Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 12:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fordeer.io_chrome.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
fordeer.io_chrome.exe
Resource
win11-20260130-en
windows11-21h2-x64
43 signatures
150 seconds
General
- Target fordeer.io_chrome.exe
- Size 50KB
- Sample260506-pge7faas2x
- SHA256 41f5b257257341cc78bd9dea6aabe7e2ed174ccee0a260902b49becef684a035
- MD5 d8b58c013877fba836ac61bcca580cec
- SHA1 b396cb71361d3c713d1e720a6b44cd1b3c97f4cb
- SHA512 e82ac817e2c16b906660812c145d3777612d44c97c7b61866b240be6839bcb724599dff46f0d319fbb27480e3965372fe02312383f6382a1204eb6e436c1cd86
- SSDEEP 768:id4K1X41QZ+6IN1/jpf0ZxD8LNJl/q/RgL4mC1XXGblfppAKFc5xC:eTa+ZNklpCArVqGL4mEXGblfLAucO
- TLSH T14433F74477F94212F1FF4BBA49B19611AB30B8A79C22D78E06D5058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2836-0-0x0000000000EE0000-0x0000000000EF2000-memory.dmp disable_win_def behavioral1/files/0x00070000000248a7-2444.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" fordeer.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" fordeer.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2916 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fordeer.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts fordeer.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe fordeer.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe fordeer.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe fordeer.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2660 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation fordeer.io_chrome.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf fordeer.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf fordeer.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf fordeer.io_chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe fordeer.io_chrome.exe File created C:\Windows\system32\sysupdate.exe fordeer.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe fordeer.io_chrome.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3060 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" fordeer.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" fordeer.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2580 sc.exe 1680 sc.exe 1172 sc.exe 2272 sc.exe 2652 sc.exe 1368 sc.exe 2620 sc.exe 2976 sc.exe 5280 sc.exe 912 sc.exe 1540 sc.exe 628 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3968 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1968 ipconfig.exe 5676 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 288 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4756 vssadmin.exe 2232 vssadmin.exe 1252 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\WallpaperStyle = "2" fordeer.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225435210088673" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command fordeer.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe\" \"%1\"" fordeer.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command fordeer.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fordeer.io_chrome.exe" fordeer.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.pdf\ = "PDFBotnet" fordeer.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet fordeer.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell fordeer.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open fordeer.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open fordeer.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open fordeer.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell fordeer.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings fordeer.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\DelegateExecute fordeer.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings fordeer.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell fordeer.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command fordeer.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 284 schtasks.exe 672 schtasks.exe 552 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 powershell.exe 2916 powershell.exe 1744 chrome.exe 1744 chrome.exe 2916 powershell.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe 2836 fordeer.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2836 fordeer.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2916 powershell.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeIncreaseQuotaPrivilege 4696 WMIC.exe Token: SeSecurityPrivilege 4696 WMIC.exe Token: SeTakeOwnershipPrivilege 4696 WMIC.exe Token: SeLoadDriverPrivilege 4696 WMIC.exe Token: SeSystemProfilePrivilege 4696 WMIC.exe Token: SeSystemtimePrivilege 4696 WMIC.exe Token: SeProfSingleProcessPrivilege 4696 WMIC.exe Token: SeIncBasePriorityPrivilege 4696 WMIC.exe Token: SeCreatePagefilePrivilege 4696 WMIC.exe Token: SeBackupPrivilege 4696 WMIC.exe Token: SeRestorePrivilege 4696 WMIC.exe Token: SeShutdownPrivilege 4696 WMIC.exe Token: SeDebugPrivilege 4696 WMIC.exe Token: SeSystemEnvironmentPrivilege 4696 WMIC.exe Token: SeRemoteShutdownPrivilege 4696 WMIC.exe Token: SeUndockPrivilege 4696 WMIC.exe Token: SeManageVolumePrivilege 4696 WMIC.exe Token: 33 4696 WMIC.exe Token: 34 4696 WMIC.exe Token: 35 4696 WMIC.exe Token: 36 4696 WMIC.exe Token: SeBackupPrivilege 4960 vssvc.exe Token: SeRestorePrivilege 4960 vssvc.exe Token: SeAuditPrivilege 4960 vssvc.exe Token: SeIncreaseQuotaPrivilege 4696 WMIC.exe Token: SeSecurityPrivilege 4696 WMIC.exe Token: SeTakeOwnershipPrivilege 4696 WMIC.exe Token: SeLoadDriverPrivilege 4696 WMIC.exe Token: SeSystemProfilePrivilege 4696 WMIC.exe Token: SeSystemtimePrivilege 4696 WMIC.exe Token: SeProfSingleProcessPrivilege 4696 WMIC.exe Token: SeIncBasePriorityPrivilege 4696 WMIC.exe Token: SeCreatePagefilePrivilege 4696 WMIC.exe Token: SeBackupPrivilege 4696 WMIC.exe Token: SeRestorePrivilege 4696 WMIC.exe Token: SeShutdownPrivilege 4696 WMIC.exe Token: SeDebugPrivilege 4696 WMIC.exe Token: SeSystemEnvironmentPrivilege 4696 WMIC.exe Token: SeRemoteShutdownPrivilege 4696 WMIC.exe Token: SeUndockPrivilege 4696 WMIC.exe Token: SeManageVolumePrivilege 4696 WMIC.exe Token: 33 4696 WMIC.exe Token: 34 4696 WMIC.exe Token: 35 4696 WMIC.exe Token: 36 4696 WMIC.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeDebugPrivilege 2836 fordeer.io_chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe Token: SeCreatePagefilePrivilege 1744 chrome.exe Token: SeShutdownPrivilege 1744 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe 1744 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2836 fordeer.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 1744 2836 fordeer.io_chrome.exe 85 PID 1744 wrote to memory of 4424 1744 chrome.exe 86 PID 2836 wrote to memory of 2916 2836 fordeer.io_chrome.exe 87 PID 2836 wrote to memory of 2620 2836 fordeer.io_chrome.exe 89 PID 2836 wrote to memory of 2976 2836 fordeer.io_chrome.exe 91 PID 2836 wrote to memory of 628 2836 fordeer.io_chrome.exe 93 PID 2836 wrote to memory of 5280 2836 fordeer.io_chrome.exe 95 PID 2836 wrote to memory of 2580 2836 fordeer.io_chrome.exe 97 PID 2836 wrote to memory of 1680 2836 fordeer.io_chrome.exe 99 PID 2836 wrote to memory of 912 2836 fordeer.io_chrome.exe 157 PID 2836 wrote to memory of 1172 2836 fordeer.io_chrome.exe 103 PID 2836 wrote to memory of 4872 2836 fordeer.io_chrome.exe 105 PID 2836 wrote to memory of 2272 2836 fordeer.io_chrome.exe 106 PID 1744 wrote to memory of 2628 1744 chrome.exe 107 PID 1744 wrote to memory of 3968 1744 chrome.exe 108 PID 1744 wrote to memory of 2628 1744 chrome.exe 107 PID 1744 wrote to memory of 4000 1744 chrome.exe 109 PID 1744 wrote to memory of 4000 1744 chrome.exe 109 PID 2836 wrote to memory of 2652 2836 fordeer.io_chrome.exe 112 PID 1744 wrote to memory of 1272 1744 chrome.exe 113 PID 1744 wrote to memory of 2332 1744 chrome.exe 114 PID 1744 wrote to memory of 1272 1744 chrome.exe 113 PID 1744 wrote to memory of 2332 1744 chrome.exe 114 PID 1744 wrote to memory of 4304 1744 chrome.exe 116 PID 1744 wrote to memory of 4304 1744 chrome.exe 116 PID 2836 wrote to memory of 4756 2836 fordeer.io_chrome.exe 117 PID 2836 wrote to memory of 4696 2836 fordeer.io_chrome.exe 119 PID 4872 wrote to memory of 1896 4872 fodhelper.exe 147 PID 1744 wrote to memory of 2056 1744 chrome.exe 126 PID 1744 wrote to memory of 2056 1744 chrome.exe 126 PID 2836 wrote to memory of 520 2836 fordeer.io_chrome.exe 127 PID 2836 wrote to memory of 552 2836 fordeer.io_chrome.exe 169 PID 2836 wrote to memory of 284 2836 fordeer.io_chrome.exe 130 PID 2836 wrote to memory of 6104 2836 fordeer.io_chrome.exe 134 PID 2836 wrote to memory of 2508 2836 fordeer.io_chrome.exe 136 PID 2836 wrote to memory of 3740 2836 fordeer.io_chrome.exe 138 PID 2836 wrote to memory of 5260 2836 fordeer.io_chrome.exe 139 PID 2836 wrote to memory of 5640 2836 fordeer.io_chrome.exe 140 PID 2836 wrote to memory of 844 2836 fordeer.io_chrome.exe 141 PID 2836 wrote to memory of 5900 2836 fordeer.io_chrome.exe 142 PID 2836 wrote to memory of 540 2836 fordeer.io_chrome.exe 143 PID 2836 wrote to memory of 672 2836 fordeer.io_chrome.exe 144 PID 2836 wrote to memory of 4652 2836 fordeer.io_chrome.exe 152 PID 2836 wrote to memory of 2232 2836 fordeer.io_chrome.exe 153 PID 2836 wrote to memory of 864 2836 fordeer.io_chrome.exe 155 PID 2836 wrote to memory of 2372 2836 fordeer.io_chrome.exe 156 PID 2836 wrote to memory of 2660 2836 fordeer.io_chrome.exe 159 PID 2836 wrote to memory of 1368 2836 fordeer.io_chrome.exe 160 PID 2836 wrote to memory of 1540 2836 fordeer.io_chrome.exe 162 PID 2372 wrote to memory of 280 2372 net.exe 165 PID 1744 wrote to memory of 3360 1744 chrome.exe 166 PID 1744 wrote to memory of 784 1744 chrome.exe 167 PID 1744 wrote to memory of 3360 1744 chrome.exe 166 PID 1744 wrote to memory of 784 1744 chrome.exe 167 PID 540 wrote to memory of 5676 540 cmd.exe 168 PID 5640 wrote to memory of 552 5640 cmd.exe 169 PID 5900 wrote to memory of 1968 5900 cmd.exe 170 PID 844 wrote to memory of 2320 844 cmd.exe 171 PID 3740 wrote to memory of 288 3740 cmd.exe 172 PID 5260 wrote to memory of 3060 5260 cmd.exe 173 PID 2508 wrote to memory of 1252 2508 cmd.exe 174 PID 2320 wrote to memory of 3000 2320 net.exe 175 PID 2508 wrote to memory of 3104 2508 cmd.exe 176 PID 1744 wrote to memory of 576 1744 chrome.exe 179 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://fordeer.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c3ffc728,0x7ff8c3ffc734,0x7ff8c3ffc7403⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,2659845637502296542,8630226947345137371,262144 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1960 /prefetch:23⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,17915955022028730850,2581972130788378593,524288 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2220 /prefetch:33⤵
- System Time Discovery
PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,18083078667838538218,17591817565653713398,524288 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2532 /prefetch:83⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,11219670585393170085,4159394681161104888,2097152 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3156 /prefetch:13⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,10883605751734485617,15597622604974814226,2097152 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3180 /prefetch:13⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,5565021123120520463,9771318972642866293,2097152 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4400 /prefetch:23⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,4596986493613389536,6084874767338037085,2097152 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4704 /prefetch:13⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,9869265551075809215,217140771470996492,2097152 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3196 /prefetch:13⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4868,i,7964519278185137798,2310264693517345475,2097152 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4676 /prefetch:13⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,17793518571517489436,4180761709551998219,524288 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4164 /prefetch:83⤵PID:576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,7410704169484125463,3812282678871311706,524288 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5756 /prefetch:83⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,18383483354658542779,16341093803717193985,524288 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5812 /prefetch:83⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,13120298333487906860,2839266182438107900,524288 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5740 /prefetch:83⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5728,i,16464579882258174877,4421117277832196678,262144 --field-trial-handle=1972,i,6140027474695593324,16247619499268985626,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1052 /prefetch:83⤵PID:3764
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2620
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2976
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:628
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5280
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2580
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1680
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:912
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1172
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe"3⤵PID:1896
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2272
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2652
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4756
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:520
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:552
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:284
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:6104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1252
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:3104
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:288
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:3060
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\system32\whoami.exewhoami3⤵PID:552
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3000
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1896
-
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1968
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:5676
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:672
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:4652
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2232
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:864
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:912
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:280
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2660
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1368
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1540
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1356
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe1⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\fordeer.io_chrome.exe1⤵PID:4332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2016
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 c9848f60f42f236c7a356dd7afe0c0c84ab395f8173ca68c2e3293d7f55e01dd
- MD5 92a381dfdaa4047232bdfaec041fa5e1
- SHA1 4d5b636b7da2c6eed8b4a3e0697eeab82c8601b9
- SHA512 2b336e92380ab5caae393ff0f32928e08cf61c92bdb0ec812370b83167b4000c7f2c3b7dcc53938ef0e6853ba29e60762ed88ab726dda02c31d5d7ac6afc8dc5
- SSDEEP 1536:vBU+XPHXcBn3fqM+3BoimpWYK3q5HORRtsFruPBJA8ezplLRSku1uJ6V9BrA:vBUU3cBn63Bo9Vz5uRTuuazplCICpA
- TLSH T158633C374B33FDC1A77E3D80E05039461C883F6787B56678FA850EAA18E6244EF6E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 37fab21627d43e01b44a4d1fb55ed901bc0e1aeecd654525dcf84ba77e54e0e4
- MD5 54d11324231cb2dd50fd6598a1246443
- SHA1 3ab191b7a0cc77738cc05110178cab1f53a12f1b
- SHA512 071dff9d844fcd52a662d4bba8c720c08eb853d2abc368c3373b8bd438ca2c4e00bd0a13d30f3f9a07a4a44b55745b99c2b3e002a773cd0b8448245bfa0991eb
- SSDEEP 1536:PBU+XPHXcBn3fqM+3BoimpWYK3q5HORRtsFruPBJA8ezplLRSku1uJ6V9Brb:PBUU3cBn63Bo9Vz5uRTuuazplCICpb
- TLSH T1D8633C378B33FDC1677E3D80E05039461C883F6787B56678FA850EAA28E6244DF6E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 1890e4516f0e6403cc945a942a803949905b877fd57e9f5d1b352e63b436483b
- MD5 8b9887952541e95e8ce7cbb4aee8a14f
- SHA1 d5da467967b5360d9b2fa22bb2ae1f5454cfb0b5
- SHA512 0d142939910f3eedb1ff22b738d56ee083430f982d1567c56833f224c49022cb45f9a970b8b7fca2838295d92ab276c484342a963bd59d27cc8bfea51b8380a0
- TLSH T1B3E02BBAC821EC3F08FD071D60610786E750135727504A4B763DD3088FB053F4586C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 720B
- SHA256 c3cb157e26e3d069f0abc5bdb1e2f201952a5abe53953f621fa84cbfb6492b08
- MD5 f33d92dd48f70055ff1008b43d628229
- SHA1 69b90acbfe6fbade0b96686480a49171ecf86059
- SHA512 22888fe667b6cffa634f2ebaee318c9c2b0555035e5a54fc18712e28ea9faf21cffc89815827dd757782fc4c8b51460e4de5cc96f5c1c7a17f3e3fb572891d45
- TLSH T17B01F06841862673CF610AB411F95AE039F17E3AC8AB7F0ED07920B8B65B39DDB45304
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 cdff37f932a472bd97b2dcec43f3667e262f716aebfebfcf80bbd3614a475032
- MD5 f89f276ce61103ecf0de856a236e839a
- SHA1 a88930f03835f406b671b5f7ac1c1f073ef8db95
- SHA512 991cdd4b697e9f2abc9b57cb32992899ea4d3b3865b0797758598e9f13e3c112ca65be0d20fff977e0441f73c2afff09e6b4d9e95d53fdebaf8ddbe4fc69e72d
- SSDEEP 96:D0YjIiRx+7tGJaIEagdu9kSZFMhrL1RIK1qb8/8Kx19X1BjhIT:D0UIiRQ74JaIEagdGXTcrRtQ8ES19XrC
- TLSH T112C17BF3D3E4856DCA1152F4AA256E2FDD29091843283D6B89E99E0F93F2572D140B8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 c055fa3367eee138a2f7436bd298a6fb8f0996013cc107d53b61b386e755298e
- MD5 8b0aedec184856299d884417866bc3e2
- SHA1 ba75ce6b7c6f288fa8e59c32015db5c86f37bfc0
- SHA512 acfdfcd5c403532dfe471947e423ad1a3e2c2f3ca3ea3f71354133bf9f2dbb717aaee999fa01e0f48764164aac7082fda02ad92422373ddd013362c47da83aa2
- SSDEEP 192:lRQpMPOY8XClv7SpyPRp3fl79QHsb+WNnHCpXQ2BeeqH2hfvRHVyIsnAUgvlaJ:lRQpCbVeiXdWwim2c2RfvE
- TLSH T1BF52D62EB914797B5CC6D22AF9227B5BE7F4102161D02E88E7FC8A2C25E75DD321B017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 331f3412565abb81a45acc0aee1c157056d82543a7600f868f571531ad0ac82b
- MD5 34f37d85e95940e9eb7fa4e931c1866f
- SHA1 aaba5ce92c7179759ed61b5ba4e5fff866336a7f
- SHA512 566170a186ddc9928c0c9c39fa53d44c091f083ba7e337b06004aea2537883b8c1f294be8d760b44354b0858f5419201c03c26c94043f4706f34d8acd961a3c6
- SSDEEP 192:lRQpnOBqw8XClv7SpAPRp2fl79QHsb+WNnHCpXQ2YeeqH2hfvRYVyIsnAUg5m:lRQpsqIVeUXAWwim2z2RS5m
- TLSH T11C42D66EBE14757B5CCAC22AF9227B5BE7F5002160D02E84E7FC8A2C15E79DD221B017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c8493b99e8408a986a457f9d8176b4462e5da4c7b108e7566747662da85a6daa
- MD5 86025bf4d69c033448d1693f0e30d377
- SHA1 2f14366e541992135b56c8f1976842e45cf394cc
- SHA512 1d38e25d14f5e89fad00736476fa41c16d68b716425cfb2a6dc94009d18ee58e8441b2211be642028a806ad7e911574b6dc5100dbdb8dd711728e9d169a22da0
- SSDEEP 192:lRQpePOY8XClv7SpAPRp2fl79QHsb+WNnHCpXQ2ieeqH2hfvRZVyIsnAUgvlaJ:lRQpUbVeUXAWwim292RNvE
- TLSH T17A52D62EBE14797B5CCAD21AF9227B5BE7F5102160D02E84E6FC8A2C15E75DD321B017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 2c95ba5cea8a4c55f3dc473702e23be116183f57482bc38defaea731c0fab60a
- MD5 8c54a51360c5227332ae5b211e674c95
- SHA1 37fc294b8d47979bc64de70e5d9286cdc872a85f
- SHA512 72ef8f3e180dadc704f06076e623a6db4304ee6883f61623df25c8bc2b8110f47d31faf2ccdc681cbfc1c661886df661fa150a811c93e2a66f82ccf09e13f159
- SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLc8SzXODk7+ErU3fFHGA3Oc:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7p4
- TLSH T1D972EAA7784C9A770F94CACCDC167E4FADB5024B65E9886482FA982503D5BCF110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 1a2adb9fce4ee985c7b63ffb3faf50fcb16a55d711ca96ebad2e1674bc1dec49
- MD5 2f33b29c157f03d4a9e370dc024e6d97
- SHA1 4c0b61bd9868e3d5564c22b6020c96c8bffb14ca
- SHA512 aed91a3246f2188bcad3aa37cdc0fa6e34b5b2888dcf9b6161e0bd03fc5e9732051094c0005416ba75559ec6e745994bcd4041f9dfedede2dc5b74207f0e1435
- TLSH T119B0125080415512C44702F526D204983114DF319705171157F469B19C261904115150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588a49.TMP
- Size 96B
- SHA256 c639c7c9ba4850bb8434bf50ac858227a500e485cda875fc7c49ffb08ea51cc4
- MD5 f13c7ccdc18ba41001463bda7032cf2e
- SHA1 54a1bf46b58a9b1e1723e96ab6606dd077c3b5b8
- SHA512 ce17e4a9e0d198eee511198a04d42945a6b729580560cb872968228fa42c4defe1826848822cac1a2b4554343f656de6b5735e99149031edf9c637918423dbac
- TLSH T13CB02280C8033A32C08303B03880A3C8F0A0CF2ECA03022AE3F00A23EC283300220A20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 c94b25e4ca920a6a3ab946bd4b810041ce0d65cc10b26de543a2ee39aa06e197
- MD5 4d3233795fb85ee39b6ee9a01fe6b513
- SHA1 4b9dc82e25acb27eac1d7ac840cc562282c57b4d
- SHA512 4b19e67df7b290a286822bbbb7281c2c95bdaf465120a0df0fa6bdec209559739755008d4dcac0e099d1cbe06a6b4c8864917d315c57856693030517b2f1255d
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OxzdVumjndM:1nbZeMrv/hGtxlndM
- TLSH T179D3984B3A743002EDE59A762CE054BB5D3CB16D4F15A5D528B620588EF2863B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 77357d1a320b1f08674059c615481a30d34fefadd769525fc5af4bddfbb9fea6
- MD5 dfe08bd8c72311540d55608e0e5e69fd
- SHA1 dc15aad49f260963a93c88629145061126f6ce92
- SHA512 9cfdda756c9b05d949e4d5df581ad82bda63c585e2adcc3baff931711a8011b57e5bc5497f88e6d7def797a13067d85a1795e1f9c2405b19b564a9135fa8df62
- SSDEEP 6144:s1ymdUNJbLsLcMbNCdcp8zlkUPrOk0HOGm/SFyEEX:bmqJboLbsdlkirOjuGdF2X
- TLSH T13D14123AAE2A17F241BD6AE2B5BF6E06CD22D347F54EBE0C3014BBC554980C10752DB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 e1373714b416e892932a143fd6b287c6d1e4ac2cc81fb01511d83313d47cc024
- MD5 3fee7a738dc6a024709c1a952058ff95
- SHA1 7e6d70c86f902786dcf465babe1d653e09ae6d93
- SHA512 84f64ed87ee445b20aab438f3cd7cc689dca8f3c9eb17c265a28e10655c98aa5934101ca39f5d7c17ed442df36abf4ee02cf22e8a5662af2cac2719b4f9e48a5
- SSDEEP 6144:s9mdUNJbLsLcMbNCdcp8zlkUPrOk0HOGm/SFyEEX:ImqJboLbsdlkirOjuGdF2X
- TLSH T10F141239EE2A07F741BC66E2B5FF6D06CE229302B08FBE5C3124B7D855940C507529BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 04ce6c4ce11d7395bb54234a72e68227763b082098da5286a6f608908960573e
- MD5 75e1cd38dc0acb79b2974d8984d0d300
- SHA1 731b00fae7d3f985bbb66d17ba61f4eb54be5ef7
- SHA512 ff4492270327f7bba82ede5353554e2e3ae551f8737e0a20957ffcd121ce67fd5235613cd205abd8f01aee30f4eed0da7ba7e9184de12c08359e83fd2a255e2d
- SSDEEP 1536:KiH3hRcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRk:173Qw/xLANk0mUW5GmRntSFCjEENO
- TLSH T1959312BA5E2646F795BA4AD1725E790ACE12130E305FA9CC72AC138C61C51CD2B63F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 4086339760a77ddef8c18e6cc719d1ac0f3e23d15fb3ed492d5ce35a49e552a6
- MD5 38d65fa9907162dbdac75e3aa4a75a7d
- SHA1 fb4c8c64d9bd3ed6d28ef8171b41907307c7f4e9
- SHA512 1d54776fe0ad196d4765fb088f859a7511d3275598532f562629d9a07bed1d1cfed16dcd0a07a5a31c788cb2591f08a24a87207a94ccbd923aa22e797a9a6155
- SSDEEP 1536:s3jmrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:SEh3Qw/xLANk0mUW5GmRntSFCjEEND
- TLSH T1F19312BA4F2646E7957D4AC136AE7808CE12130D70AFA9CC326C638C61D01CD2B63F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fordeer.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztwzhaqf.h11.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 242B
- SHA256 4ccb389f3df0a387c3f364c67bb5eb52fd4723f365bbc460e0e3fcadf4fcbf49
- MD5 4118575b83150752ebb389132e6ddad5
- SHA1 bc28a8f35a020f6e4ac45653a06a055c66b99c2e
- SHA512 25cc93163442670d5cd31bcf082fee7c253dbcb61b1f0a284d29efed1430fba39a912e68f6449888d0186ec7e22b4eedf2dc6b464d9f0752b9bb4adc3234ab2e
- TLSH T14FD0A7CFB248C6B90001623B81F3CD8CE9E588683B23BE705AA5DD4D369188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 243B
- SHA256 6165703f56ade3345cc3b85b19056901fa2f8a813e262ccb6a4348446a5d4907
- MD5 02da2de087f23aba37ee027382a975e2
- SHA1 a0e8760a999f0b81dcb70d727248742c3345ee1b
- SHA512 39f164c16b3f013aa6a7bb41f224ba1e491c02f0147767f4d43f150ddb69b5b3944654ac1563ae1f23daabb1147c7ecc4d334cb8f0634acc2cce02aa6e1f938f
- TLSH T131D0A5CF7148C5790001523B40F3CD4CE5D584683F236D305565DD4D375144549F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 143KB
- SHA256 1774e4a2b115972f079a209766c77de44f5b9b8bc28824427d61bec654688d36
- MD5 209bc673a1f4479fda34a1f946e27bc5
- SHA1 58420248c224ed75d684265a1417acf210a33312
- SHA512 c59f0fd04a8041627c36890333135d3f3495aba8b3e3d7cf5ab096ee6d7ec9f59ed39771a1f77a0448e81383a086cab5e8629a77c6a8883eeeff5c7852429616
- SSDEEP 3072:37XfwV/YElYsaRSlFwxpcDsZ1G6C8Zbg1gG:rXMYEl0MsZ1BCKgiG
- TLSH T13EE37751C6F69D2A15D65AAB195237D1A439B7F192ECC5FB20B2AA73F077CF2C308201
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 143KB
- SHA256 97516b49c9164b0f5dbd73e8bd598aeaaf1059d5d95907b352db3f97a96806c2
- MD5 1f7ffd44358fa997d9d2ee9294fc3e0f
- SHA1 a7a0ccb829a922af68fd7968bf725b05b4bac1dc
- SHA512 9f634002b579967b5d3f29bbbbcd0fc49efd149bcb6822a810a82c1cf0a03f76b15d2e55aae52d6fe0e9597217a492a51ee1751173b85ac228604b98efb0bfac
- SSDEEP 3072:f7XfwV/YElYsaRSlFwxpcDsZ1G6C8Zbg1gC:jXMYEl0MsZ1BCKgiC
- TLSH T1E2E37751C6F69D2A15D65AEB195237C1A439B7F192ECC5FB20A2AA73F077CF2C318201
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 41f5b257257341cc78bd9dea6aabe7e2ed174ccee0a260902b49becef684a035
- MD5 d8b58c013877fba836ac61bcca580cec
- SHA1 b396cb71361d3c713d1e720a6b44cd1b3c97f4cb
- SHA512 e82ac817e2c16b906660812c145d3777612d44c97c7b61866b240be6839bcb724599dff46f0d319fbb27480e3965372fe02312383f6382a1204eb6e436c1cd86
- SSDEEP 768:id4K1X41QZ+6IN1/jpf0ZxD8LNJl/q/RgL4mC1XXGblfppAKFc5xC:eTa+ZNklpCArVqGL4mEXGblfLAucO
- TLSH T14433F74477F94212F1FF4BBA49B19611AB30B8A79C22D78E06D5058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH