d4b5bdb436f6d95c5d26dac9c3980558

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                          Filesize

                                                                          356B

                                                                          MD5

                                                                          23756ac285628d0a055d5fc5d109a7df

                                                                          SHA1

                                                                          a964f2ebfbf862cd5ee836fa3fc01fb0c4741a1d

                                                                          SHA256

                                                                          b93aa224381534f89677f767144667d1e6bff57a7958665dc7816c92ab9c29c9

                                                                          SHA512

                                                                          0b4e219466becb833af44ebdf253d5598abdfa463f0045411a9c2a7372a079c48f193b55536a4946cfc06198bb125dff71110f2adf0e5676f3d7fb2e14d7cc8d

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          646d2f592c78f24fc32bda5e26c9a5bd

                                                                          SHA1

                                                                          3d822241d8e6a589b07407151df33fb64ce996a4

                                                                          SHA256

                                                                          ece7cadd64f53824edc5a9cbf7325c528e5c90019c315c9a43010871fa3b0369

                                                                          SHA512

                                                                          357b10668166d6615869c33618afab07bff56a682a54c9b91f4856a318522f7c707b5b06d62db1126719f649bf9804e33f18c6512da89c53a48f970a5be0aa6d

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          c3776108b9ab3a25eb3f4c544ae73bf7

                                                                          SHA1

                                                                          c5b362a7ae1c1f6d9c5631659e8cee1fb4f9807b

                                                                          SHA256

                                                                          1ee513b53c6e6023cdac1a0e5d46e0e9add27e31bd60be4a9cbe23438831c8ab

                                                                          SHA512

                                                                          a96def4a00aee3381a36f55d74e11c4131b76d0932e2ef48eb58a9038660ec9daf4b0847ff5a143236910cc3bef48ba413a8b7d1bcea9632729e91bb0a9c795b

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                          Filesize

                                                                          15KB

                                                                          MD5

                                                                          938ec49add3d9576b16f6dba7b775ae2

                                                                          SHA1

                                                                          602dc2411050d38f7a61456b39bf73541b8d54ab

                                                                          SHA256

                                                                          411591e84c805276261d6fbcbb6532f2b775cfc701033cb182c46beb54de5f0b

                                                                          SHA512

                                                                          9c845675bae83feb09b48521c9578aa6db95373db4bd6c30be41f2db72e847145443256230de275dcb8ca09ff0216c77158f35a5b470019f4e78cc800b6723d4

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                          Filesize

                                                                          72B

                                                                          MD5

                                                                          29c84a279bca726b7d766f09490bf68a

                                                                          SHA1

                                                                          53fb2235cecb930463fa2aee08ab7c4ab85e5aba

                                                                          SHA256

                                                                          14274a217e2231dcb6d60077dd7f84587bf485a015561a7e16ba26c9b37521db

                                                                          SHA512

                                                                          2e2ec39d18b150927864dcc32e08843fa39d390d7ecae3d4bd8b80ae1a4ef5940bbcd27b1efc8da124bf6c596bdbc7e0a4941809b6f6837dd7d3cf81ca859364

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                          Filesize

                                                                          232KB

                                                                          MD5

                                                                          273f977440772f4886c657b612d6a524

                                                                          SHA1

                                                                          9fef2e5d09509e26392866859d4bdd5cb4c12c6e

                                                                          SHA256

                                                                          714059a08f48d02bcbc7dceac512d5ecacd5c879c9234b7225799bf037ce0e75

                                                                          SHA512

                                                                          d2960ec436fe35779ff2d6dd76778f2d30d156b7ce22152ba905fbd34a5c9408c8adaa784fbb7565634521eb06ff561f0f350159abed26368598baf6ce33a5a6

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          b8880802fc2bb880a7a869faa01315b0

                                                                          SHA1

                                                                          51d1a3fa2c272f094515675d82150bfce08ee8d3

                                                                          SHA256

                                                                          467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

                                                                          SHA512

                                                                          e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          ba6ef346187b40694d493da98d5da979

                                                                          SHA1

                                                                          643c15bec043f8673943885199bb06cd1652ee37

                                                                          SHA256

                                                                          d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

                                                                          SHA512

                                                                          2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          5KB

                                                                          MD5

                                                                          86f8ae2c71b2af69acf5604c4112a2e7

                                                                          SHA1

                                                                          82bbb550733ec2a84b35158ffd051be366de03f8

                                                                          SHA256

                                                                          183796a8c2e8b7c9c282a8cad54b65e2d2537baa5838e54ab8f35ca11e558442

                                                                          SHA512

                                                                          399169e740695203741ff41c537848e7fa8adbc2df446f97d49e19929523fc31daaa6e20e6453239d78d7b22e7353afb1a3dc20a65d21c57ab86c85f7a4102e3

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          4c5eddb760e03094be77ed412d21a0f8

                                                                          SHA1

                                                                          88b1859557b35daef592d18307e054efd9ce1c54

                                                                          SHA256

                                                                          24aa19733e54164c17778114c0ec489768f0c413ec11b2de56d27daae9767747

                                                                          SHA512

                                                                          ffaa797a77c56d110507413524d86e1e7844fef08d40db35a75b7c206ab0e827dd5889392f7baef0bd960e6e3e3e77664fc587511acaea32d847038b85acea23

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          7036eb96ffde3f66219c0ed8073ab2c1

                                                                          SHA1

                                                                          a7db219fc38989ceddb976ed9c99f4c9b00f8768

                                                                          SHA256

                                                                          b8f233c04f222abb07dc893d943992de0bbd5bafebc1ef0863f8d490a079773e

                                                                          SHA512

                                                                          fb9babbf26c7ae9f0c4f38441630bbfaf4a8c6e3aa18c97ddf321e911751a958d8e2cf072fe1afb0fed55ca4a6322fae1931803f0bb86f625b1c89fe2a38ad32

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                          Filesize

                                                                          16B

                                                                          MD5

                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                          SHA1

                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                          SHA256

                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                          SHA512

                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          399531a320b4c36f26839f48e1020154

                                                                          SHA1

                                                                          c7ecd14a9c9fad3dac9b52ffb072b9a88f03ab32

                                                                          SHA256

                                                                          e0fe0aab1c22359400cb5c0f6716efdc0a560dc9923b20580dd4e5cdaa2f108c

                                                                          SHA512

                                                                          7ecce79f374829444e2ce224469d0ac9931c0a02568d9eda6232f88ccd9aeabcab5374b4b32699044794b55382d94b92035a6fb71793118b1a9a9ec0bfdb4ae6

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          6288a99d46a85b510c689c469928f224

                                                                          SHA1

                                                                          eb037fe8aa529793975afaef8f79cabce1788e59

                                                                          SHA256

                                                                          f7dc1e643eb25113f4d3fea67b6397ecddb00a6f491f294eef4dfd171ac02943

                                                                          SHA512

                                                                          33752ae44152caf71389d979d9b1ca3236428ee7517406e35a41d2c5ce2c7084d227478082d51d3596ef14e158946f8c6d7da8c98785f44f9cf6d8e1cfcf7629

                                                                        • C:\Users\Admin\AppData\Local\Temp\662d0967-8b2b-4076-b096-6a015d981d85.tmp

                                                                          Filesize

                                                                          1B

                                                                          MD5

                                                                          5058f1af8388633f609cadb75a75dc9d

                                                                          SHA1

                                                                          3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                          SHA256

                                                                          cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                          SHA512

                                                                          0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                        • C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_914467965\85285250-b554-46ad-9632-daf38a7be094.tmp

                                                                          Filesize

                                                                          132KB

                                                                          MD5

                                                                          da75bb05d10acc967eecaac040d3d733

                                                                          SHA1

                                                                          95c08e067df713af8992db113f7e9aec84f17181

                                                                          SHA256

                                                                          33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                                          SHA512

                                                                          56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                                                        • C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_914467965\CRX_INSTALL\_locales\en_CA\messages.json

                                                                          Filesize

                                                                          711B

                                                                          MD5

                                                                          558659936250e03cc14b60ebf648aa09

                                                                          SHA1

                                                                          32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                          SHA256

                                                                          2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                          SHA512

                                                                          1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727