Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3Broskie - ...ins.js
windows7-x64
6Broskie - ...ins.js
windows10-2004-x64
3Broskie - ...est.js
windows7-x64
3Broskie - ...est.js
windows10-2004-x64
3Broskie - ...dex.js
windows7-x64
3Broskie - ...dex.js
windows10-2004-x64
3Broskie - ...est.js
windows7-x64
3Broskie - ...est.js
windows10-2004-x64
3Broskie - ...dex.js
windows7-x64
3Broskie - ...dex.js
windows10-2004-x64
3Broskie - ...est.js
windows7-x64
3Broskie - ...est.js
windows10-2004-x64
3Broskie - ...t.html
windows7-x64
1Broskie - ...t.html
windows10-2004-x64
1Broskie - ...dex.js
windows7-x64
3Broskie - ...dex.js
windows10-2004-x64
3Broskie - ...est.js
windows7-x64
3Broskie - ...est.js
windows10-2004-x64
3Broskie - ...dex.js
windows7-x64
3Broskie - ...dex.js
windows10-2004-x64
3Broskie - ...est.js
windows7-x64
3Broskie - ...est.js
windows10-2004-x64
3Broskie - ...dex.js
windows7-x64
3Broskie - ...dex.js
windows10-2004-x64
3Broskie - ...est.js
windows7-x64
3Broskie - ...est.js
windows10-2004-x64
3Broskie - ...dex.js
windows7-x64
3Broskie - ...dex.js
windows10-2004-x64
3Broskie - ...ess.js
windows7-x64
3Broskie - ...ess.js
windows10-2004-x64
3Broskie - ...st1.js
windows7-x64
3Broskie - ...st1.js
windows10-2004-x64
3Analysis
-
max time kernel
105s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.plugins/plugins.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.plugins/plugins.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.plugins/plugins.test.js
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.plugins/plugins.test.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.vendor/index.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.vendor/index.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.vendor/index.test.js
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.vendor/index.test.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.webdriver/index.js
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.webdriver/index.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.webdriver/index.test.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.webdriver/index.test.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/sourceurl/_fixtures/test.html
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/sourceurl/_fixtures/test.html
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/sourceurl/index.js
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/sourceurl/index.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/sourceurl/index.test.js
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/sourceurl/index.test.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/user-agent-override/index.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/user-agent-override/index.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/user-agent-override/index.test.js
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/user-agent-override/index.test.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/webgl.vendor/index.js
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/webgl.vendor/index.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/webgl.vendor/index.test.js
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/webgl.vendor/index.test.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/window.outerdimensions/index.js
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/window.outerdimensions/index.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/examples/detect-headless.js
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/examples/detect-headless.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/examples/test1.js
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/examples/test1.js
Resource
win10v2004-20240508-en
General
-
Target
Broskie - Copy/node_modules/puppeteer-extra-plugin-stealth/evasions/navigator.plugins/plugins.js
-
Size
538B
-
MD5
06b15f6f834d59a0d74b426db7436391
-
SHA1
03560a83ad1b1fc37be6716ffcb599ca9e9d0835
-
SHA256
c745c08d92a2aa6439da1ab2ff9258f9691b61faa46b7714fc1aad888fa36dbb
-
SHA512
57557527045312df5fa5c27549099716b46eb878aee55a103f2f5efe85d060686ec1776ec982a3849dbf6ddbea82d3ed488ced4999e6f249ead3125def7792a1
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 16 discord.com 17 discord.com 18 discord.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe Token: SeShutdownPrivilege 2416 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe 2416 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2452 2416 chrome.exe 32 PID 2416 wrote to memory of 2452 2416 chrome.exe 32 PID 2416 wrote to memory of 2452 2416 chrome.exe 32 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2784 2416 chrome.exe 34 PID 2416 wrote to memory of 2920 2416 chrome.exe 35 PID 2416 wrote to memory of 2920 2416 chrome.exe 35 PID 2416 wrote to memory of 2920 2416 chrome.exe 35 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36 PID 2416 wrote to memory of 1916 2416 chrome.exe 36
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Broskie - Copy\node_modules\puppeteer-extra-plugin-stealth\evasions\navigator.plugins\plugins.js"1⤵PID:2524
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6009758,0x7fef6009768,0x7fef60097782⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:22⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:82⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:82⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2228 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:12⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2236 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:12⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1600 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:22⤵PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1604 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:82⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3608 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:12⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2612 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:82⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1488 --field-trial-handle=1384,i,15395007139198267751,15132987290904859539,131072 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5a9c1d2a6a6e2008303c2079d46bacc14
SHA17e5ca410425471e00a2b2cb141feab5b7b449ac1
SHA25672490cafa362386dc250f9979d82becccb1394a88e966a81c9bf4f856c96a367
SHA5128d81a606e9770e5a5140980dc86c0db00b411066a7fbe85314403d6060cdddeed136725a37a557e74be6fb9a1c322ebd3e965488e4ed83328c16ce00fd3d975e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0fb2e43be99d11405a56399c7e63494
SHA15cba28e29a21a87c91305a136a18c60b3773a1d7
SHA2569403dbbec8fe363436ecb736fca21daa9f20b5889672721cf4946a405390852c
SHA5124a77ea2999325aae00b6e6131f35028a7ac285db921b1aefdba773de53b9b58147b7bcca3457ba9d8facfd371fc67b7769920badccad55aaa6e472d442a1a5c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591aa3e5e16c3cd944890864e88ca2830
SHA1562bf80730481091748b9d1226f30397e9051175
SHA256e225bb23835ae29d81a43c6c3ca999dcb1f917ba7c23d6be675d19f1b720db70
SHA5127adcb16fe36dc18a9929c7055bdd72b67e3cb7c0d676a7bb97b85746b0cb4d205efa9acf05a3bd60a40b27a5b24a66169fa21fd871393f6ca36e821f8f24c977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507dcec0b4d91924ba576425fb9897b6b
SHA1aff1fcacb850dbfead1302e9263dc8761228c7a0
SHA2565c07e4f01b6b12e2a79d2910fc92a3989ea821b0cecc4a30e6c40682cdbe1a01
SHA512363043f58258ef14724f05a3e605ef9f953653c92968123bd3d155cd23c811aed3b0fcb291094200a894336804a859f9def47c0cae8552aaa252f1c11bb94809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bf847636065badedf582a46c2be36f8
SHA14535551535edc3a5c2e6532a42c18dd94777ee86
SHA25671eeed23b51cbaf448d48d536d9fbfd39c9b5624311b6446b07377054a009f79
SHA5121b6f0edebaa42ab350929b32a9bd4b9ac8fd2ea4bb5304951e4c11c4b5b66229a2b34979aa8b469f76f50121bb7c51d6faffdae5df5963508f1a6565cb988dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51655578fd3af719fde5fc6ae290b57fb
SHA1510f4e977f56b5ee75cf72c95ec5025936d5184b
SHA2560e312ce75d8830ea21add33bf639f1ff0e5c0478a9ee45ae699eca1a48bafc14
SHA512e253d322a5893d8f459d8a8b23df1e5cc4db795a64128adfae74200740cab09cfcd53618bc93afa0a03bb84202c1bca46b94ccaa98b1750850ccbc258cf9b0b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d0084758e07a6d9c3290e6f1c60cf38
SHA12e08b3ee86dfaa14aa9a0e7884323c4f263e41cc
SHA2568b3cb3c3533a90a3723348c7c4e8c3a0ef12f0368ff3a3ade043607a195373de
SHA5128747de49e32e4470dca0015df4030ca4b209011ee172ca75d726040b33a01c51f97666b232ae9fb9f43feec4198316e67210fd6e603eeaf57032d8cbf61f8b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5000140f54be5cb8d80682d8d95c7fac0
SHA1a74b67a25553b9c226cc2388185989641962391f
SHA2564ad83aafc1017b90ae08e5e9d8271ed429b3e43b0069d6bd5c2e1a29286161bb
SHA512237fef34f3ce10487028cb07ea3706435e44fd1a4ea3184191f1eb83c98e994a968c57d70f6de06db8deccda08ea4b32d6a5b22904533168522a06c8ad0503f0
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
361B
MD5681cd298844c378d1094cd36ed0106e0
SHA1012a1e53b5ae289e390f76e051aa17ad3c6c4bb2
SHA2568869e89ae1499b414f68fa708e1d99c69a652f1a43eda77f32c554eaab331230
SHA512986def1b660e1af6f75b7e55a1c93f28c103b4f640d838b4eaa1ce74598562c3397680283b800b9e2792763bea33fcf4b3e8a41eed93605514efa97453354ed1
-
Filesize
5KB
MD5d2f4b615076070b650ecd0c6ecb4ab54
SHA15fec00bdc0ed4b19d6625cd7ec7bf58e3fc8af58
SHA256b28522fcaf1c3170fe47ce0c970eeb57caa5c226389404c81b084c8dbf14cc8f
SHA512d90bc522cef9ea5c949c0f0687aefc5283cde568299de0ba7b305a29712b109e0b82523ef776674a1782856aef41ab6ee77d10ac2dee601029cc5e1de8b91f9b
-
Filesize
5KB
MD5ef0a74b0a442a0267a95146b5a3d1db2
SHA17ef7832c228650febeff6acce0ff6175cb879eee
SHA2561b103e87aeb88c5ecd565ce247039f9d8839f7f5e929edfd4bbfdd60bd232c52
SHA512ccf35c048192a0c0de8a38a25a94a1b22f0995f1d47f33952ebd4d1aedfcd1899e455bef053120a176a215d91af28982d686c08a4c1f1c83bf3213f569ee66ec
-
Filesize
5KB
MD506c9980b5e8d9f79d70857ca22b0bcd4
SHA131bd9d0fa5cf397f54bb990afae1ac7e776cc5f0
SHA256433fbba5df41309ab977622837f7e278731adaf17cb72dd969697d7f8e46870d
SHA512466f99b61bd08e35e1c8475c6191887a9b93014ad708e23e18ed9d3be2a909dead64abed3c5803b62cb2c86adb74f64a587706cf963e1fcc604c8e98f95eebd6
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b