Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
16/11/2023, 21:03
231116-zwf3dsgf7t 816/11/2023, 20:30
231116-zamm2sge5z 816/11/2023, 20:19
231116-y4bbfafc49 816/11/2023, 20:13
231116-yzxnwage2t 8Analysis
-
max time kernel
581s -
max time network
546s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
16/11/2023, 21:03
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://0ffice365-management.net/[email protected]
Resource
win10-20231020-en
General
-
Target
https://0ffice365-management.net/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133446422926193647" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4984 chrome.exe 4984 chrome.exe 4464 chrome.exe 4464 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
pid Process 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe Token: SeShutdownPrivilege 4984 chrome.exe Token: SeCreatePagefilePrivilege 4984 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe 4984 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4984 wrote to memory of 4980 4984 chrome.exe 62 PID 4984 wrote to memory of 4980 4984 chrome.exe 62 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 1424 4984 chrome.exe 73 PID 4984 wrote to memory of 4480 4984 chrome.exe 72 PID 4984 wrote to memory of 4480 4984 chrome.exe 72 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74 PID 4984 wrote to memory of 2564 4984 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://0ffice365-management.net/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff97e579758,0x7ff97e579768,0x7ff97e5797782⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:82⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:22⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:82⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4304 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4520 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4836 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:82⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:82⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5224 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5028 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5664 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6072 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5972 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5876 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:3752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5184 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5452 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6452 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6180 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5796 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5672 --field-trial-handle=1820,i,17472123418704812694,6664856144164242336,131072 /prefetch:12⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5e8fdeb9c299418d2dbe53b2d46bfa55e
SHA13cf67c9d2d1a68b97b64f98e0f23197e3e0331c2
SHA256f5149a90113e7ea0ce8ad07c0a73f177ebf50483de55fd5433972cd2e3b14fe3
SHA512d9380574e592825577a3e2d8f9c76b2d57557207080a53765cd8deb6a3a8f422fb7d263f5876a7bf22d6b7b2963f017c18eb1a6f0d16c21a0f64d93b1dcef37a
-
Filesize
32KB
MD543c1fb88ab087cf0f2463bd19e52f876
SHA1cb3e725ffbc88768afd3d1703443cfeb5e92ea2c
SHA256e02a04b416eb7dd334215590ddd46fb4e653494c72b227f42acd77f6775a4d8f
SHA512da1cd38e46c1f93203955d681b8a5dce2a55299f01fdc307ac58f213f312dd1df49487adf9f902a4e9c7d0cf030ff3a08c74773ebeb32eb6835457569c8f2d95
-
Filesize
54KB
MD5a1db65947f4b3db03cb75b1f599bdba1
SHA1874e2a7e4a1d4b62588da59c4cbfa2afb5711ce8
SHA256721526468a14c8f80043d98f322488b8176180021b7f17779a7e120b7ff421e6
SHA5122457eb64829a70c632a6bfd59527fec40e4da72c8853e89187afe64e04ec3df4bb43dd887063d70a964a40fd323f7146620af5a78833ab88dcfb1ca382429e9f
-
Filesize
34KB
MD5ec10056d89af41f2a514df0773ecfed4
SHA142c04818b32b03e4c1cc657b76eabe8bd413b901
SHA25675b10b11fb9a43301d2313ff724b1ea4181b90aa94aaf7660f673cdc2ddb7dfa
SHA512a17a15a85953f97db9b6ef3377da264f4bd8ff27aaace97e496bed45e6324f90bf7ed4760d5c513999ff9dba6f7ca30f6f443720294eb3d786d3fc57f3059fc9
-
Filesize
30KB
MD5c989afc189de824d0325b8e17de9b620
SHA16468a15d01f5e2f25e9e85b027707bb3c14382ea
SHA256d3a8eae87cf5e9117b6ff1823431e6c7335811533076024713baee169b38036a
SHA51296177e87d3752de667ed5ed5968aa3bcd6bcced6d70d98542dfcabbbf1940b667e9806c314d07667d741fbf31ca1de1b8d8dec5c0f6634bc0b033ded1d9c0ef7
-
Filesize
30KB
MD5e13669013c41a1905ebec15f3decc546
SHA1d7960787c1a70e62d06fd5e903437f880599238d
SHA256b7ad235271ca6426638782d8f056908d2032aeb33bccc8241156a26000496c05
SHA51272af0ccd2a5d63db20a0969c5147755d5ad9bd93aceada85343d84663a7cebc99bbcf279672ba8d302465aa7c00f11e2e27cb8a042aecb8ecff93a94defe719a
-
Filesize
17KB
MD5fa558851d0cf5ede5b4c4432dbe653c6
SHA18de6a52cd4a6f3417ae60df7c38af3ededce4c11
SHA25677c365b78f99267d5bf2355d63c30f92ad838076d14a4bcf345a3750b554b0a3
SHA512d6737a5112e5fe466b5a02c47c58cd15c168cc934fb6cee3f73e54502cee140dc325c577e01fe2b67550729b1dabcec617cb0d008d95adbe0b5f5baea6879df6
-
Filesize
299KB
MD57d07c247e8dfd5bfaf9a7169b5c402bd
SHA1392cc7836ca5418f3e65cc67f5680b2a359399dc
SHA256345f500582fb5cfc20df5426c6b54bb0bcaa62eb0249a4a661dc9716a9edc006
SHA5127004443de5b756f63b9cc5498ae8b33540f82297250df5996e9510f653d2acffc1b6ab0fb5b955131ec9af60ba33f34c52d277563fe9c78214b0c53df2dfe541
-
Filesize
216B
MD57e4192f2f147e55442709ff99cde0a6e
SHA1dc71ca65a4c57ecfaec3af3fb086365efc82444d
SHA2563bbe41913c84f7978059a766791f6c91c503f465c1a1ec898fa06bce2a81ddd4
SHA51200406b558e54cbb59da6ff081f11154a237e64009dd5bcac70985f880340c9dde45b40fd004da28d896d6be559cafbdd250bf3b5f6ab817fb8e5ed1b3d1216a8
-
Filesize
1KB
MD5fc25a92ea11589eb777bf48d81676779
SHA1d7331976fdfafec9d4379db88fe3343002743dd6
SHA256d99d67b2b9ff7ee33e0c386a2f9b0d72093d9ccdfb16a4cb8c355c0a41d75219
SHA51295e219f65944197fedd08d6ea9b6818e2f102b6d257e084e65482c953847f1f94463257799f2a699b3ecb89a6cf8f600394b12d82d79ba57b40b9deaa363c97c
-
Filesize
1KB
MD53fa5caf4d48d7a68531889a2525f4a87
SHA19d87daafae0daf9064daac7b6ff27900ac32699b
SHA25610c77c864e84ed45ea0960f637cc976e7c150eb6b32a6621bed55d653136459f
SHA51269adb0ce632e9fe51e9c26a9d03c29c81ab8ad6a64320c9bf5f899d1b3ac9b6e9315ffdf2af1149db2e8d0ec4c808fe0599f35905957b81476bed2f919b3ffab
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG.old
Filesize349B
MD5f3ebcb524371f55b10374d98585cd882
SHA15bdc70e5949206436ef16759a8484f10f833bb9e
SHA256d0585053e967bed0bb261cdf902a460d03288dbca1017cbacb26c0d18e05cbc7
SHA51269af69e7eb83a0bbf8facfea17d3642d4dbea7bcd4ed0d279959b3b1b2465b23c8cae3b4559fa096444c41000cfbc7dd534677564f36e30c4c1ae4d2c0ad8978
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD58aa01b25e6d97537cb24618f5e6888d4
SHA152ed209a67a2c5bbdd53b7753be730ba68fcab77
SHA25675d9a54372ef137a70d3876bb302405b4449233489f859fc35cd06196dc2d8d1
SHA51248515c7ca5dd97e0685b52475d331ec6a5b0beb1824a0a70e3a56736826f71c82c57c46cf4f7601060203eb9922c78a739b85522b9e14cd403f89f4e791bf14a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
3KB
MD58750e0a771e2d7b6fc3dfc188b4466df
SHA13ded759d8ca8db01e71cc3b6d085428b83c35c38
SHA2564679008e361774aa9edea6cab93e430bfdf1f0fa92961da302dc43bf883626a4
SHA512d00c65ce5977823d6b7a6fdd5187473c9d56ac64f555c4b28da5280d20373cd7d8a437832da4f82b79e6eb99c252b2846f0eb303fee21b708cb7145251af7c65
-
Filesize
3KB
MD5f0c9117b45a85648565f121940c23963
SHA124f810228703b3af7a2ac49387d7aeaaa29e31ca
SHA2567b48a7c573b81f3b5eea04e4f39d599fe6bedcd0bd264fd2bc5822af2ad7e6b0
SHA512c76df3a5aaa3fac1aa163ca263c367ccdecf75ea7d90ab6ddab39f266c559345c264f1a5425cb8de6de80c4be99074e2c9d2d44c0e77e2913170f38a12a42cfc
-
Filesize
3KB
MD5925e7a27ca1607f0b433512e5ec5fec9
SHA19b671f5963bb7b827040664a825cae0ec8abcb44
SHA25629734ebd9ff65f90b524e57754cf00e74c9d981f88813d523dc0c1f9158ad079
SHA5125ad0898f9aecbe39aed19a723754f477afa8d53294e15797446c9d80b12a8f5627e5a702eb1b1425f297360b90d3ee8fdbeaa1d35b62a935c5757a00a82a29fd
-
Filesize
1KB
MD5811cc6fdc38670420f5980a3a054efbe
SHA10af54e528c22dece4d5905622f6d647de8ad91a5
SHA256a00b8d0752d5b537ed45aed65fd8c1c06edd62f45a7fe4e23258b6b6ef708489
SHA512ff2b8c2e802e9fa64d23bc50ca9a178876766dadc5a1225176af566f84aef38e1cc06164cd1b67c2368fe77692012c71c69fbf66391a45b867af811b48bb95a1
-
Filesize
1KB
MD5312e57c56210e982224ddff113d189ef
SHA1b7cd74bded57a09b86972adf5dab894a88fe573d
SHA2569ddd125de3408e00b550df09f58dcaf7a392098edcf0ae2ac1a52e4893cb24b2
SHA5129cde8a8ba53c40fa10af3b4888ec7104c4ffef0f10e70988089da35d148136f1ada9b03fdc23395b6105474ce6d11b62802e0e002a231c8a07ae77c28647694c
-
Filesize
1KB
MD5d149b104f2667d0040c3238cfffb926f
SHA1c68eb9e570dd4e6ad0ec18dd23d91f57aaf48714
SHA256b334c37b65b297220080bca39a83fa3e58cc9890be288ba5e42905cab9130eac
SHA51226f000f927de03f44055d6ace90a7143ee0efe9e6f9d2adf6ea7c3542f34f4ee27af8e58df1d831533cc90f9bc80e922449da61cadde147f899fd77ab6dbff55
-
Filesize
1KB
MD576dffd4b046bbca359f385020b86b34f
SHA1299feaa45a83a5680f62b06f365120d8a560eeb2
SHA2560a5330c38027396343bc96efbac5141efdeaba4d340d2cbe111b8430a7535205
SHA51249c9fc0d5584934d0ac284b4ac2e40a641b890d1104c0f86108b17996263d617845d3e5923d600c76caaaccddfc2b2b0c7ff5273073fa4bb7839cffac9646728
-
Filesize
1KB
MD5e030e1ab690fab08292204c1ff7634c6
SHA1b9bc2ad29a1f45955a8915fb347d46ff26355c85
SHA256aaecf5a551bcd5d3f6fa938c8062836d949a68f5245f8ae48c31ad91d2712af7
SHA5126ffb43ac2d92cffbe2410defb34a5c12ccc0c948bbe32c5c770ea7a1790a3fafdcb48585b18dae6876ffd4128719510a023b098149548856fc3ac47474d74442
-
Filesize
534B
MD5a93d9a41b754ff421d8b10090169fd49
SHA1c2306ee64210c936c90b9f5e6d381c71c7a44981
SHA2562b3dae09b75b41756c6e7aee10589beb528cf2af4cdfb791e6848c7a06a761fa
SHA51212a50a5d3503bb5d80f65e16c5d6b413d031f1d6d454b3c2fdfaa9c4f991bb2cbd2e85acda4a2622a399f223745a9c11ee5e1ceaae9b40cd51ad209844eaac62
-
Filesize
5KB
MD5fcd2701e8e62c735c2e8c4a7aea39e03
SHA1ab56091972eb75a91934c2ec17c84cb37cbbadb5
SHA256871959eb7feab57a4778e3c8211b3c92fa5430eaddfbca8041d45a4ad029585f
SHA512c858d031234139585c6ca85a4751efbb1d84102815ef703d78616bebf48dee69e6e8d1460cfbdabd78d8e76badccb8553237771e78a26bde22d578c5a65c2685
-
Filesize
6KB
MD59ca475df87afd917ed0069c1fee63c95
SHA128f63beb3c40089290d10ab797d10eb05aa850d1
SHA25684c175c5b5a72fbf13d395c3b81af6e8a9ef458ece2532208872a3d9818dcfc7
SHA5129baa280144c0cc81137b8dcd7554afcb9aa94218377e8ae56ed8485af5ccc5de3ebb8b4ef7ce4a0e901ee8846b5fcb769ef2635496c6794cfd39ec8d8c06ab7e
-
Filesize
10KB
MD5927034a46092bc4437e5d841d9b55733
SHA19d49f6cc2a0469ab361240c15b448ec980c93987
SHA2560ea3de907adb61fdc11a364795c320bb858b3be581713bee2fdd859487186f8e
SHA5124995f4d7a246952b9fdb8082e32cd3cd8f9c22f5ac07bda84d4fa9a66b642822d47528293a43a073b0eeb70774fe4eba87ff4cdc826d2537b3f6f6b4bed72360
-
Filesize
6KB
MD55d04bac4798e9ccca9cf25c0176c236e
SHA11d98bbc0e250587a51ab825828e002bba781b35e
SHA256fc12b86dd35a477f8c4ec6d4cfc7a3de653afcc7e8f0c9fbaed32d138a20facc
SHA51240ce02383a2f3e22c0d9406b62a3ec45813c597ceb434d593a1079dce19f6480182c80e0c52a17f1370a0165d81afe5436fdfd87395c4922c401d2ce652e88e0
-
Filesize
8KB
MD5a1773f46620fb9cf5b7a8a860a7d6f2a
SHA19fb96d5ddf97684aef33654f503ac46ac9217a0d
SHA25628e496f94af5900681a86e516fc3c8c6e7cf9151f6319f10c7fbfe7ffc99abd2
SHA512660acdd7c2e65798b6195df4a930c9b7e4f7ca288bbd821ae956df0b285d72d93ef210b1b627468b05e6213aa295ddfa6bb0512be914ad0fc72fa376d0fb79fd
-
Filesize
6KB
MD59a1c899aa84c9f8a7379fca311bde019
SHA1f5bfda12f921d1225e81b3d53f9873aae19f254e
SHA256a03a1727bf5c82af09708be1f92b7695d670e0de997268931f7ab18568fce25b
SHA5121c10bb68ab1f429e5f87e156e8e933c0f6cfacab7c1dd4c7a24add4e71c247fd32f7a84b3db5f341432e47bc08199f366c0f35f7595e82311886260e85683535
-
Filesize
6KB
MD50bb5d6e64ac4eb635d25943d8b5a0641
SHA1db7f713ddd16d017f5764902ab2ae3d355bda337
SHA256bc5baed11f3848fe0f5049cf5e29f6814793638cb7d5e9910df04653d5026698
SHA512d24316d318aa7d139635061fe853f570f4d994eb56e1d939ae4df557af3dc2d9497286dd00a84b64602e4fdfdd46ea73eb7d5d7ff40faed4ff8561261439f104
-
Filesize
9KB
MD5dc27583801bb90e8171af998a9280cf6
SHA11c7392b087c2133cd9d0067547f57455d188e072
SHA256cb697f8bb5e3aa2545a498e11cb039a449024aa0ecb2836f3ab742f5d884beba
SHA51247876f5bb09e84331a3624ed56bc89fa6552f9fe7a33ea90113d33332e98b2d882f66cac0210c9c56c841031f2addd7e4c9911a2fc05c95e95bf418db329007d
-
Filesize
5KB
MD55b08aca52f717404ba0b9244d920366e
SHA1b1cf06546e458dd7324b0a1a1d688b428775d97c
SHA2566c34ec8edd095d6dec8819d0697c7beb4b96950b4981a8ea1284dc11f6569aa1
SHA512aac8d085e1c895040c9c7edb71be866a338ef585d38186ee984e7d47842c94a1f025dfcb298f748f8842f7ba45476d01ec57c86b7daf2612e03ec5017b145c89
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\d1d703e9-4fca-4d79-8b40-ce316b739ca2\index-dir\the-real-index
Filesize22KB
MD5f2db074d6acb1979bf8553924f958c49
SHA13fc0415f8ce76c8de6118e2f973d57dbc49c8d9f
SHA2568e04df7beff0f2acc9e2780909f65f90944e54d19f28ac783d8b742a7089be56
SHA512b6953841d80ac3529a7c430322c19ac737471dcf7708f2e7b48d9f6e1dd9918e4ee9a5a5b3672f6a6135594fe1278794891044d1ab3e08c6b9a82f3f6bfcc282
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\d1d703e9-4fca-4d79-8b40-ce316b739ca2\index-dir\the-real-index~RFe59814c.TMP
Filesize48B
MD579eedc590f508f0069fff4e24b15e503
SHA1e093f0f2a9f446586c42336cf8f9789a25fac11a
SHA2560c34e1f08056c8205d210c3c717b17c666e5a94e5be99214c3614f2782c56e47
SHA512cfb8cd7e0557e52014087d8854d6517bb085a562db2d1214f7aa0c873df46332d48e941b43fdf9879f2415bec0f1edc01cbec52cf2e7de3b145b19f00e8f9817
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\index.txt
Filesize260B
MD5b129f6eb0154a170871b4acd5c3ff6a3
SHA13a9a9992cb60b9845f006e5834aad9aff675a948
SHA25624250845a9d50ddca135de156f709bc1b5b9576520a890737135f03a725a0e87
SHA5129b513010066b452003a2c9ac5813df28741faafb5da52d4913c1d3755bed9d85234f7c83a2594e2ce70dbdf9f1037e21e9e41efa051caa8dcfad652036cf2f10
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\index.txt~RFe59818a.TMP
Filesize264B
MD58efc0e38f29a71c416d11fe59a25c701
SHA11ca997ee1db20e0c455572210729f77b456b4e5c
SHA25641e3d8ff5458249c16006552b725bbb927489025fc24a3a4985629ac374d2919
SHA5123d9e0c304bd8bd5b9241706e51d922f60292bcfcaabf4cd4ca50acd1c432b038b63bde01fe7b5db99dae26bc6fd91e9c97a267350e581247a27a8d5aeb01cfe3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize240B
MD5a7ccb251fab1aea46566b80a83d8aeee
SHA1808fed8e9cc3c173054b485084ca69c200f8b4ca
SHA256b04c0fa6ce880a3c3062c65f03362abfdaa8034a8b0166859842441610e0c548
SHA512e7516b52ebda83b053b8ee22556cb8be6c8f247960fe689bfc3422cfc4d3824c37f5b74cb5675b72971e639fcb3aecbcbca5bbbf54539834e13a34c4773e1bc9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cbf6.TMP
Filesize48B
MD56aa3f67058f2778a9970ccfb7c760444
SHA1210892521448d96e12f5411f2d31100a378806b7
SHA2564c009cc38a06c79922b2eb65eb8a91d182db9b9e035cf2a0b818854ca280fb11
SHA51275a4515861ff0fa0967dfa378089f7044bf0245eaa9a80999ee6f430947421ffbf42765bf0a68b58eae1235b6936a9138eddbdc3fc79d03315e36448811ec95e
-
Filesize
106KB
MD589f0f4f396786c877ec01cbd261c991d
SHA1ef336275e8c62afef4b54e4f1248d32dfa6df01c
SHA2560484f73890531f6e25241633c6466377017e6f7e15ee4d39c2f0e58a6036ba13
SHA51271a77088038472cfcb1e9bee5e604e4456539ece2bda44d07680c80f21a5359e001494ed95bbaa2b07642b207e9910ace7739302215e6674cf25715b4a37179e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd