d74642bc350421e1a55f73755e408b36cf5d859eb82b5beb04f99abc976fbf73

Resubmissions

18/04/2026, 06:30

260418-g9tarsbv6k7

18/04/2026, 06:29

260418-g834ksh1617

Analysis

user interaction
yes
max time kernel
35s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mcpackbycatchingggg.bat
Size 2KB
Sample260418-g834ksh161
SHA256 d74642bc350421e1a55f73755e408b36cf5d859eb82b5beb04f99abc976fbf73
MD5 3ec55f95ab7a1fa9cbcf357fab5b1315
SHA1 c5171b9c0338bac7acebf84fadccfe3b06b0f9ee
SHA512 d55a4f134263c2f3b84c56f17439d345e4f6fd72e47965047d6bc7cd38149a02a7e1af708a9eb0768f42cee4ac2c8298a4f7b0e8acf0809d17a284012949909c
TLSH
T1BE51395F6C8DAD419DE02FA347263781E601904E36EABBF86D29E02C5F0FD817115BD9
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	cmd.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	whatismyipaddress.com
9	whatismyipaddress.com
18	whatismyipaddress.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	chrome.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
2092	timeout.exe
1260	timeout.exe
1300	timeout.exe
2252	timeout.exe
1788	timeout.exe
3036	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	chrome.exe
2324	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2092	4760	cmd.exe	86
PID 4760 wrote to memory of 1260	4760	cmd.exe	87
PID 4760 wrote to memory of 1300	4760	cmd.exe	88
PID 4760 wrote to memory of 2252	4760	cmd.exe	89
PID 4760 wrote to memory of 1788	4760	cmd.exe	90
PID 4760 wrote to memory of 2324	4760	cmd.exe	91
PID 4760 wrote to memory of 3036	4760	cmd.exe	93
PID 2324 wrote to memory of 3928	2324	chrome.exe	94
PID 2324 wrote to memory of 4720	2324	chrome.exe	95
PID 2324 wrote to memory of 4720	2324	chrome.exe	95
PID 2324 wrote to memory of 3832	2324	chrome.exe	96
PID 2324 wrote to memory of 2348	2324	chrome.exe	97
PID 2324 wrote to memory of 2348	2324	chrome.exe	97
PID 2324 wrote to memory of 4468	2324	chrome.exe	98
PID 2324 wrote to memory of 4468	2324	chrome.exe	98
PID 2324 wrote to memory of 3992	2324	chrome.exe	154
PID 2324 wrote to memory of 3992	2324	chrome.exe	154
PID 2324 wrote to memory of 4156	2324	chrome.exe	101
PID 2324 wrote to memory of 4156	2324	chrome.exe	101
PID 2324 wrote to memory of 4596	2324	chrome.exe	102
PID 2324 wrote to memory of 4596	2324	chrome.exe	102
PID 4760 wrote to memory of 472	4760	cmd.exe	103
PID 4760 wrote to memory of 1376	4760	cmd.exe	104
PID 4760 wrote to memory of 1004	4760	cmd.exe	105
PID 4760 wrote to memory of 560	4760	cmd.exe	106
PID 4760 wrote to memory of 1660	4760	cmd.exe	108
PID 4760 wrote to memory of 648	4760	cmd.exe	109
PID 4760 wrote to memory of 3840	4760	cmd.exe	110
PID 4760 wrote to memory of 2968	4760	cmd.exe	111
PID 4760 wrote to memory of 3524	4760	cmd.exe	112
PID 4760 wrote to memory of 1964	4760	cmd.exe	113
PID 4760 wrote to memory of 1892	4760	cmd.exe	114
PID 4760 wrote to memory of 3544	4760	cmd.exe	125
PID 4760 wrote to memory of 1008	4760	cmd.exe	127
PID 4760 wrote to memory of 1920	4760	cmd.exe	129
PID 4760 wrote to memory of 1352	4760	cmd.exe	130
PID 4760 wrote to memory of 3288	4760	cmd.exe	133
PID 4760 wrote to memory of 4172	4760	cmd.exe	135
PID 4760 wrote to memory of 820	4760	cmd.exe	137
PID 4760 wrote to memory of 4544	4760	cmd.exe	139
PID 4760 wrote to memory of 3892	4760	cmd.exe	141
PID 4760 wrote to memory of 2036	4760	cmd.exe	143
PID 4760 wrote to memory of 3824	4760	cmd.exe	145
PID 4760 wrote to memory of 116	4760	cmd.exe	147
PID 4760 wrote to memory of 2244	4760	cmd.exe	149
PID 4760 wrote to memory of 2080	4760	cmd.exe	150
PID 4760 wrote to memory of 3032	4760	cmd.exe	151
PID 4760 wrote to memory of 4784	4760	cmd.exe	152
PID 4760 wrote to memory of 1292	4760	cmd.exe	153
PID 4760 wrote to memory of 3992	4760	cmd.exe	154
PID 4760 wrote to memory of 4384	4760	cmd.exe	155
PID 4760 wrote to memory of 4268	4760	cmd.exe	156
PID 4760 wrote to memory of 3884	4760	cmd.exe	157
PID 4760 wrote to memory of 5264	4760	cmd.exe	167
PID 4760 wrote to memory of 5280	4760	cmd.exe	169
PID 4760 wrote to memory of 5328	4760	cmd.exe	171
PID 4760 wrote to memory of 5360	4760	cmd.exe	173
PID 4760 wrote to memory of 5432	4760	cmd.exe	175
PID 4760 wrote to memory of 5620	4760	cmd.exe	177
PID 4760 wrote to memory of 5668	4760	cmd.exe	179
PID 4760 wrote to memory of 5704	4760	cmd.exe	181
PID 4760 wrote to memory of 5720	4760	cmd.exe	183
PID 4760 wrote to memory of 5732	4760	cmd.exe	184
PID 4760 wrote to memory of 5744	4760	cmd.exe	185

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mcpackbycatchingggg.bat"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2092
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1260
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1300
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2252
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "whatismyipaddress.com"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaff8cc728,0x7ffaff8cc734,0x7ffaff8cc740
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,1246164178504337049,4860688785809197189,262144 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:4720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,12203911065586685857,2470536771198611259,524288 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,10359455980707115386,5284496844853448557,524288 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:2348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,17382653292959884759,15061305625752003595,2097152 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,3426215170691149769,10747219987862853850,2097152 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,17134944931338907644,16762426643738869652,2097152 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4512 /prefetch:2
    3⤵
    PID:4156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3956,i,956488258629874659,1591531582714467297,2097152 --field-trial-handle=1968,i,11563562356474491662,7797398086980477696,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:4596
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3036
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:472
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1004
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:560
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:648
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3840
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3524
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1964
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1892
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3544
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1008
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1920
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1352
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4172
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:820
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4544
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3892
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2036
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3824
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:116
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2244
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2080
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3032
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4784
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1292
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3992
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4384
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4268
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3884
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5264
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5280
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5360
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5432
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5620
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5668
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5720
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5732
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5744
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5752
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5760
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5768
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5776
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5784
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5792
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5800
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5816
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5824
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5872
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6184
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6440
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6456
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6496
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6536
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6544
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6552
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6592
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6600
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6608
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6616
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6624
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6632
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6640
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6648
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6656
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6676
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7052
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7124
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6228
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6364
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6524
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6572
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6708
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6728
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6752
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6784
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:6776
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4112
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:660
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7140
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7172
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7180
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7188
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7196
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7204
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7664
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7680
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7688
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7696
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7704
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7712
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7720
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7728
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7736
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7744
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7752
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7760
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7768
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7776
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7804
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7860
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7812
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4424
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:7844
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8240
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8532
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8704
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8720
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8728
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8736
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8744
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8752
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8760
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8768
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8776
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8784
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8792
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8800
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8808
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8816
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8824
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8832
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8840
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8848
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8856
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8864
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8872
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8880
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8888
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8896
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8904
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8912
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8920
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8928
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8936
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8944
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8952
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8960
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8968
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8976
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8984
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:8992
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9000
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9008
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9016
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9024
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9032
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9040
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9048
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9056
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9064
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9072
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9080
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9088
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9096
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9104
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9112
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9120
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9128
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9136
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9144
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9152
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9160
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9168
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9176
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9908
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10364
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10380
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10388
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10396
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10404
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10412
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10420
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10428
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10436
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10444
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10452
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10460
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10468
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10476
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10484
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10492
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10500
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10508
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10516
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10524
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10532
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10540
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10548
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10556
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10564
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10572
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10580
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10588
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10596
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10604
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10612
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10620
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10628
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10636
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10644
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10652
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10660
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10668
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10676
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10684
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10692
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10700
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10708
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10716
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:10724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 ca4d5196a9ee7be66c290decdc68ee1e041b7ab0aa58b9d9eece50a2b8404cd4
MD5 68f607dc3b48f1fe74b45a9f3f3c212e
SHA1 4f15e5b3674d1718e5a296eb3ef23fe344ec1f64
SHA512 6ca1d72555ce29b306911088f331f616af3cc155c362c07d51bc99557249db7ee1edc8d6d8598433de89b86fcbddde3f8b6cbc898229018dc6d152a7960f3281
TLSH
T187F01507218BCD01FB9666F093DC4DA130752D8807833E7D80E1CDBE62D2B9A2924572
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 6c6b3ddb5dc6a20f5596f18b663b9b84ab71d3165af3932698e7f0067776b532
MD5 2b604da3f858e12ab8889951ebef24b0
SHA1 1efe06c1844718737676114b0078c95d8de7524a
SHA512 6dab50dba41fca43aee01a5269e72f0ed1dd01bf9a025d41e46ade54e08cb6572c77f3d40ae491a9010d3f19d72cd6fa8dca12c5760155dbe73b0184cc5e84eb
SSDEEP 192:FaIaEgHdprh5uFwNu+TTCFVtl0Rb2KyitFVR1vDb1d:FaIaEgHdprh5uFwNu+TTCFVtl0Rb2Ky+
TLSH
T164E1BFB7C2F8C63D965199F0EB44AE2ACF6D0954432C3C9DC8D4BE4793E2962DA0074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 268a5d3a55b7684481c8d7a3df139998363d54b418b3c63836a7edec56b5f44f
MD5 785f707deebcb81f33e71779888556c7
SHA1 427905c016d2ea3cdc95104444ddca41efb43ca7
SHA512 b6fad53c0be21d59604b96a39f6b4aca27f417b02abe15e9a7b028305628f96384b60cb5ca6e073e30cd7eec2fba35d790bad676369c34a690bfc507337fa8c4
TLSH
T1E531ADE3967EB897603E587B3E04F806957AB43541827CF8DF6A847D70925F31B12432
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b12c21c40918796fde06f0470667b98de6b219889e59d1d0ebbbe19159b8725e
MD5 438459cefd337b0d20e60e6330278f0b
SHA1 58ff7cf0bda8c307c5c5a1ffa8f2ea583b07a5cd
SHA512 e54ca80f253604c2d992a2effa71f48dc197853d083589b25e24bef9e18e8c0c79586ce6ff35022f24ac3bec311378264a1b7d65d7847559c23c4622fd1aa2c3
SSDEEP 192:sRxi6se99joHVRv7CMpAPRp2+V93Hsb+WN+9uYW6I2CYPyIsnAUge:sRxiXeHjOBxUXRxwAw2Be
TLSH
T11E32C51EAD28753B9CEAD32AF921B75BD7F5102160D12E84E6FCCA2C15EB6CD2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bd5a87304e1ac440e6f88e00adf9817ca0a80f5786157af791f3604d763a29bb
MD5 0d8c66f685f339c15769dc06dc316316
SHA1 2b4d440c941d5dd0b99850724a9c57dd80ab499c
SHA512 eca0e7a3b9b8973c539466c54274e0be528e54746cd433eaf908b4637563d30ce703c654c45041c443a9a4326c2d05a4115a775d51365018499c87d49f2f86bb
TLSH
T1B5B012518041D910D05301B5138A44D8314CAF109614170153E06D7D983A4B241181A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586712.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586712.TMP
Size 96B
SHA256 0d948f1e1e814dbe48d453e2e454574d131968539e0787a7529cd0108fb928c1
MD5 79aeaa00e1a67d6f0b15b741ff39a7ed
SHA1 a16aa5ada8ef0a0aba6da6a0e4dfda4495601e48
SHA512 2b70ea5dafc97629b93b93e68605bd67519f66a52933eaffaa33cd1834c219e1a4b622de8c58f0458457f0c065a5be28cb5d06c3fd05cff4b33a384050c27c16
TLSH
T1A5B0222AC202A223C20203B02888C0E83020EF28C303030A82E0CE3ECC302A00822230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6f6b94bbd43c1abae09ef915e4c3ca7d939d182f44c74a238a0362cc889d4cae
MD5 a296ea8ae62a2eba37254ce8865e7002
SHA1 bcc7a09d684474fc1cfbf71fc315aed081d804d4
SHA512 17e032a889855dc1e491a588a538fa407bb32a7e3f820f897e5d44fcc61f2063ed29cebbfcd248282d7753c32392806e4a958ed20b5a7699e8e5aeee9e40c310
TLSH
T136A004170F454D10CC0C07F01145134353C1CC504C3703D740DD054CCC504C0FD15171
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 18b3ec7dc8fe33a91eafbbf618d3e775cc55b8e3244ee4246aa6cf3e76fa2a94
MD5 9287f31f9b7138c1d87ab71637917fec
SHA1 0cb5a4669188028789f9b432f4baa3b6abbb3c48
SHA512 ec0d2000c14a5b2263ffb8eac018addf210455ab5fe60059e5455a33c0e45768839c656c1ada8e5375fdcd2817fd7a3096b46a5cf1a070753738c697bd6304d4
SSDEEP 1536:ip/icYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:ai3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1549312BA4E2646E7997D4A8176AD7808CE12534D705FB9CC325CA38D61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 bb7997bfc62bc9a887367f79f0602e8c5e4a9099f9a36e381fc139dd3eb8ed6f
MD5 11f022a0763e130e7a00077caa2e48fe
SHA1 66a032264a4bd7517e4157019e151f7180d851d4
SHA512 a0ed2c13e99473cd79a925ad3be3adefa77dd7a74e20a7e79ee61d0db75f8c98ba58c3a4385071dc54d7515a9442410a4c38f60ff3632099d6b294351a1a4021
SSDEEP 1536:dpzcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEk:X3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1CC9312BA4E164AF799BD4691729E790ACD22530D309FA9CC3268578D21D01CC2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download