Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 04:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cthk.io_chromes.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
cthk.io_chromes.exe
Resource
win11-20260130-en
windows11-21h2-x64
43 signatures
150 seconds
General
- Target cthk.io_chromes.exe
- Size 50KB
- Sample260506-ffkabsaw2v
- SHA256 91e8a66bdb4d7e98748b8bdf494af1e4c97f346a2319149b25a2afb725fde903
- MD5 6b1682e96ed0a271d021f1fcfd865fe8
- SHA1 9bdb38e32c1f718dd7c8fe2de9500ea491848b70
- SHA512 a8d9f367355e6c7b074a7d0c4e22237cc149a9d5c4000acd9842fbf2f15f0f98c880be48180930eb6864034be25285cd285f7f6be176dbf6ed92d6f18b4131c3
- SSDEEP 768:IdhBVsJcxWZMzOaa9jx+HzMVSY/s/RgL4PC1XXGblfppbKFc5x4:MhkaxXa9jEYjsGL4PEXGblfLbucs
- TLSH T18833E54477F88551F2FF8ABA4DB186119B30B8A79C22D78E06D505CE1AB2740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/5020-0-0x0000000000B60000-0x0000000000B72000-memory.dmp disable_win_def behavioral1/files/0x00070000000248f1-2426.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" cthk.io_chromes.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" cthk.io_chromes.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2764 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cthk.io_chromes.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cthk.io_chromes.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe cthk.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe cthk.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe cthk.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1092 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation cthk.io_chromes.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf cthk.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf cthk.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf cthk.io_chromes.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe cthk.io_chromes.exe File created C:\Windows\system32\sysupdate.exe cthk.io_chromes.exe File opened for modification C:\Windows\system32\sysupdate.exe cthk.io_chromes.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 292 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" cthk.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" cthk.io_chromes.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1180 sc.exe 3636 sc.exe 3904 sc.exe 3104 sc.exe 5004 sc.exe 1248 sc.exe 4360 sc.exe 4768 sc.exe 752 sc.exe 1704 sc.exe 2372 sc.exe 3248 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4872 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1628 ipconfig.exe 2624 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3828 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1876 vssadmin.exe 1560 vssadmin.exe 2992 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\WallpaperStyle = "2" cthk.io_chromes.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225165437118776" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command cthk.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open cthk.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings cthk.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command cthk.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell cthk.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell cthk.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings cthk.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet cthk.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open cthk.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe" cthk.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command\DelegateExecute cthk.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\.pdf\ = "PDFBotnet" cthk.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cthk.io_chromes.exe\" \"%1\"" cthk.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command cthk.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell cthk.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open cthk.io_chromes.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1060 schtasks.exe 4676 schtasks.exe 3816 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3932 chrome.exe 3932 chrome.exe 2764 powershell.exe 2764 powershell.exe 2764 powershell.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe 5020 cthk.io_chromes.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5020 cthk.io_chromes.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3932 chrome.exe Token: SeCreatePagefilePrivilege 3932 chrome.exe Token: SeIncreaseQuotaPrivilege 3016 WMIC.exe Token: SeSecurityPrivilege 3016 WMIC.exe Token: SeTakeOwnershipPrivilege 3016 WMIC.exe Token: SeLoadDriverPrivilege 3016 WMIC.exe Token: SeSystemProfilePrivilege 3016 WMIC.exe Token: SeSystemtimePrivilege 3016 WMIC.exe Token: SeProfSingleProcessPrivilege 3016 WMIC.exe Token: SeIncBasePriorityPrivilege 3016 WMIC.exe Token: SeCreatePagefilePrivilege 3016 WMIC.exe Token: SeBackupPrivilege 3016 WMIC.exe Token: SeRestorePrivilege 3016 WMIC.exe Token: SeShutdownPrivilege 3016 WMIC.exe Token: SeDebugPrivilege 3016 WMIC.exe Token: SeSystemEnvironmentPrivilege 3016 WMIC.exe Token: SeRemoteShutdownPrivilege 3016 WMIC.exe Token: SeUndockPrivilege 3016 WMIC.exe Token: SeManageVolumePrivilege 3016 WMIC.exe Token: 33 3016 WMIC.exe Token: 34 3016 WMIC.exe Token: 35 3016 WMIC.exe Token: 36 3016 WMIC.exe Token: SeDebugPrivilege 2764 powershell.exe Token: SeIncreaseQuotaPrivilege 3016 WMIC.exe Token: SeSecurityPrivilege 3016 WMIC.exe Token: SeTakeOwnershipPrivilege 3016 WMIC.exe Token: SeLoadDriverPrivilege 3016 WMIC.exe Token: SeSystemProfilePrivilege 3016 WMIC.exe Token: SeSystemtimePrivilege 3016 WMIC.exe Token: SeProfSingleProcessPrivilege 3016 WMIC.exe Token: SeIncBasePriorityPrivilege 3016 WMIC.exe Token: SeCreatePagefilePrivilege 3016 WMIC.exe Token: SeBackupPrivilege 3016 WMIC.exe Token: SeRestorePrivilege 3016 WMIC.exe Token: SeShutdownPrivilege 3016 WMIC.exe Token: SeDebugPrivilege 3016 WMIC.exe Token: SeSystemEnvironmentPrivilege 3016 WMIC.exe Token: SeRemoteShutdownPrivilege 3016 WMIC.exe Token: SeUndockPrivilege 3016 WMIC.exe Token: SeManageVolumePrivilege 3016 WMIC.exe Token: 33 3016 WMIC.exe Token: 34 3016 WMIC.exe Token: 35 3016 WMIC.exe Token: 36 3016 WMIC.exe Token: SeBackupPrivilege 4248 vssvc.exe Token: SeRestorePrivilege 4248 vssvc.exe Token: SeAuditPrivilege 4248 vssvc.exe Token: SeShutdownPrivilege 3932 chrome.exe Token: SeCreatePagefilePrivilege 3932 chrome.exe Token: SeShutdownPrivilege 3932 chrome.exe Token: SeCreatePagefilePrivilege 3932 chrome.exe Token: SeDebugPrivilege 5020 cthk.io_chromes.exe Token: SeShutdownPrivilege 3932 chrome.exe Token: SeCreatePagefilePrivilege 3932 chrome.exe Token: SeShutdownPrivilege 3932 chrome.exe Token: SeCreatePagefilePrivilege 3932 chrome.exe Token: SeIncBasePriorityPrivilege 5020 cthk.io_chromes.exe Token: SeDebugPrivilege 2624 NETSTAT.EXE Token: SeDebugPrivilege 3940 whoami.exe Token: SeDebugPrivilege 292 tasklist.exe Token: SeIncreaseQuotaPrivilege 5012 WMIC.exe Token: SeSecurityPrivilege 5012 WMIC.exe Token: SeTakeOwnershipPrivilege 5012 WMIC.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe 3932 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5020 cthk.io_chromes.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 3932 5020 cthk.io_chromes.exe 85 PID 3932 wrote to memory of 4884 3932 chrome.exe 86 PID 5020 wrote to memory of 2764 5020 cthk.io_chromes.exe 87 PID 5020 wrote to memory of 4360 5020 cthk.io_chromes.exe 88 PID 5020 wrote to memory of 3248 5020 cthk.io_chromes.exe 90 PID 5020 wrote to memory of 1180 5020 cthk.io_chromes.exe 92 PID 5020 wrote to memory of 4768 5020 cthk.io_chromes.exe 94 PID 5020 wrote to memory of 752 5020 cthk.io_chromes.exe 96 PID 5020 wrote to memory of 3636 5020 cthk.io_chromes.exe 98 PID 5020 wrote to memory of 3904 5020 cthk.io_chromes.exe 101 PID 5020 wrote to memory of 1704 5020 cthk.io_chromes.exe 167 PID 5020 wrote to memory of 2644 5020 cthk.io_chromes.exe 105 PID 5020 wrote to memory of 3104 5020 cthk.io_chromes.exe 106 PID 5020 wrote to memory of 2372 5020 cthk.io_chromes.exe 108 PID 3932 wrote to memory of 4872 3932 chrome.exe 109 PID 3932 wrote to memory of 3856 3932 chrome.exe 110 PID 3932 wrote to memory of 2056 3932 chrome.exe 111 PID 3932 wrote to memory of 3856 3932 chrome.exe 110 PID 3932 wrote to memory of 2056 3932 chrome.exe 111 PID 5020 wrote to memory of 1876 5020 cthk.io_chromes.exe 114 PID 3932 wrote to memory of 3416 3932 chrome.exe 116 PID 3932 wrote to memory of 3688 3932 chrome.exe 117 PID 3932 wrote to memory of 3416 3932 chrome.exe 116 PID 3932 wrote to memory of 3688 3932 chrome.exe 117 PID 5020 wrote to memory of 3016 5020 cthk.io_chromes.exe 118 PID 3932 wrote to memory of 4408 3932 chrome.exe 120 PID 3932 wrote to memory of 4408 3932 chrome.exe 120 PID 2644 wrote to memory of 2924 2644 fodhelper.exe 121 PID 3932 wrote to memory of 4552 3932 chrome.exe 126 PID 3932 wrote to memory of 4552 3932 chrome.exe 126 PID 5020 wrote to memory of 4804 5020 cthk.io_chromes.exe 127 PID 5020 wrote to memory of 1060 5020 cthk.io_chromes.exe 128 PID 5020 wrote to memory of 4676 5020 cthk.io_chromes.exe 151 PID 5020 wrote to memory of 4752 5020 cthk.io_chromes.exe 135 PID 5020 wrote to memory of 1380 5020 cthk.io_chromes.exe 137 PID 5020 wrote to memory of 1772 5020 cthk.io_chromes.exe 138 PID 5020 wrote to memory of 1500 5020 cthk.io_chromes.exe 139 PID 5020 wrote to memory of 2104 5020 cthk.io_chromes.exe 140 PID 5020 wrote to memory of 1688 5020 cthk.io_chromes.exe 141 PID 5020 wrote to memory of 3184 5020 cthk.io_chromes.exe 142 PID 5020 wrote to memory of 3816 5020 cthk.io_chromes.exe 149 PID 5020 wrote to memory of 2988 5020 cthk.io_chromes.exe 150 PID 4752 wrote to memory of 1560 4752 cmd.exe 152 PID 3184 wrote to memory of 2624 3184 cmd.exe 153 PID 1500 wrote to memory of 3940 1500 cmd.exe 180 PID 1688 wrote to memory of 1628 1688 cmd.exe 155 PID 1772 wrote to memory of 292 1772 cmd.exe 156 PID 1380 wrote to memory of 3828 1380 cmd.exe 157 PID 2104 wrote to memory of 3052 2104 cmd.exe 158 PID 3052 wrote to memory of 1092 3052 net.exe 169 PID 4752 wrote to memory of 5012 4752 cmd.exe 160 PID 5020 wrote to memory of 2188 5020 cthk.io_chromes.exe 161 PID 5020 wrote to memory of 2992 5020 cthk.io_chromes.exe 163 PID 5020 wrote to memory of 5056 5020 cthk.io_chromes.exe 164 PID 5020 wrote to memory of 1704 5020 cthk.io_chromes.exe 167 PID 5020 wrote to memory of 1092 5020 cthk.io_chromes.exe 169 PID 5020 wrote to memory of 5004 5020 cthk.io_chromes.exe 171 PID 5020 wrote to memory of 1248 5020 cthk.io_chromes.exe 173 PID 1704 wrote to memory of 2792 1704 net.exe 175 PID 3932 wrote to memory of 1036 3932 chrome.exe 176 PID 3932 wrote to memory of 4076 3932 chrome.exe 187 PID 3932 wrote to memory of 5012 3932 chrome.exe 188 PID 3932 wrote to memory of 1172 3932 chrome.exe 189 PID 3932 wrote to memory of 4356 3932 chrome.exe 201 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe"C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cthk.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ada1c728,0x7ff8ada1c734,0x7ff8ada1c7403⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,16675351807769685973,2975610128747245508,524288 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2596 /prefetch:33⤵
- System Time Discovery
PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,8454000418213755906,5868074106545292164,262144 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1972 /prefetch:23⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,14535920435627713576,16836509024200903482,524288 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2624 /prefetch:83⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,4127789914692183617,18115152434328553354,2097152 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3152 /prefetch:13⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,5284728946209249355,10317092794244185619,2097152 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:13⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,13894258120347096893,12003637287896821359,2097152 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4384 /prefetch:23⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,9262353782221837220,1221183213717475664,2097152 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4700 /prefetch:13⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,16337283638071981294,16526287173066707931,524288 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5388 /prefetch:83⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,17002562429818682530,16311210552639942824,524288 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5604 /prefetch:83⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,4818651567812743413,17041270819455564018,524288 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5392 /prefetch:83⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,1376359393515564255,15381853879294661747,524288 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5524 /prefetch:83⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5580,i,6882057669379463652,16122058029592052436,262144 --field-trial-handle=1976,i,16923234242453270740,6444210785190626874,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5664 /prefetch:83⤵PID:4356
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4360
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3248
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1180
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4768
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:752
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3636
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3904
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1704
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe"C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe"3⤵PID:2924
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3104
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2372
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1876
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:4804
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1060
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1560
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3828
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:292
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:1092
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1628
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3816 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4676
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:2988
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2188
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2992
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5056
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:2792
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1092
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5004
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1248
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4636
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exeC:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe1⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exeC:\Users\Admin\AppData\Local\Temp\cthk.io_chromes.exe1⤵PID:3524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2620
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3940
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260506_055104.jpg
- Size 91KB
- SHA256 875faef77992cb3bb6ceb673b9b706bb1564d3734d7d95360030747558ef08d8
- MD5 20e1d7fe11ecc6f58f79339ea40c93a5
- SHA1 d13d4d4909cb0de6425f49c0c3cf4597914d0006
- SHA512 18f61584b6c0ec8779f810ccb7839723a6dd4e1742717d449f7c8de4724c04f8cd9f02bcaa5490d753f646def175a535cee0100103bd71d55fdc9b4ea67d46c7
- SSDEEP 1536:IwdXRRRRRRRRRRR88TYhi03Z6zggggggggggggggggggggggggz7UdDwxZ4NNNNy:R+jhi86rtxNAR0LF+CdRj
- TLSH T15693A2439C089B83A16883E9BE470EAC6F1A6B0CE9577AFF54151EDB3E641124C4E53F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 46ce9b7a92ff046de85c23d209994df1103dba058b7fefa62e8c92eb2b3da082
- MD5 e348819806277319d560d17175a00e92
- SHA1 f19a5f51273a4abc6789f44f32838ec97e107b9b
- SHA512 43005f25bdd9c02ccb805cc71d8e4157513fd1b83cd031adaacf175dda05d396ceba0d4f17dd89f996dcbbff2e89acd7146dcdc2db4810b51e610e516844b72f
- SSDEEP 1536:0BUR/QFVEcqHemTVfi0dlH6s/hD7aRJuIeVEbEkz+PjXQQdLkeSYryv514GW:0BUNQnEcUVf/F3hDmRJuIQkkXQQGXYrf
- TLSH T179632A368B23FDC0677F3E80E06039861C8C3E2B97B52678FAC50D9519A6694DF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 3baa45809672aca717b72bf1f8a5643c2e3b9e876f2c37a2b397d52c2c30ce9c
- MD5 e59c6fff17806c5e743695d1d0869400
- SHA1 16f37f2ecb68d08489e02449504135839bc829c1
- SHA512 aaf1b5944def9906300525988ae746e84806e7c50378be114c4d12adcda229e85ceef69e3cd548af09a3835ec76799c140f89725e7f2be7d9511664731f9075d
- SSDEEP 1536:UBUR/QFVEcqHemTVfi0dlH6s/hD7aRJuIeVEbEkz+PjXQQdLkeSYryv514Gx:UBUNQnEcUVf/F3hDmRJuIQkkXQQGXYre
- TLSH T1EF632A364B23FDC0677F3D80E06039861C8C3E7B97B62678FAC50DA519A6694DF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7a6c30a15b1ef641289afb4928cb8e6508d91f9cc1a897d7dd501707051a899b
- MD5 d88842f782af934e52f944835a17c505
- SHA1 b1cf9e24e1ccd260601b8aeac9e3f0212cec65e3
- SHA512 948ab22e154bfa75d26e9e135a4b16be024c7edf03de2f7196931c4821c0e4c109248313a1298545da21cc1daf021715d780127d88d11c735e68edad1b6e5764
- TLSH T101E02BAAC822AC2B19FD471A20D55745EB1803972B41590F363C430C8FF127A918685C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 580265700c9fcc2a5b4f85efa3c658c3c61d811e9dd22b4bc36c85549f1129b0
- MD5 0e2830aa9698424b2535d17634853620
- SHA1 aae9de8e85b91a6e0660d2f35371b355fd481514
- SHA512 c585e6896cbeb30d0d6230f0ea87ffed03714491743caa8b61231b1786921a170eaa1e545676a17deecc1a7ccbf658609cae2127a3a3cd5c072eeef0b43d8b3b
- TLSH T167B0122E1ED00601CB81C1B278FD0D8431301D2C04392733C5D422D94CC33904942141
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 4f62d67a4c6ffdb94f67085d68920666e07b756b79bd4b1e6f621f3e46790f1c
- MD5 0b31317219ce471d5cb50cfa71ad299c
- SHA1 377d9da24b51912c7fc2b447ce46d79d5894315e
- SHA512 fb10c86fa9f94e4bdffb231e4b4cbe5a100bbb1adcb93d9e181890cada42aac376a6c8a6402418d62e8ff68f589c57c65c87daf1f7153135bf85d405afc7a035
- SSDEEP 96:Duob1obkobzob4LzoblaIaEg7UO1OCobFobqobIobOobBK34KajhvobN1:Duob1obkobzob4LzoblaIaEg7z8CobF1
- TLSH T107A1ABF7C3E4866DCA1156F4E6147F2FCD290A19536C7C1688E4AF4B93E2872E24164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3fef7dfb67892905cf90d24c99cf8f9d9d2f0d1086e89999d6891fa82e70142c
- MD5 f9e0e5cb2cfbf7df52d3f1c9ab6076cd
- SHA1 ffd5d36a5550137a251de4b6d174b2c5d39556cb
- SHA512 42d37fda29641468e376420a12343caa7cafe04e9d6381b15509edb4e76de82b2088a0be1476c0efdf8ba1288304fe858d49b5719ccbe8dba20d258776e736d0
- TLSH T172519DB3C3E8997D891156F4AB257F2BCDA90A54631C3C56C8D4EE1F53E28B6E20024F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 3781cf87524bf466249ccad55f774f42a708d2a3d636e2503938c58cc8da5a94
- MD5 0e72f8653e3d9b6a01287c8527da6688
- SHA1 c0cefcbcae9783fec694b0fce10c1d33aa78ed15
- SHA512 f45bc03f578f4f62e257e32ecd9e3dfdec0db5fc272eb7f622cd3d177530e46b5eeacc2a0940294057a41b3af6ccdfd039eef788e22f84d6f975d23da1f001a7
- SSDEEP 192:WRGlJq+sfGBv7rpAPRp2ylc9+Hsb+WNnMIWZX2x1eoPa4vVyIsnAUge:WRGlsuRfUX8EwtA2zawe
- TLSH T16A42D82AA9187A3BDDDAC21EF9617757EBF6102171C42E44EAFCCA2C04D75CD621702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 4fe66ae4d90954ec84c917803551d1f7c4206eb54dd87e95f46c37ce6483f88d
- MD5 7d68925268608a08d70c1c536b90000a
- SHA1 e7fd6a4a380fb2fad104e417602a34424dc83960
- SHA512 de8917590956465d4c892508de83d25504f010581113f003b4f8cfd3aa6e253d2fb7a042354212c14e50f79e542f2c2d94d81be20ae8381883ba868b8c790e02
- SSDEEP 192:WRGlYq+sfGBv7rpAPRp2ylc9+Hsb+WNnMIWZX231eoPa4GVyIsnAUgraJ:WRGlhuRfUX8EwtA2Bafe
- TLSH T17852C72AA8187A3BDDDAD21AF9617753E7F6102171C42E44EAFCCE2C05E75CD621702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
- MD5 eaf45e095eaf8d2e1b455626d5895959
- SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
- SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
- SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
- TLSH T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 0f6df14baa65ce04522868d97d1be31783398a145ba3dca0b63b317a353cbb77
- MD5 af522a607413c0fff98ba856b984daa4
- SHA1 051474581f31feb3fa99d8ee33f037bc2db119d8
- SHA512 4fa5bafb39a4343397107b9b4c355fff4d47e346861bab982e657ff158241d57a1993562c19bcc8300df9b14724a2b4fe6e23f4b18b6caacd7c59370c78db149
- TLSH T13CB0125284469521C40302F41286048C31149F148705130553FCFBB39C2E5908114161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5875f6.TMP
- Size 96B
- SHA256 e1b3ae32ebba42f30612b77d1124aaf97cafe7d1d6f9585b44affc6f45ce787f
- MD5 faa88643943aeebb53355ab9c15618f6
- SHA1 fb7344502c3386a7f9eba2917ab5bed982fb6183
- SHA512 1140fa041e7cce8b49aca824b34ddab20b4b8fed36f38de4c57c55693ec2dd2235e2bdfa5d61af567bd649e6fc4ae9c84a228b49d52edd58b2b16d2a4baef3e0
- TLSH T1A8B02208C0232203C00383B02C8AB2CCB220CF22CE230222A2E03BA2CC283200020320
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 a6f739426eb0a889f529fd5b9e8a167108abafc997f050f24a6885afe6d13b80
- MD5 7c395b5422d5cafd40379d33bd71db98
- SHA1 f22f56bbf1287c1f913deeedc81c30bdfea15b17
- SHA512 99beb54e27bdcc0026f54bf103bad1d39ec97c295f6035594339ccb2f1253aed6b3349dd55d9b41b0c55bf5c106c36c59c5f0b5486578828f3473c27b3f2be94
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2ObpX6AQqNVummwkK:jeuvBnhJsueMEGvIW1DcP2OVF/VummnK
- TLSH T154D3884B3A743102EDE5DA721CE051BB5E3CB16D4F51A5D528B620688EF2863B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 a731fbd2ee28e5fa1a7420de73bbb768db9ee2071b1fec0286cecf16576227ad
- MD5 faee335bfe4546adb0d10b87dcb0a1b9
- SHA1 62e096d900e7625931ea5f766f0d1f3646eb92fc
- SHA512 a634b69a96f71682e91122fd3884e112677800d8c30801049bed656373110fd0d0ad2a5f00fb1e84b615bd847ccbc244e4fd64632b2babfeff472c7e76f9af72
- SSDEEP 6144:fVmK4ZKKlGp8IcIusAZ4BOJrOk0HOGm/SFyEET:dMFgvE4BOJrOjuGdF2T
- TLSH T1551412B64F1BA3E7C47EAB213569A9058C1E53CF826DAC9C608CD78F34893451D22DE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 9ce4360329bed8bd59fb96f851f63403dc7c30159219e28ac350b60c48f8b722
- MD5 9a2ae32699e9b26afa1b60c14d65a197
- SHA1 67e8078818aa6ec945b60aac5e3c16538407ec5d
- SHA512 6066361c96d5bd96840efd8565140ce0ff5e62558482079946c58da5abd7de51b4e2a87ae81a46202418fc40c6a2aaf39aa6b847d884e9517c6cdc2e5a94c6e1
- SSDEEP 1536:jVDcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xD3Qw/xLANk0mUW5GmRntSFCjEENQ
- TLSH T1519302BA5E174AE7957D4A8176AE7809CE12630D70AFA8CC315CA39C61D01C92F73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 26dbe94539f945e4a2db378bf6bbe9e5043f1a92d318cae6f6d0c2a77ed76243
- MD5 425941dc3faf7a53172b60866cb3b175
- SHA1 c907ef9b765e588e3e60ad93562ce4caf9bcf935
- SHA512 804d9af8517d1f3b31fb44e45730b4470ff824cd0bf64151637feca4d96521e923a4623b1b554b6876cd24593f81fe44b67dbc10c861a4c86898b887d7dcc59b
- SSDEEP 6144:ymK4ZKKlGp8IcIusAZ4BOJrOk0HOGm/SFyEET:yMFgvE4BOJrOjuGdF2T
- TLSH T1371412A64F1BD3EBC46EA731356DA9068C1E13CA517DEC9C218CD7CF34893851E229A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 b2240b1e7169f89ff290df78b4004bbf2df5de2973f81283fb4c529208c8746f
- MD5 6228f9020f94888900c10b90ed3c8121
- SHA1 7f2e86e509b085f1f25f12a556bf0530167b8896
- SHA512 d97235c3aab8379f67b98e9c80dedc5e791bf2a1c7a450d7fc3a1c60f1894da6459963150c35d73a331e6b5e9b33fd5d08b4fb5dbfa5122f85489eb2f5e61c4a
- SSDEEP 6144:JmK4ZKKlGp8IcIusAZ4BOJrOk0HOGm/SFyEET:JMFgvE4BOJrOjuGdF2T
- TLSH T1D61412A64F1BD3EBC46EA731356DA9068C1E13CA517DEC9C218CD7CF34893851E229A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cthk.io_chromes.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o3ftbu10.u0e.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 240B
- SHA256 95cbec710ca5b00e70eb7d38b55d099f92b37ba4d0acf7b999b3b9acd4fe983c
- MD5 5377a5d714278bbd4b09f25b04df692c
- SHA1 fa9c6eb3aff2fc49790f1044a45967efd9088026
- SHA512 d6a8f14bb5c62f95552bc79cefe7940b66e8b225e303fea3149d5d0b185306abd452eecd9c47a8f260e4ead01b263baa17dc6bc60f4623b7510511d5ddef0b23
- TLSH T18BD0A78BB24DC6A90001527B81F38D4DEDE5482C3B13BE706AA5DD4E36918958AF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 241B
- SHA256 d328664d56e28ace2d6f5afb8d8e0dc6e95349d6f688e070895b3d77123a3634
- MD5 80c71701c72071f2acb0d29870c2c3a0
- SHA1 e32ad69548821e5d112d682aa1ae859527067954
- SHA512 30c24c30bbf8a342c039be560af77beee15f4f0c3f72b9ec49830592a08c6e5e738f7a5b5c4fa10c8e2cf5843487da5b73d43e82bcb907fc19de4265cc7ea91b
- TLSH T1D8D0A7CBB24DC6A90001527B80F38D4DEEE1492C3F23AE30AAA5DD0E36818958AF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 122KB
- SHA256 9f1e8ac4951d958617987099f9edaa034b4d997fde297db41d9a8250b8e01a72
- MD5 37848d720c78315fca25858642b66518
- SHA1 1a62c3d18dd818241d887a98496702c491fa0891
- SHA512 d237998a7c5021b9386bb9df2b51267a744b0a9e9aa9fce938f7d5f6ba56f540ef72dbd7667ec7b59b1103fc6e44bc52ea1b209084f4a42c1ad4398b7c1844f3
- SSDEEP 1536:Mtns1NO8PAnERlWGGG8GEJ/JDhAV5Cg8AVAIMP6Gkg/Z:SngNO8PAFGGG8GCPAV5Cg8AVAIMCGkgR
- TLSH T1B4C31940C2F79E2B45921EAB091233D0A078F7F492EDC5FB70E6AE53F162CA7D618615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 122KB
- SHA256 cef7910779686debd1de99db3e3d9c3da355fd47834161175cc22349e6f2835d
- MD5 579f9a56e3109dd7bb18d6d8b3cc4aef
- SHA1 3669ea2930953762557c4a6460247e0464a70150
- SHA512 90d5613779bf8e3b0b2ef7967b5aebe371daac55078943d070870380d9346c29bd72c0bb6638b1b1408475d5914291b54c6c2816525e40299de1440cdd14e478
- SSDEEP 1536:Jtns1NO8PAnERlWGGG8GEJ/JDhAV5Cg8AVAIMP6Gkg/U:7ngNO8PAFGGG8GCPAV5Cg8AVAIMCGkgM
- TLSH T13BC31940C2F79E2B45921EAB191233D0A078F7F492EDC5FB70E6AE53F162CA7D608615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 91e8a66bdb4d7e98748b8bdf494af1e4c97f346a2319149b25a2afb725fde903
- MD5 6b1682e96ed0a271d021f1fcfd865fe8
- SHA1 9bdb38e32c1f718dd7c8fe2de9500ea491848b70
- SHA512 a8d9f367355e6c7b074a7d0c4e22237cc149a9d5c4000acd9842fbf2f15f0f98c880be48180930eb6864034be25285cd285f7f6be176dbf6ed92d6f18b4131c3
- SSDEEP 768:IdhBVsJcxWZMzOaa9jx+HzMVSY/s/RgL4PC1XXGblfppbKFc5x4:MhkaxXa9jEYjsGL4PEXGblfLbucs
- TLSH T18833E54477F88551F2FF8ABA4DB186119B30B8A79C22D78E06D505CE1AB2740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH