hxxps://catbox[.]moe

Analysis

user interaction
yes
max time kernel
1379s
max time network
1359s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://catbox.moe
Sample261027-dvfvca1tew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3556	3988	chrome.exe	82
PID 3988 wrote to memory of 4952	3988	chrome.exe	84
PID 3988 wrote to memory of 5056	3988	chrome.exe	83
PID 3988 wrote to memory of 4952	3988	chrome.exe	84
PID 3988 wrote to memory of 5872	3988	chrome.exe	86
PID 3988 wrote to memory of 5872	3988	chrome.exe	86
PID 3988 wrote to memory of 5024	3988	chrome.exe	88
PID 3988 wrote to memory of 5024	3988	chrome.exe	88
PID 3988 wrote to memory of 3496	3988	chrome.exe	87
PID 3988 wrote to memory of 3496	3988	chrome.exe	87
PID 3988 wrote to memory of 3756	3988	chrome.exe	89
PID 3988 wrote to memory of 3756	3988	chrome.exe	89
PID 3988 wrote to memory of 404	3988	chrome.exe	94
PID 3988 wrote to memory of 4296	3988	chrome.exe	98
PID 3988 wrote to memory of 4296	3988	chrome.exe	98
PID 3988 wrote to memory of 5160	3988	chrome.exe	99
PID 3988 wrote to memory of 5160	3988	chrome.exe	99
PID 3988 wrote to memory of 4672	3988	chrome.exe	101
PID 3988 wrote to memory of 4672	3988	chrome.exe	101
PID 3988 wrote to memory of 5848	3988	chrome.exe	103
PID 3988 wrote to memory of 1876	3988	chrome.exe	104
PID 3988 wrote to memory of 5556	3988	chrome.exe	105
PID 3988 wrote to memory of 2252	3988	chrome.exe	106
PID 3988 wrote to memory of 2252	3988	chrome.exe	106
PID 3988 wrote to memory of 3840	3988	chrome.exe	111
PID 3988 wrote to memory of 3724	3988	chrome.exe	112
PID 3988 wrote to memory of 3724	3988	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://catbox.moe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa5d1bc728,0x7ffa5d1bc734,0x7ffa5d1bc740
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,1712999484355351044,3565666063269611196,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,8929959356292760810,4924575934127746064,262144 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,3400056439560057866,15050285477507588595,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,4792582041131041379,12779569620883328215,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,10139158801450406457,14475623867977094899,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,9921438242620458372,13886384042193819951,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,17678538038892273956,4214245377319503418,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5344,i,2372867539665751349,5208686588402962463,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3248,i,13211744861287138481,16671717596205693791,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5344,i,5980982395416299543,1531289596458461068,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,5272297058638737048,10732764751597861805,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,3771621031036579844,2345253518917499590,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,2697054969671032044,17089466639226319582,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4636,i,2661946194281522414,3171968805100560776,2097152 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5448,i,411324530117953778,12258422898242858201,262144 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1260,i,16733132505246375910,15111405762319567203,524288 --field-trial-handle=2092,i,4954502277647621921,16326377878842199428,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6a9d35e0-1485-4c15-aaf0-193d9cc59546.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6a9d35e0-1485-4c15-aaf0-193d9cc59546.tmp
Size 131KB
SHA256 1d9d4834864aa07305f02cfd9dc269f2e0f1d43e4017aaadddac4854b207a502
MD5 52e01732b86b7603f6ad63bd2ca794e7
SHA1 00c3dc7edf34c126d1f8e58d8d9bb7216643bbbf
SHA512 e0091b1e347c88455c3e5c66e43b81a3997dcbce9e3ced060357eae95a1e22530888ef94c0aea5b7319d323c99593df09263ca9e8819b4c05e70c88d21566451
SSDEEP 3072:0mEIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzA:0fPtbmf1K49XLWbEPi4NTKlLzA
TLSH
T19DD312213D41BCB4A9EEDB21A1901A15EAB8D94F96393BF65CDE3F4C05936D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14ab2208-ecef-44ab-88e7-33394c1c8861.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\14ab2208-ecef-44ab-88e7-33394c1c8861.tmp
Size 12KB
SHA256 76af0a95ec229c2cd09b9b3fd1427f708019f348dcf92a78e10b2c1da77b12a6
MD5 6421dbf35d7c3c7ea1c47d0b511ceb21
SHA1 7d503edee2b0c234dd01df655208d73bc57d704c
SHA512 16fb5771f300377fc54b568a103fd2a33b79d500b63624c94dc0054233d7ef3597c2c6072e6aba6e2b8d6d4fa69260980d12c4fc49b8ec58509ff5518470dfaa
SSDEEP 192:QRkjzxrPSIVv7PpAPRp2+9fHsb+WNn4fPckWle1dtwuVyIsnAUge:QRkjJDljUX95w4P1W0dtwme
TLSH
T1A642962DAD10797B6CDBD219F9627B53D6F6202231D52E80EAFC892C26D76CC2237057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e4d0dc5-2a04-4658-afec-3217f28baa86.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1e4d0dc5-2a04-4658-afec-3217f28baa86.tmp
Size 13KB
SHA256 adc127b2fd5192db5ab7e32c2d9063fe5c2ffd636485e09a05f22e8f29612302
MD5 90be44b60586455d74c31e5fa918d4fd
SHA1 8be781d1a87e9328cc3892b611f4acc694a50e00
SHA512 e8db962e213ca9e7906b69555597f471e9497536ad7c6b536e5a2c298e8faadcb7236c7861658c7ec53a5e138d8b92a26829e733cc6f0579d0fe00a852f754e3
SSDEEP 192:QRbjexrPSIVv7Pp8PRp2QJ9fHsb+WNn4fCUN2OFnkWle1dtwoVyIsnAUgE:QRbj4Dlj8Xd5w432OFkW0dtwME
TLSH
T17E52B62DAD10797B6CDBD219F9217B53E6F6202221D52E84E6FC892C26E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bf8f3fb-27da-40af-87a5-c7372c61655c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6bf8f3fb-27da-40af-87a5-c7372c61655c.tmp
Size 13KB
SHA256 585e4d023b084589a979d0d0a70c2c03b8f0da3ad620460387c9865fa3a3fabd
MD5 62d954c394dddfd1739762d861766eab
SHA1 67ef4c840df5c6d19c0f5a8a977f0435fd96f6f1
SHA512 5227ad73a187d968c2f9e3eed9f6f931b411ea0e9d5f50e8a078eda7a114df9cf4c55b751b47c06660a707f40985ff64916cec0841130cf76fbd628071fd6231
SSDEEP 192:QRbjzxrPSIVv7Pp8PRp2QJ9fHsb+WNn4fCUN2OFnkWle1dtwoVyIsnAUgE:QRbjJDlj8Xd5w432OFkW0dtwME
TLSH
T13252C62DAD10797B6CDBD219F9217B53E6F6202221D52E80E6FC883C26E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b03b90d-4986-4756-9b4b-32c3b0ff0c45.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b03b90d-4986-4756-9b4b-32c3b0ff0c45.tmp
Size 17KB
SHA256 bff6e389719bb777fa7fd4033d39d92c9c068d450ab2ad7a94625a4c9a8c7fd5
MD5 f51474ec91e2c72f14a1753eb7671539
SHA1 9f950a472724383d2b13efcc437615b30deb207d
SHA512 05827e4dfa28e34946fff83c56e7cbcf8e1d35586f494e510abe2dd2dcbe27c632da49714cfa9c5d882266468d914d61e9d1e1e4891eeec1a8a63d85bb9bebfe
SSDEEP 384:uMj6t7KxkXqKf/pUZNCgVLH2HfgslrT7pLuLceSklXOD6t+ErU3voHG75M+4cGyg:uA6t7KxkXqKf/pUZNCgVLH2HfgsdT7pu
TLSH
T194721A676C4C9E3B0FA4C6CCD8177E4FACF5024B65ED886582FA982503D5ACE114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93a2f449-4c00-4062-b834-012d730c433f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93a2f449-4c00-4062-b834-012d730c433f.tmp
Size 414B
SHA256 517b3b9b140e2fbf5443325d5c27c439fa1c4a11d647d50025880bc6e7ba42a0
MD5 531d5ffeb164e2e6605da85be81f3fd3
SHA1 27c8285ab91607854774acf50fd1e0780a627bff
SHA512 2fd27a8c56a7337f855d72b84ea60f22882d44055c505a937f809df9eedb278c578612a2016908525c7d3d9ac504a8d0b61e39ac5d1ccb7fd8bf6ef6a50f3ba3
TLSH
T10DE02BA6CC70A8771CFC1B2C94160745E70113172B41889B3A3C810D8F746365589C6D
MD5 SHA1 SHA512 TLSH

Submit Download

08474813-ae9b-4782-a22f-6a6114b1eddf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\08474813-ae9b-4782-a22f-6a6114b1eddf.tmp
Size 523B
SHA256 856fd8bb948f786511451eb20c8e1bf7fdfb0f382da1711202954e42183ff7fb
MD5 12273a9450cf30ef06fba50a76081c80
SHA1 eddd017b46abc0bdec2112d88fd1a482db51fa7e
SHA512 301f1c314df70a8335f0655ff21605016e0ef5c6b516edffb489de6297cc1306dc4bfea27ee74153548f9dd96719637ee44e73a7bec9946e837b371a18748786
TLSH
T160F05967DABE7477107A45AB1E05B8061E76A430034168F4CF6A426DA0C26F72B06447
MD5 SHA1 SHA512 TLSH

Submit Download

277a79d3-933b-472e-b54a-eff4e9ff5cbc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\277a79d3-933b-472e-b54a-eff4e9ff5cbc.tmp
Size 2KB
SHA256 924015f160596ef17477c84bc83f532f159ee702ed2efa058c9959120a4ee4c7
MD5 f4b8eb3d465ecead16de7db32d7628e8
SHA1 0093e6aefc9e7e193bd22c908cea8d29b61c803e
SHA512 8eb846b47fd4f719b6e75eaea2e9b4046ef5dc5a80182013b73d9a24b7f6d37de849ea82b94fefd1aa03a85a3b2564aed74b7e8c39c379fa9c6927efe4447b82
TLSH
T173416BF793F4857E8A1196F4EA156E1FCE690524032C7CA688D46E1B93F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

97fb82fa-9e87-42b7-b9f8-36a011778105.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\97fb82fa-9e87-42b7-b9f8-36a011778105.tmp
Size 2KB
SHA256 7e895187fbdc036f32eb8961ffa560028f4bba3c2ae378636f6012413f7422cc
MD5 bb13d74b5300e57b63f12bf0851c5f4f
SHA1 d574da4824012ec423881b326f46a9af8208e40a
SHA512 8d41278f7e5a5f3b5b3f4808462cefe39d0a9ae018c2a4a06490d2fcb8c0f984454b31b8bc484cf0a8823247218f16141c33289862d1cb5930a8378148998f07
TLSH
T107417BF793F4857D8A1196F4EB156E1FCE690924032C3CA689D46E1B93F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

9b3c1ea1-431b-43c1-9334-89f8d875733d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9b3c1ea1-431b-43c1-9334-89f8d875733d.tmp
Size 1KB
SHA256 419021e4b71384bff0742fa65000f76f737297cd8c794d740307f0695996ff9f
MD5 dfb3c618449e317c891246b9ad7058a2
SHA1 9ba50dab3fd25b07e090b61ffe0f269bf1fdc224
SHA512 7e3aeca8687bedc803964303d3245db04940ad61eeff3f4340f0c56f8a97cc6b4b6cdd0f8f42097d386889411b17ab3ec40a111113a62e3a0d61b4f2c4c54998
TLSH
T19C419BF793B4857E8A1192F4EA156F1FCE6A0624031C3CA688D46E1B83F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

ee8691cd-c7c8-482f-b258-ecda2d81f089.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ee8691cd-c7c8-482f-b258-ecda2d81f089.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 56db3ddcaa91ceefc5106a254fd1d944da0d3ad54edac549d745215529372981
MD5 77a05863da12173cc95133385579bb9b
SHA1 1ebefd93663255959215573ae1100d54e0e2ec93
SHA512 47dc65622c795ec15da521f514e536c7526686c709d5ff0821ed4ab035363643e3a94dfdd37f3bc5615954f26fd58a5ce18c1c92590fa04cec86dec60bed8c71
TLSH
T1EDB0121584419303C04303B4115554C83254EF14B615130282F46D11C836263802F154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ce9cab487b0b7c71825391b67f15d7568b6712a3398847ee54f61d088fd48595
MD5 c16cd358ff5b7a08b65c8014cc8e831e
SHA1 999b1d600528e5f0d9066d7f52ae5cabd4fbc2c5
SHA512 d7476d098175ddbe0f0123223bf258d33ecc545e272bdc4e29063384b65881537527f21000a66bf72e47c9f091c20e0583d610e7184609a916b54ad68b597199
TLSH
T150B02200C2032202C08203B22088B2C83220CF30C2032202F2F00AB2EC283B00830020
MD5 SHA1 SHA512 TLSH

Submit Download

d1b66bc6-b816-461a-96d3-3186593c0f2c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d1b66bc6-b816-461a-96d3-3186593c0f2c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

aa5903da-fc24-4475-8f21-29f7dc26e5ac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aa5903da-fc24-4475-8f21-29f7dc26e5ac.tmp
Size 132KB
SHA256 a9c0d0844160e4ca555d936727d92a70bd1ea766c8ef38801ab627fb9307a8f9
MD5 9804c4ca4a32bfa9f990a5f8d921d405
SHA1 8e92f60b5212c080bbd73b709245d45cd822de26
SHA512 ba28237f531209c99c1699c37f1ebd99ff9ae7ce9b34f114e6faae0a0d04836158db48d6987cfd1c2b19f49daf95b033d58c49746bb10d89ebf53c585001a253
SSDEEP 3072:dmuIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzA:djPtbmf1K49XLWbEPi4NTKlLzA
TLSH
T145D312213D45BC74A9EEDB21A1901A16EAB4D90F967D3BE65CDE3F4C05A36D9C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c14cd143-b076-4d58-81a0-6a541a0ea2fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c14cd143-b076-4d58-81a0-6a541a0ea2fd.tmp
Size 132KB
SHA256 ed80617272c9885861c2bd2ed3280a55a0c94dfe824dd5d369146bcf119d20e2
MD5 7911262a6fd49d7eecc7219bb026515b
SHA1 db19682f58125597c0b9332d88eaac18232c7a0e
SHA512 157ec13cb703269a88bd4c04e54a05dc0eb21167509c1a96435e48ab42a21d764e5a5f88a2c04245f1cf67038b646faf966b854d63ab3ab57f35cfefef4d9be6
SSDEEP 3072:dm8HIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzA:dNPPtbmf1K49XLWbEPi4NTKlLzA
TLSH
T1E5D312217D45BCB4A9EEDB21A1401A16EAB8D90F9A3D3BE55CDE3F8C05936D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e882506c-ef84-4126-a390-939058a703c0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e882506c-ef84-4126-a390-939058a703c0.tmp
Size 132KB
SHA256 e29ab32140bb80ebbe8efe597e73b67ab898057f444146a43a03eda01c2f6366
MD5 b6398e4bc4b09cf9ff151676338dc2e5
SHA1 5526bdc1af60ea8d137c9d269a4f5ca82f0e9ba9
SHA512 f5e4a6fd14d4c85bcaaf19c7b9c06ec1d57f36747d961674bea2a433b607ce0f8b5924990bdb15705c6a424f40bd254e4722e9e270cdddf2f50288c04fd2b1b0
SSDEEP 3072:Bm8HIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzA:BNPPtbmf1K49XLWbEPi4NTKlLzA
TLSH
T127D302217D45BCB4A9EEDB21A1401A16EAB8D90F9A3D3BE55CDE3F8C05936D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb1c5ab1-958b-496e-9997-70cef97203b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb1c5ab1-958b-496e-9997-70cef97203b5.tmp
Size 132KB
SHA256 d1cd1dc37525f736d845327a37965d1aef0675740cca46924676755520695ae7
MD5 a53d585116ed341d3033bec61cfd4a39
SHA1 5a36ffb2389b6bcf1faa72a4d8ae1683a2ad92dd
SHA512 bf239995dba8fb5f2ab9a427dd288d83c248b0df78b6bc10bb480f5aa6b7c871be8d3a1ee6decee8d06c416c0a0973842b2bb2b90476014bd279b07d5f8f081d
SSDEEP 3072:MmuIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzA:MjPtbmf1K49XLWbEPi4NTKlLzA
TLSH
T160D312213D45BC74A9EEDB21A1901A16EAF4D90F96793BE65CDE3F4C05A36D9C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download