Overview
overview
10Static
static
3Ghosty Per...er.rar
windows7-x64
10Ghosty Per...er.rar
windows10-2004-x64
1Ghosty Per...FN.exe
windows7-x64
10Ghosty Per...FN.exe
windows10-2004-x64
10Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per...ry.dll
windows7-x64
5Ghosty Per...ry.dll
windows10-2004-x64
5Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...on.dll
windows7-x64
1Ghosty Per...on.dll
windows10-2004-x64
1Ghosty Per...ec.dll
windows7-x64
1Ghosty Per...ec.dll
windows10-2004-x64
1Ghosty Per...z2.dll
windows7-x64
1Ghosty Per...z2.dll
windows10-2004-x64
1Ghosty Per...pe.dll
windows7-x64
1Ghosty Per...pe.dll
windows10-2004-x64
1Ghosty Per...ui.ini
windows7-x64
3Ghosty Per...ui.ini
windows10-2004-x64
1Ghosty Per...16.dll
windows7-x64
1Ghosty Per...16.dll
windows10-2004-x64
1Ghosty Per...rts.sh
windows7-x64
3Ghosty Per...rts.sh
windows10-2004-x64
3Ghosty Per...th.sln
windows7-x64
3Ghosty Per...th.sln
windows10-2004-x64
3Ghosty Per...th.xml
windows7-x64
3Ghosty Per...th.xml
windows10-2004-x64
1Ghosty Per...ilters
windows7-x64
3Ghosty Per...ilters
windows10-2004-x64
3Analysis
-
max time kernel
89s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 22:30
Static task
static1
Behavioral task
behavioral1
Sample
Ghosty Permanent Spoofer.rar
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Ghosty Permanent Spoofer.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral10
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral20
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ghosty Permanent Spoofer/imgui.ini
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Ghosty Permanent Spoofer/imgui.ini
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Ghosty Permanent Spoofer/server/EmuAuth.sln
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
Ghosty Permanent Spoofer/server/EmuAuth.sln
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.xml
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.vcxproj.filters
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral32
Sample
Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.vcxproj.filters
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Ghosty Permanent Spoofer/imgui.ini
-
Size
96B
-
MD5
4e6c82ea70e35ffccbc1f6e1e407cf69
-
SHA1
7f824787db54b8328a0d85365e001fb3f3a3f9a7
-
SHA256
7feae2d266f55f0c5fe1104b96ae043ef79aaeac7ab7fa27225afd44b0a9c66f
-
SHA512
5223dbf0dfb5dde2ff2507d2128cff8363c257c31e673ad63b8a910a915dabf8166412df21322124619a43796b1285308103df0a5dd65acd8812272ea0fbedd5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2724 chrome.exe 2724 chrome.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2852 2724 chrome.exe 32 PID 2724 wrote to memory of 2852 2724 chrome.exe 32 PID 2724 wrote to memory of 2852 2724 chrome.exe 32 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 644 2724 chrome.exe 34 PID 2724 wrote to memory of 2408 2724 chrome.exe 35 PID 2724 wrote to memory of 2408 2724 chrome.exe 35 PID 2724 wrote to memory of 2408 2724 chrome.exe 35 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36 PID 2724 wrote to memory of 640 2724 chrome.exe 36
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\imgui.ini"1⤵PID:2364
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6cf9758,0x7fef6cf9768,0x7fef6cf97782⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:22⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:82⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:12⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:12⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1668 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:22⤵PID:956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2184 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:12⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:82⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2768 --field-trial-handle=1184,i,572765181777139855,2492432816334217519,131072 /prefetch:12⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD5d79b35ccf8e6af6714eb612714349097
SHA1eb3ccc9ed29830df42f3fd129951cb8b791aaf98
SHA256c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365
SHA512f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a
-
Filesize
168B
MD556eb7eb8005efddb56e6bfc6f1f456d4
SHA1fa284c01cf6c86b5a96269afb964b82a01a1e14f
SHA256b7c553b6dfa645235899d643f7a8e0a06f0838ad226b829340ff37f21eef894e
SHA512f6050596c666c8a1e18123fa87e03fccfa20d37fcc619e5f9e7c89b7450f20466ed5ece748f5620969cb139bd5ea705cc91660e023a644d03c006b8ad45098c9
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD52170e9c0b2072332ba57ae38de652731
SHA1c6a34c80fbea486a8464e52c21525abf2659e82c
SHA256b43ab6ee1df9567bc655305107f3e11db5339bc339f0a859248bff6d5d8581cf
SHA5124c4f46c12ee76bce10ae693b355dc71f7de836253e988a734855be557cabd1f59730778031efbe9c82ff2f2c8089c177a32a0dc0680b373879c0c8fa88b88282
-
Filesize
6KB
MD5f91623e4b00b5a2b362702ffdba1bfee
SHA12374fd1fdb567262b2ea5efe6f3297b8898a630f
SHA256d6494c098a547a48b445426934f5b526725e39ee5ec5c80bf7d9d0d77bafaca0
SHA51276d1886c6a9b611873b61a42818c38948e80e5578189b46e69d3281ff3edd0db13dd9df283a6dc7e910a6b63dfbed9f59a9e1ef61b287fdfc499fb725259e7de
-
Filesize
5KB
MD55ebe3c1ed99f869286df548ad20fa69f
SHA1e50dfae88bcce810965bfbba629f2e90419d0337
SHA2567859801048c6d7ed86950de34c0cab222824b7bb878a882f2e4e05ab9b31a052
SHA5127f7f7fcb15051b54419cfa6f1f3a77561f3707c0fa54038fe8fdf1b5dd82f2c4b360100fb827b1caf50ce9907612830821d0c20b4ea85e704f6e4af89f2c4418
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
343KB
MD550ae2d4680b6856be3138f3666e3daf9
SHA10c772e9b1f54f8bb3e9ba3e02177946d44ef35a7
SHA25693f64f5acbd41505e40ce6a77ca65a469939145e3fe8fadfd63be040682212d9
SHA512a681a5f3612d1399d86e29fcc2c7fc0e5d20e7bd83283bc0d2209e432691da53f01decd6500377ebc2ce9b628e983ef5f63faf37cb1ff0825f45e88306e0cb0d
-
Filesize
343KB
MD5a6413f2bdd061c0bc6141e500bf0b8ce
SHA1b8ea47ecc03d5ff64cd90c97d6b226de97c29ca5
SHA256d47df22adc521380c7b5f50ca77eb042d6c35bf34561d1d28b7788b8b5e6acc4
SHA512e97f068401cea924cddb0380e363ada417a60f535672ce46d48382f58dd0e4b7b529e89945104490785d2094626e68d72be693e98fdd48f48fab5a589c21795c