Overview
overview
10Static
static
10Battly-Lau...ws.exe
windows7-x64
7Battly-Lau...ws.exe
windows10-2004-x64
7resources/...ute.js
windows7-x64
3resources/...ute.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...DME.js
windows7-x64
3resources/...DME.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...ime.js
windows7-x64
3resources/...ime.js
windows10-2004-x64
3resources/...cli.js
ubuntu-18.04-amd64
4resources/...cli.js
debian-9-armhf
4resources/...cli.js
debian-9-mips
1resources/...cli.js
debian-9-mipsel
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...tch.js
windows7-x64
3resources/...tch.js
windows10-2004-x64
3resources/...ark.js
windows7-x64
3resources/...ark.js
windows10-2004-x64
3resources/...put.js
windows7-x64
3resources/...put.js
windows10-2004-x64
3resources/...col.js
windows7-x64
3resources/...col.js
windows10-2004-x64
3resources/...ten.js
windows7-x64
3resources/...ten.js
windows10-2004-x64
3resources/...ema.js
windows7-x64
3resources/...ema.js
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 20:33
Behavioral task
behavioral1
Sample
Battly-Launcher-Windows.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Battly-Launcher-Windows.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
resources/app/node_modules/color-convert/route.js
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
resources/app/node_modules/color-convert/route.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
resources/app/node_modules/color-name/index.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
resources/app/node_modules/color-name/index.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
resources/app/node_modules/concat-map/README.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
resources/app/node_modules/concat-map/README.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
resources/app/node_modules/concat-map/index.js
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
resources/app/node_modules/concat-map/index.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
resources/app/node_modules/ejs-electron/index.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
resources/app/node_modules/ejs-electron/index.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/Mime.js
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/Mime.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/cli.js
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral16
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/cli.js
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral17
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/cli.js
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral18
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/cli.js
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral19
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/index.js
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/index.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
resources/app/node_modules/minimatch/minimatch.js
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
resources/app/node_modules/minimatch/minimatch.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
resources/app/node_modules/protocol/benchmark/benchmark.js
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
resources/app/node_modules/protocol/benchmark/benchmark.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
resources/app/node_modules/protocol/benchmark/input.js
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
resources/app/node_modules/protocol/benchmark/input.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
resources/app/node_modules/protocol/benchmark/protocol.js
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
resources/app/node_modules/protocol/benchmark/protocol.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
resources/app/node_modules/protocol/lib/flatten.js
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
resources/app/node_modules/protocol/lib/flatten.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
resources/app/node_modules/protocol/lib/flattenSchema.js
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
resources/app/node_modules/protocol/lib/flattenSchema.js
Resource
win10v2004-20240802-en
General
-
Target
Battly-Launcher-Windows.exe
-
Size
112.1MB
-
MD5
03696da629e834c395f699847326448a
-
SHA1
3529afa76451ed5beeeb0bb4a31f7cc8bc463aa6
-
SHA256
9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d
-
SHA512
fca0ef778b3ab13cf01e3d39d4c7eb4a587f600ed8d5ab10a03a3061178609dc13a75f6cc736ec27ed9f40a2a554030217cc91a8bf982d42f460585102f1969b
-
SSDEEP
3145728:SJcuNt6i+X0MdTUPo+YFawtU4odzp7emMT:qcuN7+QYFjmPztemE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1744 Battly Launcher.exe -
Loads dropped DLL 5 IoCs
pid Process 2000 Battly-Launcher-Windows.exe 2000 Battly-Launcher-Windows.exe 2000 Battly-Launcher-Windows.exe 2000 Battly-Launcher-Windows.exe 1744 Battly Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Battly-Launcher-Windows.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe Token: SeShutdownPrivilege 1252 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe 1252 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1744 2000 Battly-Launcher-Windows.exe 30 PID 2000 wrote to memory of 1744 2000 Battly-Launcher-Windows.exe 30 PID 2000 wrote to memory of 1744 2000 Battly-Launcher-Windows.exe 30 PID 2000 wrote to memory of 1744 2000 Battly-Launcher-Windows.exe 30 PID 1252 wrote to memory of 2316 1252 chrome.exe 32 PID 1252 wrote to memory of 2316 1252 chrome.exe 32 PID 1252 wrote to memory of 2316 1252 chrome.exe 32 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2520 1252 chrome.exe 34 PID 1252 wrote to memory of 2536 1252 chrome.exe 35 PID 1252 wrote to memory of 2536 1252 chrome.exe 35 PID 1252 wrote to memory of 2536 1252 chrome.exe 35 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36 PID 1252 wrote to memory of 2584 1252 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7db9758,0x7fef7db9768,0x7fef7db97782⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:22⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1460 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:82⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:12⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2140 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:12⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1028 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:22⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1408 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3684 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:82⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3688 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:12⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1300,i,3016993377536216275,16533897551400913173,131072 /prefetch:82⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
363B
MD5406b71ce93ecf49af0cd3ddd4c4f12ed
SHA1e649cda9c0b97338ad907634a2fb9b679b2090df
SHA256dc969680eee63f4af3896d8dbfc3d813c79736745f7e2e524865e1918915e353
SHA51239b78410cd8d13e9001e26c03d28724976892f1bd4b3edec7e77de33903021315bd5a4d0ac939673dc7fe2887518b6bdee8f38b0d530127f545dd4f99dcaef37
-
Filesize
5KB
MD57f386765ab861299ae21f5233349b078
SHA1b1ec872db03b35553ef173a9ab9e0aa8b35b1cad
SHA256b1be1239b0d5139d8654ccad5cafda44c4dc107f75cc7ba261f0cef322be84b1
SHA51258c6364901ddef88118438df7668ab6a8dba6d27adb8ba380672f6d4103352f34bb491e36d22dda5e66a95cb07bacb58960634d1b0953aacc2a48a53d613bce3
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
162KB
MD5dfb929636c720047a5df3583ce5195a3
SHA1abee1fcd7d6b311bee5798d55a8b02c869a465fa
SHA2565eb5b1f6c4eaee49176159d202c522b849d18d92796b8408cfb3511d80754ebe
SHA51280ec2c624c327e51bee359d2c7b7d7189fa5aef36996f3e1998b1afce53991a96b2325a223d281a174032248df94306aeb3ecc16078f0c9bf7f37b8a402704a8
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2.7MB
MD5bf09deeeb497aeddaf6194e695776b8b
SHA1e7d8719d6d0664b8746581b88eb03a486f588844
SHA256450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
SHA51238d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\AppData\Launcher\Code Cache\wasm\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\AppData\Launcher\DawnWebGPUCache\data_3
Filesize8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\AppData\Launcher\Local Storage\leveldb\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\AppData\Launcher\shared_proto_db\metadata\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ansi-styles\license
Filesize1KB
MD5915042b5df33c31a6db2b37eadaa00e3
SHA15aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA25648da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
SHA5129c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\async\inject.js
Filesize4KB
MD5724bb52915e1158b4dff6f26ef4baf72
SHA1ad0aa6a0ac5576433051167524923e6aa794c96a
SHA256f1e4594194164d2504946c85c8e983346b25f9be8239178defec27e912b56c21
SHA512657c3dec82c5c6c34accdbc9d96e2be59a592e60241960810f10a662f5305c21dcef8cf006fcdefb0d48d30ccdd30d9dd6c263c089a88591f18a83a2f390eaaa
-
Filesize
411KB
MD553b029ccb83951c0f232fbcde874b403
SHA1c6c57b8b7eac7c0f3b7ecff5d4b2a4c1de4d326f
SHA2564a3a74bcc1da624c51860bf3dc2333230cad7c961414e015a987e204f6447461
SHA512514d3e5e925ec16db2ab89d71b34c95ea76f5679dfc4fc2e759c0e982d08660b5ca9a76bbc814ed3335b461ac9e1bf82de2b88dc988f4378e3a974cd59485acb
-
Filesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9