Overview
overview
10Static
static
10Battly-Lau...in.exe
windows7-x64
7Battly-Lau...in.exe
windows10-2004-x64
7resources/...ute.js
windows7-x64
3resources/...ute.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...DME.js
windows7-x64
3resources/...DME.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...ime.js
windows7-x64
3resources/...ime.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...tch.js
windows7-x64
3resources/...tch.js
windows10-2004-x64
3resources/...ark.js
windows7-x64
3resources/...ark.js
windows10-2004-x64
3resources/...put.js
windows7-x64
3resources/...put.js
windows10-2004-x64
3resources/...col.js
windows7-x64
3resources/...col.js
windows10-2004-x64
3resources/...ten.js
windows7-x64
3resources/...ten.js
windows10-2004-x64
3resources/...ema.js
windows7-x64
3resources/...ema.js
windows10-2004-x64
3resources/...ate.js
windows7-x64
3resources/...ate.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3Analysis
- max time kernel
36s - max time network
137s - platform
windows7_x64 - resource
win7-20240704-es - resource tags
arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows - submitted
07/09/2024, 00:04
Behavioral task
behavioral1
Sample
Battly-Launcher-win.exe
Resource
win7-20240704-es
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Battly-Launcher-win.exe
Resource
win10v2004-20240802-es
windows10-2004-x64
9 signatures
1200 seconds
Behavioral task
behavioral3
Sample
resources/app/node_modules/color-convert/route.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral4
Sample
resources/app/node_modules/color-convert/route.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral5
Sample
resources/app/node_modules/color-name/index.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral6
Sample
resources/app/node_modules/color-name/index.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral7
Sample
resources/app/node_modules/concat-map/README.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral8
Sample
resources/app/node_modules/concat-map/README.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral9
Sample
resources/app/node_modules/concat-map/index.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral10
Sample
resources/app/node_modules/concat-map/index.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral11
Sample
resources/app/node_modules/ejs-electron/index.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral12
Sample
resources/app/node_modules/ejs-electron/index.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral13
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/Mime.js
Resource
win7-20240708-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral14
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/Mime.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral15
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/index.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral16
Sample
resources/app/node_modules/ejs-electron/node_modules/mime/index.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral17
Sample
resources/app/node_modules/minimatch/minimatch.js
Resource
win7-20240708-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral18
Sample
resources/app/node_modules/minimatch/minimatch.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral19
Sample
resources/app/node_modules/protocol/benchmark/benchmark.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral20
Sample
resources/app/node_modules/protocol/benchmark/benchmark.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral21
Sample
resources/app/node_modules/protocol/benchmark/input.js
Resource
win7-20240708-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral22
Sample
resources/app/node_modules/protocol/benchmark/input.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral23
Sample
resources/app/node_modules/protocol/benchmark/protocol.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral24
Sample
resources/app/node_modules/protocol/benchmark/protocol.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral25
Sample
resources/app/node_modules/protocol/lib/flatten.js
Resource
win7-20240708-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral26
Sample
resources/app/node_modules/protocol/lib/flatten.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral27
Sample
resources/app/node_modules/protocol/lib/flattenSchema.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral28
Sample
resources/app/node_modules/protocol/lib/flattenSchema.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral29
Sample
resources/app/node_modules/protocol/lib/generate.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral30
Sample
resources/app/node_modules/protocol/lib/generate.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral31
Sample
resources/app/node_modules/protocol/lib/index.js
Resource
win7-20240903-es
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral32
Sample
resources/app/node_modules/protocol/lib/index.js
Resource
win10v2004-20240802-es
windows10-2004-x64
1 signatures
1200 seconds
General
- Target Battly-Launcher-win.exe
- Size 188.1MB
- Sample240907-acnwfsvbmp
- SHA256 9cd7f45620bda9811e200380d3e43a3ea768c48d1240448c279b3321d3ae59b6
- MD5 3b6b92297beb78efb283e0d2fa32fc19
- SHA1 b056d281a74d9e0fd7546bbed068a915608336e0
- SHA512 bb32b9529abe3fef0025cd8f81a4bcea6cffaa4b20112e9fbd57482b0f4ee092740afbcd788684fdae676bc7cebc17af491c9dae73b082cca31b9aabc3111463
- SSDEEP 3145728:IJcuNt6i+X0MdTUPo+YFawtU4odzw7Lm3436E7IkGl0BkChNw5+VTmms+B6Q87:UcuN7+QYFjmPz0Lm3J0wahNw5+VTTs+y
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 792 Battly Launcher.exe - Loads dropped DLL 5 IoCs
pid Process 2756 Battly-Launcher-win.exe 2756 Battly-Launcher-win.exe 2756 Battly-Launcher-win.exe 2756 Battly-Launcher-win.exe 792 Battly Launcher.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Battly-Launcher-win.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1688 chrome.exe 1688 chrome.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe Token: SeShutdownPrivilege 1688 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe 1688 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 792 2756 Battly-Launcher-win.exe 30 PID 2756 wrote to memory of 792 2756 Battly-Launcher-win.exe 30 PID 2756 wrote to memory of 792 2756 Battly-Launcher-win.exe 30 PID 2756 wrote to memory of 792 2756 Battly-Launcher-win.exe 30 PID 1688 wrote to memory of 436 1688 chrome.exe 32 PID 1688 wrote to memory of 436 1688 chrome.exe 32 PID 1688 wrote to memory of 436 1688 chrome.exe 32 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 2084 1688 chrome.exe 34 PID 1688 wrote to memory of 864 1688 chrome.exe 35 PID 1688 wrote to memory of 864 1688 chrome.exe 35 PID 1688 wrote to memory of 864 1688 chrome.exe 35 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36 PID 1688 wrote to memory of 2060 1688 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win.exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\Battly Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7039758,0x7fef7039768,0x7fef70397782⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:22⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1392 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:82⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2028 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:12⤵PID:884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2036 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:12⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1904 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:22⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2836 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:12⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:82⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4048 --field-trial-handle=1444,i,13089439540565897776,16179861506325134038,131072 /prefetch:12⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
- Size 212KB
- SHA256 7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
- MD5 08ec57068db9971e917b9046f90d0e49
- SHA1 28b80d73a861f88735d89e301fa98f2ae502e94b
- SHA512 b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
- SSDEEP 3072:tG3zu3Ek6OGff9u9xmHDyzB2m2niCRYd16kwEaqKk35LaHahdU269cWQJWU7/u2Y:tuNH9BHM2niUY+kyqKk6mCT7ULuoK9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cf9d5101e93bbbea_0
- Size 280B
- SHA256 eaeaad7485ad9fb3a1d3aa8c9f2b8ff1887f9fd330b54342d87ec433fc225aac
- MD5 f4b10db4a390bcc14c13b2158abc2db2
- SHA1 69581f73dc0fba33b942c365a11a63dfe7502e09
- SHA512 df3277164ee17c8eb5d34215e24cabfe0ac920dab7f5b0818e4b9e9912bd27c1f97717e8d4e4b4e32cebbd10d537841ab1c4683e612c92a6d035d8e02c8e2f6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 da125a09501e5a993c991b02981b895e812522b8f73d612b7fa9406c6ac7f5f8
- MD5 2b28001390e12ccee76a3519210e28b2
- SHA1 cfbe9941217221ce4dab10d7a3601f005a2cd819
- SHA512 0267be3f3c4f1b11f49b3e0f98c04f5fbd24996af8c06b053a08545996590ce1ce51d8f022acd848eb17a4e3e9392dd3a240a9cda46936226bf6a00c6684464c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 efb64d60f11d110cd643a50919a0229db0c33e78c0a2417ee73f85e8602b9956
- MD5 2be7b096721f2f6257127ca483086861
- SHA1 2759ae3f8220260e8e87e53b89fc56121a23bbc0
- SHA512 03c733ad55d89cd28137540801085a6dbf91fb6ec1d85515b0f01bbfcf1a3803691f60a3831f3a6b70ee976808e087b740f1f07551f784e43750dcee3cfcb999
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 dc3a62db52292de50f80101e977fd4a4b9cf624863080c1870cf928d490975f6
- MD5 0872ee88da26ebd8e1e63866ffaa2ee2
- SHA1 30057832991c172cb008543088b64f88822ab74f
- SHA512 d602b6c60d61e2ec66ca8d29b81a6b3c763f411066b679fe3249936846f6a1c5ae0d293c6a07dad2b54ca260e79d0c7ed03e83cb3b92f1cfd45efd6183c25cdf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
- Size 16B
- SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
- MD5 aefd77f47fb84fae5ea194496b44c67a
- SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
- SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 56d0e187e8e237cbc58af714204984734d55cec61cf1f5796a4ab821247f34e4
- MD5 fb1ac249efc55e9b5b823ca270b77b8a
- SHA1 6dee0c7420c7586cf59b4ce4a47e0febfb63b0f0
- SHA512 47cc793c53253fd3b34dbf7b9a660e725f405a1433470ec39b7d123f73ab339c28a17b5afc5cc242cded5d237a5e36fe64c5a33a429b03b58a4f24c7a5ecdb98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 987B
- SHA256 7b77f86b2d1617d22560fe2cc0cb22909121eb2b3dbde2ade864eba79ae41522
- MD5 180f956de4a41ed1bd3caccb941619bb
- SHA1 eb5c55f0aa490b308ee7b95668c673a5d079d017
- SHA512 a3c51b55c59b902a84ea498416fde389d79cad6a65d257e5792cb52423693cb954aeae890d9eb07753bb440912297c9d6244de42783f40304e797fe576eb4ea2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 d2f3c0c3bd206805f479ebf1e2d20a1a2d1ba8247964a2fcce94152f6bfb4d6a
- MD5 6a071a8459a5266352d5b091a76a57de
- SHA1 16b257f13a706ba1459e09929f2bd9845e741e00
- SHA512 a24c40e3542161a90ee4b4c19bdf772f2d035ef370fc5de184d901250acf386c611475196a230b1a718d9d051cedae9a167c370841941c997862335dd4073dc3
- SSDEEP 96:wwALKI/yXVGd8iZRy7Di+6MsmdewkPMFauOQA7ajVhYtjEsXt0/cg2Vup:w/LIXq8syy+FjkPTgotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 ecda216ce6b4ad81dcf3f380570840a8524a2d2ce9f5ecfeb9dc703072dba960
- MD5 f28b40b04e758d677b75b0f2b1913457
- SHA1 bcb8541b69da27402217f9a2111b9f6e3871f900
- SHA512 b97770ede967f44684527fc08424366c723362e49e1bb5216140d2e717e61951f1b0e17c9d0075f7c98908438d08e2e70ccefcedaa9427e5e33ab252b1b59348
- SSDEEP 96:wwALKI/yXVGd8iZRy7Di+6Msmde4k/1FOQA7ajVhYtjEsXt0/cg2Vup:w/LIXq8syy+F3k/votjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 8dd13fbc447cf01b1d1862d4042246760af8a22480c7b9a8906bee577bd5b5fe
- MD5 6fed1aff46f0121c1a6808b18cfb6e14
- SHA1 8e24d6932bd5e2cee3e369973dd47a6fddee4c89
- SHA512 6fad4e3b893848be7bdc03a98a17db697c2a1a020eb3b645b9ebce4fef76378845ae63bd87b3d4c318779dcbe94d7393776d2374e6d6365948cac54805570f07
- SSDEEP 96:wwALKI/yXVGd8iZRy7Di+6Msmde6IOQA7ajVhYtjEsXt0/cg2Vup:w/LIXq8syy+FTCotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 c66c9c1f497668d6131a9073e815d3d7fc3f2cc82a759ccf08063411d1fc4958
- MD5 a46986306582aa8525841b1add6c3b71
- SHA1 717047a54a6773b0f10fa601efbc426313e6bc08
- SHA512 553aaf8d63f4bf77a7da2db6ea9f08c5cb0f722eec2b5fb809e52b42a661cee6e87a06c2a6c48144e6528fd05bae35cf59c4dd647e64afc4e90e082355685904
- SSDEEP 96:wwALKI/yXVGd8iZRy7Di+6MsmdevkiO01OQA7ajVhYtjEsXt0/cg2Vup:w/LIXq8syy+F4kiRtotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 321KB
- SHA256 3ed7a4fc069e471cd33deceed99180cdbb6252b3010401a1b863f47c84361cd6
- MD5 63d449f7961235871d70afd80abfed8d
- SHA1 a63d67e6a80a15c069902a34e75ec87cc5353513
- SHA512 eb8ffb9aac89cd33cd872981dde699a7b9c550d648dac6c7e1cc56301127bc3b80529fb5d963d9a0124d8f2bc095f09286c4c8c0ef44b18e8cce2199acf155d6
- SSDEEP 6144:CxUPsnKK+aQ2HsCcziNWe9dpDoL52M2clNC+2fo0aCnjjjrib:CxUPQgaQ2MCcOUe9dm2MFlGt/7mb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fa6a0d05-b56d-4c95-966b-65a8bf9222cf.tmp
- Size 321KB
- SHA256 79e52f70bf0af151251be2f2afe075894eda5ec0cb5e63a6b6eca66cfa65d70c
- MD5 0112b432a127dc3980cd28e5fa1b9a0b
- SHA1 0408865981d26751d9d8d9f1b280847aaccd8ca2
- SHA512 90d01c8027805d825440e3884dbe989fab898aca757bc23e3b15fdedab3c6d5981291877ae47df6399d5434e40a2b786f45a9a40ec45ccc4533a37136a1b31b1
- SSDEEP 6144:3xUPsnKK+aQ2HsCcziNWe9dpDoL52M2clNC+2fo0aCnjjjrib:3xUPQgaQ2MCcOUe9dm2MFlGt/7mb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\ffmpeg.dll
- Size 2.7MB
- SHA256 450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
- MD5 bf09deeeb497aeddaf6194e695776b8b
- SHA1 e7d8719d6d0664b8746581b88eb03a486f588844
- SHA512 38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
- SSDEEP 49152:2gUBJTIe17EwJvr3OXtgTyFBcCen6yfUvUUP/bkLmV:ZY1vreXOuFePUP/bay
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\resources\app\AppData\Launcher\Code Cache\wasm\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\resources\app\AppData\Launcher\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\resources\app\AppData\Launcher\Local Storage\leveldb\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\resources\app\AppData\Launcher\shared_proto_db\metadata\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\resources\app\node_modules\ansi-styles\license
- Size 1KB
- SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- MD5 915042b5df33c31a6db2b37eadaa00e3
- SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2lAJpOSmFJDNkXONlNELTCxSGFu\resources\app\node_modules\async\inject.js
- Size 4KB
- SHA256 f1e4594194164d2504946c85c8e983346b25f9be8239178defec27e912b56c21
- MD5 724bb52915e1158b4dff6f26ef4baf72
- SHA1 ad0aa6a0ac5576433051167524923e6aa794c96a
- SHA512 657c3dec82c5c6c34accdbc9d96e2be59a592e60241960810f10a662f5305c21dcef8cf006fcdefb0d48d30ccdd30d9dd6c263c089a88591f18a83a2f390eaaa
- SSDEEP 96:y6Kcr3mvLCw7I20odkC2z2yS4NBsBMV30scZ2OFbnkhdQ70M:y6KcOLfdkC2zpNBsBI3zo2skhK70M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso90EB.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso90EB.tmp\splash.bmp
- Size 411KB
- SHA256 4a3a74bcc1da624c51860bf3dc2333230cad7c961414e015a987e204f6447461
- MD5 53b029ccb83951c0f232fbcde874b403
- SHA1 c6c57b8b7eac7c0f3b7ecff5d4b2a4c1de4d326f
- SHA512 514d3e5e925ec16db2ab89d71b34c95ea76f5679dfc4fc2e759c0e982d08660b5ca9a76bbc814ed3335b461ac9e1bf82de2b88dc988f4378e3a974cd59485acb
- SSDEEP 3072:Iy+VjIHJNBlLhK2mTBxTfFM+8GLa9V+16rGwQHS5LjgzlZkvZEFqKGO0jCC1jMrL:ejIHjnmVxTiheqksRQymRKvOwP9EL
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso90EB.tmp\BgImage.dll
- Size 7KB
- SHA256 e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
- MD5 487368e6fce9ab9c5ea053af0990c5ef
- SHA1 b538e37c87d4b9a7645dcbbd9e93025a31849702
- SHA512 bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
- SSDEEP 96:8efk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:tcTJa2roqJyA2EN8diuTHje
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso90EB.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP