Analysis
-
max time kernel
449s -
max time network
441s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
LauncherFenix-Minecraft-v7.exe
Resource
win10v2004-20240802-en
General
-
Target
LauncherFenix-Minecraft-v7.exe
-
Size
397KB
-
MD5
d99bb55b57712065bc88be297c1da38c
-
SHA1
fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
-
SHA256
122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
-
SHA512
3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
-
SSDEEP
3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
pid Process 3452 GameBarPresenceWriter.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LauncherFenix-Minecraft-v7.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674574520937572" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{77D4751A-6610-4648-9A21-27E24430B25F} svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1592 chrome.exe 1592 chrome.exe 1592 chrome.exe 1592 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4644 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3144 javaw.exe 3144 javaw.exe 4644 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 400 wrote to memory of 3144 400 LauncherFenix-Minecraft-v7.exe 85 PID 400 wrote to memory of 3144 400 LauncherFenix-Minecraft-v7.exe 85 PID 1144 wrote to memory of 4624 1144 chrome.exe 93 PID 1144 wrote to memory of 4624 1144 chrome.exe 93 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 4524 1144 chrome.exe 94 PID 1144 wrote to memory of 1652 1144 chrome.exe 95 PID 1144 wrote to memory of 1652 1144 chrome.exe 95 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96 PID 1144 wrote to memory of 3996 1144 chrome.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:3144
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:3452
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2204
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbd18bcc40,0x7ffbd18bcc4c,0x7ffbd18bcc582⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2068,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1872,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:32⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2312,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2324 /prefetch:82⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3688,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:12⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4812 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5084 /prefetch:82⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4392,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4708,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4900 /prefetch:12⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5336,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5428,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4576 /prefetch:82⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5504,i,13681930593487926525,17104547053424119281,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5496 /prefetch:82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1592
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5d4a71a1-c9ba-4ed9-aaf6-60c6e108b12a.tmp
Filesize9KB
MD5114be5c4353a7e03c0c46978abcb8f8b
SHA100820885893005a81e81a26be17d92cd196714ec
SHA25630234a10f7fa05133e4ae4a4529e9776e79881fa83345da353113aee8e6784df
SHA512f0e8cd94122f232a8dda8cd6aec990db072e839446ed8150bb389844da8725aa848df5db9af11fbab93cde33796ab776c58b65e694eba01ead21dbc648723d8f
-
Filesize
336B
MD57380940b264c9395d1a75da7a7482ee7
SHA1961a6586e2245089cae72b98bfa1d1454851688b
SHA2568e99b7012af707b4701cc2efedde68135e138854f6f4b3f6888cdc70bdda107d
SHA512788785a45a0f0f35eccecec2946d80233b86f51f06a1b58f26e11c08464d967339a413af9ee5312d69c401b25f12e79b467699d981ef2f047d363a8501f9d6dc
-
Filesize
2KB
MD50420b39c782ed5834512ad2901265f7d
SHA1fec8efcff387e72838c83f07657ac96287059398
SHA2567f54f2b65c70fc2d3362dbb5be5cadb6ba6642427154a5928dd19eb7ed5a1ea7
SHA512b216a9d01492b0631452e4f6a1ea34fe55cf0c64e72e0b0d0edda7e382a78d8e85f23e9b727cca1030557bf0042f78cb7671c3340b7f275aba685dd2c33944f3
-
Filesize
3KB
MD59bf110b63ac200b6bff6bd5975d0fb40
SHA19a93685b28088cfe0bf60bf8424e0929ee8a1380
SHA256474008b686ed4ede0f1180d08143579a4b2d6ee66b376b345832c25f5a4b9bd8
SHA512a276ed608c01bf4b8a67ed0079f5915f6ed133273004ec05e597b5fb0949ed804a718fe926f3bb9ea0d5255530c5c81ea70b53bfe6ed1d109bfac4f6f3a5e435
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5796d089773963e765e9a4595c33b9660
SHA176e072436cf1dd12552f792783e35129d818f910
SHA256f3c8bc9062f6b7df66145c35d7cb51e780cde68c36a9d4de954d9c3df0b76480
SHA51285c6915700cd00dcddaa68ac3faa98eb2da38e99540e81268f6a954338c904b7ca68ea3b6ec13c35d411023eefd42fd77ba2b9d375801a3415bf47b3f4354705
-
Filesize
690B
MD5f6ed08c61bd3a371325d8f396c458ac3
SHA16aa0c1d0bf01b63585123ea26ee7e0ed75d2a200
SHA256cae395c1c0c4ce4cd0d4fd007bb76a22611f24c27f924cfd36bf754e00638103
SHA512a50954e3158c3de04b3cc8f5835cd92e53497e2224d7aeaf2da68d0d2eddcbae79fadd93a1e13f6961fa66dd8c0eaae1e0bd3fcc53af918be47373dc41a2b328
-
Filesize
9KB
MD546ad7784ccc9bf0ba8902a4f4180a0ad
SHA171b963c28acda8e36a751048e171f161281803fc
SHA2569605bef4e82908c55946dd8bf1dc995ece7e65c729d7b95d3def67b0684acbd1
SHA5126603a5395c0f581cd2d7cb09593cc64685121c02fa3d9ac4d02b905cbc8fedb1d56602cef564cbd740f8dda293248d1c01e4985aa2b1f96dda005e464ac5fbf8
-
Filesize
9KB
MD52a1bff4fe7754701426e5397d895c132
SHA1a16529258cee7d7b554d0f24e0a4b74cfdd2f071
SHA256823bd3c9eb0917b9f17e856d9b898aa266f6beba0086e6361d6034e419369f59
SHA51291890b2dc36ee2a4989ecbd8554209a406f5258a076f68c351aaa07f8feb88879e320cd9482ba203fbe217a2df5fc03f05cba49cd4db9713fadef741fcb06171
-
Filesize
8KB
MD56dd8fdd0e37bc602cb0ff6a3618939e1
SHA11f447fbdc6d4af91eb891a7ec2e7a059a06dec17
SHA256128134bd9641ecac0bd08fdfcb8443092597d27380657907507e82924880f2eb
SHA51264218e993865c6d5bec8acd26e467c6c52251bc60e92ba1153c33a66475cef896cba6af65e0aed7ed3cd09f04d42a8b46da4cd9dde31261c7f38f832db5a47f4
-
Filesize
8KB
MD5a77d79c0278d398670623ba8b2a25c56
SHA1989ece18932604fec36e6ae39f66cf3abc997961
SHA256f6a9e992d6f8e989e848756bf5a064cbd4e7e995a05fba4b8dacac2496a1eb83
SHA512e0c36f5d0e31c7a87dffcad24379a20ed80cf10f86249494e20df442fdbd02e3b4855a07d63fa9c8b46547bdbfdaf030bb826b2a6ff78e6bdbd96f9b6ba7ea36
-
Filesize
9KB
MD50dd7da55269f594c9c5b8d9c1610cfa0
SHA13b18ef1563bc9083a98a0ee6a92901f6e61942bd
SHA256337f7e644b4890f351b94bf9c0a922594ea23021651cc5e2eddf49a5bce7f3bf
SHA5129d1c9a98691e82d34b2f94fde19561e2d66397f6cce9aa5c855acea7e3cc0f231dd3d843ae6f4198d81300ca1ab8bb1221f61894cd323f6f17807790efeaf5f3
-
Filesize
9KB
MD5e6db83455cd43d64d48c69915cdecfdc
SHA19f8c8e377afe553ca4f50d6b439a1a7fa9d716bf
SHA25696dddf850bdc3b05f428455f32f690646943d4426000afc756aaffc42cef89b6
SHA51234c19cbea61be59a1d051d509b36c3f7e2755d5378f86be8170cd85f297c27b9853f9871e9b008933e6a2e6134b6e72f31a9c3297565a95a0b20e27f188e5423
-
Filesize
9KB
MD50a320dc61d6011222380a917bc087281
SHA1e9334a792a06e6d1b84e8776a5add86683d3d8b5
SHA2568d66ea4d8078c4e5ea600c717b6b8ce508f2578364d55b2e4a3fbe532eec5edd
SHA5122a7881f08ca11de7df3abeac7f7db671cdb58bcf33905a414de281ea58e795e6bad5935c57c3515e332e20667a88505c490a069d94c377d58455a8291c72fab3
-
Filesize
9KB
MD50e8ffe0a75be605c4e0cc205e4170203
SHA1954a3288fc87ae2a42b5408d453c5b2ad6090992
SHA256a1696114c04d35d37a393cdc181843622a7a4bd6a76e72f937cdb9ef96421969
SHA512d8eec8be966c0e2584080bc416f1721634cadd81075d90d284088bad465f1871519639090b3cf266d1fc1ed5f42c225ba140c654b7bcde1e49c2845e4c963ea5
-
Filesize
9KB
MD5aa3d4be8df9f6aaa826638a3e6d13eb6
SHA1624722a85a9be78916b511c9fe547a1d36e79b10
SHA256b74074bc4ef29fb8554088495eb5c2697b3d3023904e190763e55d698c63b76a
SHA512ec9cc4debc07756a829641fbc72566385e65661beaa4607b9d695461475dc8286f61b228cf9bba7318d440dd7f196e570a5256b1b03cbfeb1e2902d1b3b9d792
-
Filesize
9KB
MD564627c5223f84db3765ed021a1d5d6f5
SHA1a0dd5a59f03012334b1d9e1a425e54bb64a138ce
SHA256670ef111dc5c3571b50aea86e20a88e52197716dc60bb5b2ff59652bf0309439
SHA512a0b0fc673ee4407fa7f11eb5aca05ce5336416666d0b30f5825a4c54b5b3013c7bb157cb3fcd78bfcbc5919d921a44c208a7991aa56033247a7c1ed093557029
-
Filesize
9KB
MD5db5cb90f4ab6eaa976e5484a099a9dd2
SHA167aee10b9f39edf9b38c7aca22f8db6e712eff93
SHA2565f7ec9652fde4a67abe3e318038c42147ed6f5beaa9b028586d192d4ac546293
SHA51267d9b264e80e6a1b3d93a8fd197d30dcd6a478beeac65f7b77f26557412d37cc1cdd3a1f1e0c2157f3274bae669b9882860e66ac00468b4ab659a081134ada49
-
Filesize
9KB
MD53cca59822df36f0d7af3aacc65883680
SHA16ab4a1c961850068bdf6a93d7d18a5b1330bb745
SHA256fb8a984836dc56a684dca641cab8cf95b090675c41c0b076194f6bb8575b73b5
SHA51277bc4f85f06aea04aa81c1bccc14b1ce5f4e24b72e75d8c6eb466fb29278ab6bdff1926ffdd4c24730a37dc532979dda6e77fe665399c8565125c57f75207710
-
Filesize
9KB
MD52df3763551e7c05a757b16ec43e1533c
SHA179b11a68e8a4e69534adaa72917a12d5ca9918fc
SHA2566ec2a7adec1bc204e13110a66ef501e1ecf7e09c83254f41dc0b454fbcf20760
SHA512d3022c8bb8233b30b29a1cc54e6c6cc573b538f98e731cb63c6613b353bb01f8fc64df6f3e88b42441937a0a5d86dbd36740db8986432985cf4478cbfe5905ca
-
Filesize
9KB
MD50204bd6f881126137515fcec89286b19
SHA13ce8a8d6a2cbe9f0ee8c56666fb86ff300e0dcac
SHA25626236a2a182979a261407878ad897d0c8652bd437f4d29938ef3ce53ac34a866
SHA512ba7432722b1be9f2244a7106d28cb52cfff93e21f41ea1b2798b8622a7f00124d25bb28212597b9ffbed46b77dbf77591c4c6c0b4daa6b5742c79e9273ab2680
-
Filesize
9KB
MD586a0a5ca89740024cd1616cd5b5fc644
SHA15ef8875c8f6bdaf66936d3f8466f83558e56b984
SHA256cbe1d8d4330e295197af7076ca8ae8580b1779b1c559425d8de0917e55fac988
SHA512363fc42d76334dcbaf3255497635dacfe67ec044e72e82cd52433038adfd2a56df7c86657437f19ebbf033f0a7161b36b53af37c81a1e99f5ee9fe981e3028b8
-
Filesize
9KB
MD5dd0411db7c893e4d110e686a4a054e9b
SHA11298455b326317b90ee1638470dbfdf8696156f7
SHA25612f31c80cdbfb59bf4878826d119540099e7690a8a402f6a7f914ec9f02c4c0e
SHA5127d6d00ef5cafe5750ac62dac9dee2b1885c3a989467298d2a2bca584436c235d7bf507bc855c93d7ef37d395b1357b202356398bc23e4b54194ee69a8c01b17e
-
Filesize
9KB
MD555a755ea9c8fa773fb0d5e34949d5135
SHA1553ee82f92b7aaa6e46277c59a829ec165242e83
SHA256b1ac47aa0afcdbb4a7ff04062bdd628cce02b85565931def7656971f4bd32910
SHA512322a8a5442609d140d6a090818ac12f200ba38a8460a0697f3ed95073b35d2b74290ce06deb45e145fb07365e73740edb96d11dbc8a91beccb6072f85f36318f
-
Filesize
9KB
MD5773fb78824ce644df00427dd4970e4f4
SHA16d679294161750732d414a95ed541ff52aebd6d6
SHA256619221ae706065176ec8216cab3bd561b5b838b8170058ed445095a40fd23c76
SHA512fda0a9eb79243df6c59b1d801e433b0b5eef6f64fe7250a59e9c1b48f9d146ad3e059fd72fa290b2b07c2d190af7d3ca7e428d2cbe442b2fbc3014c35715784e
-
Filesize
9KB
MD5ba8aeb292c3fec4d5ecf7d30779923c4
SHA161eab7d6ae3d512870baa39f416b34238e7cf42e
SHA2565d7a6dbb93a3c48ae5879fcbec968af5bc990d9d57aeaa22e9e23185449914c2
SHA5125d2708dc4264bbb5a600d27e74efd77a7c3ae047f2b6b9d169140758a2473509e3e550f5e8f5ff18df21e7b62d5d29977062a56a1f5cb2f889e243042adc0118
-
Filesize
9KB
MD5bf81008e1558e89a695c35f5b9739c4a
SHA15b2eca2d2e94ee749f6f4175525a2c314bb18645
SHA256744c20805e6a7bfff83c36b3afd5132683a0a2a3d19134558f9fb3fdd6aa0787
SHA512d033161e7ff9ac9532afc6a1e184996156cad792316f50b7ef11dde7dbf9965317d3fbe6c95edfc2cad8326879d3618fce85dfa842f20023253d51552da16c1d
-
Filesize
9KB
MD572949d8330253e0c3dcfa9f5c86f7db8
SHA1493ccb62f4e6171f345c50e434553366baf1a743
SHA256aa1cc4b4b76dee2718c03c1dfa97318ab39e71047c9990a4a7cf8e433f6aff89
SHA512e9eec50c1273e41314139933b3b1772357ef6bd7f555674f3b113dc37b90bd6be7b46637aaaa978f9af4776418afb5e2058d4cbb45b4125e4a8af1753bbad30f
-
Filesize
9KB
MD526655b010358cb1700c356d787fad199
SHA188fbab7046bdbe84cde82df47efc3344afcb4294
SHA2569041310b2f0641d0620021a2210947e26defd5081206e709b89b02cf3e340e81
SHA51227e562e54ffe4a47a8fe0b97e8c4253388ca96d36fca756c3cc5460127c8543b02e5b90b74530a0b52ab3006097f81ca0c8a72cf8be0ab04a20cd9ad80c15162
-
Filesize
9KB
MD5ff1334248c53d4151fb24305d52b5f9c
SHA1e2fcb1d8c751736b5c806607d507d187691307ce
SHA25621d1e4cc4aa41d0d2d6b6c02de5158e45ff46b71398ed77c1092a74c78058a6a
SHA512c86212debb1567996acdd2013cfa197d84f7be0ff2222cd0e22dfc71b1e3240cf43dab7cc4a99f3ea57f6e341b661011e7c82eeed1246f54ebc5a84d6baed705
-
Filesize
9KB
MD5b63d6fd6c3c970eafd34ab55cfad4307
SHA1122e0dc8f0139ce7786ee34a37f39aa9c2b3d87e
SHA2565823c9112b80fd514a1f947bf12cf950075e34e6b64cd776e76a67f72e29e433
SHA512af06bedc224a94ef330024e6958488201236d071b5fc7c5c95d9345facd52ebfb947fa4c65bc4735a347b6c5b5e9b834e26ca146db14416cefca6b18c298362a
-
Filesize
9KB
MD55fa86a6eb3eae96c3d0b5bde35b50f88
SHA1dca34fe8d63c9cb08aa172afaaac819aaf202f04
SHA256064a4d307674c5704b7ffa3c38b0f56a476bcbcd6dd28697cf3da4d820bcaf4e
SHA51275b6b1d0ee02383ee391688c6a48e7f42fe83d9005376b2da4c2e0dcce577b0f51632a79277d7d63a512abbc0a2b6c3e84caee1e9445b5aa014a54775a5f6fe4
-
Filesize
9KB
MD5a5c43068166701b35630accd6945a141
SHA139bbb7cb2cd1992202a59563d55a9e7945fcfd9f
SHA256041627c00a48dbea00e86b9f273cb3c34ca231327023892d3eed585b51fe20d1
SHA512b764baf3f00f9dcb17f48a1b66c5ef2ad3a3911256c524a4a378ef2b46e942981f42e368f176b878f5ccd0deb82185ae7fb89cbacc2c50eed6aeaf93b7cefff3
-
Filesize
9KB
MD5aafe4b5ef6e141ef4282bf777859b2c9
SHA19e6b38af9a0ddb3a2082828037dae7e349fd264a
SHA25623475e0e567f1c2b6263335497a54586cce691001e98d75c1b5fac6655376e98
SHA5126b87ae0aeb8a05b8ee5c96b27c477d59a7bff93e30ddc286a736298b0258506e4338c3e71df00a04a20396f798be1e68aca10c84027b56c952900e88c4f22daf
-
Filesize
9KB
MD56bbad9164d418fc24557b869c36edd53
SHA18d2581a3636273fe2d3413fcc4957bd0504db5b4
SHA2569a831aa6d7030e569bbe757cba5540f53a77031b1687af301197b0f5433063eb
SHA512969b548fb0459e395e0b836f39e315e8c15247c4697af56d9e617d6cd8bca5755beaaf292b57772f12715a4217230ec6d361f6162c61efc02dd1967d2688ffe4
-
Filesize
15KB
MD51c086566545064b274de21c9a4503997
SHA156985acc6276285cdf7a667f416826fbc6519c6e
SHA2561c5148defb5114efe398bc394469fc4a2aca8b7f0e86aa4d637469781a24516a
SHA512c90250ea19e709250ef15fa895a1d8c115dfe80c1d182328d528848c45c91c326dad8ea8f76b1da5e37352e11b18c0c222846ac2591fe9c38420a1cebb60d503
-
Filesize
193KB
MD563d760c602d4408c4a13df38736cb65a
SHA131641167254fdf5f4c4defc75a60b2d041bbe8a5
SHA25678d51d65cd3a9cb0a219c0d6c8f03a68278a1f3dcb4269f6f2469109127354e9
SHA512dd4b964696dd44712e645a8feb8fce50cb7a2dc6cdbbc4c9e3db59ca404739a8a93d3c0ada4c22148cf4cc5e61a38bbf5b92d61ecf0e8544bd2d7be67494dcd7
-
Filesize
194KB
MD5be8b266f43cad6fe0d022e758addcd55
SHA1541b1ae956c2729e5979ee916e7624b48f0d4477
SHA256f0247d08ca77f2ce6ff6d37bd0b4aa6b89cc166c64a109d484d8b6cfd0d5c8be
SHA512f9f6c43b74f5578f169e9351ddb734a68ca42b16ca42c253c691eeaf0da080a804f8257bfe9cf9dae66023ee94247252e0401dc4d6681dc3825a58057d147bb7
-
Filesize
500KB
MD584591cf8bbe4b94d5a83b2cdd605d4b5
SHA185f1dbf03d2b4c52e067849b93c3f4c7ec284886
SHA256b8c2bf47cb70a77582c302284554ecd4a29f9ee55c09fc2193b3ba942d5884ae
SHA51231ff3523bedc87efd5040c46fdaff325c29fa109a912b729c81660c0737505e9dbd2f9bc0a443bfce12ede2569d023cc1f56f6bea0943a669f4f85e0f420830d
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c