Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 00:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
crashy.io_chromes.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
crashy.io_chromes.exe
Resource
win11-20260130-en
windows11-21h2-x64
43 signatures
150 seconds
General
- Target crashy.io_chromes.exe
- Size 50KB
- Sample260508-a2bmesfw9l
- SHA256 e7b64f2670a74da784a3c7ebbd106a1078757b94ca05b2c78331f0b19d8be48e
- MD5 fc7b84002ecf3b2e1c5f0a8daa008812
- SHA1 f3ec648cec5f66504cdfcd94c1ad89fcf71da340
- SHA512 27d66c4f7ce8a5fabc6d3fe2b063a167549f0bd0930933706813ef4fae070e6bf22a507c079bcd9193c08bd2712261b52ddf871d50c74b8b3bc5b32440877a44
- SSDEEP 1536:WVgu+QO0vB+kVwGXvD4GL4tEXGblfLFucq:WSu+h0vBFw2Dr4tEXGJfLFux
- TLSH T11833074477F94611F1BF8ABA48B186019B31B8979C23D79E0AD5058E1AB3780CDE8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4728-0-0x00000000008D0000-0x00000000008E2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024921-2379.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" crashy.io_chromes.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" crashy.io_chromes.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2084 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" crashy.io_chromes.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts crashy.io_chromes.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe crashy.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe crashy.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe crashy.io_chromes.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 368 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation crashy.io_chromes.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf crashy.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf crashy.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf crashy.io_chromes.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\sysupdate.exe crashy.io_chromes.exe File opened for modification C:\Windows\system32\sysupdate.exe crashy.io_chromes.exe File created C:\Windows\system32\svchost.exe crashy.io_chromes.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2732 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" crashy.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" crashy.io_chromes.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4336 sc.exe 6088 sc.exe 4008 sc.exe 4216 sc.exe 5212 sc.exe 728 sc.exe 1064 sc.exe 908 sc.exe 1804 sc.exe 4348 sc.exe 2752 sc.exe 5112 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2512 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1248 NETSTAT.EXE 1796 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1452 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4920 vssadmin.exe 1184 vssadmin.exe 1056 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\WallpaperStyle = "2" crashy.io_chromes.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226745461506595" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet crashy.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe\" \"%1\"" crashy.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command crashy.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings crashy.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open crashy.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crashy.io_chromes.exe" crashy.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open crashy.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\DelegateExecute crashy.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command crashy.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings crashy.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.pdf\ = "PDFBotnet" crashy.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell crashy.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open crashy.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell crashy.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell crashy.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command crashy.io_chromes.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3940 schtasks.exe 5788 schtasks.exe 3720 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 powershell.exe 2084 powershell.exe 4804 chrome.exe 4804 chrome.exe 2084 powershell.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe 4728 crashy.io_chromes.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4728 crashy.io_chromes.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2084 powershell.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeIncreaseQuotaPrivilege 1212 WMIC.exe Token: SeSecurityPrivilege 1212 WMIC.exe Token: SeTakeOwnershipPrivilege 1212 WMIC.exe Token: SeLoadDriverPrivilege 1212 WMIC.exe Token: SeSystemProfilePrivilege 1212 WMIC.exe Token: SeSystemtimePrivilege 1212 WMIC.exe Token: SeProfSingleProcessPrivilege 1212 WMIC.exe Token: SeIncBasePriorityPrivilege 1212 WMIC.exe Token: SeCreatePagefilePrivilege 1212 WMIC.exe Token: SeBackupPrivilege 1212 WMIC.exe Token: SeRestorePrivilege 1212 WMIC.exe Token: SeShutdownPrivilege 1212 WMIC.exe Token: SeDebugPrivilege 1212 WMIC.exe Token: SeSystemEnvironmentPrivilege 1212 WMIC.exe Token: SeRemoteShutdownPrivilege 1212 WMIC.exe Token: SeUndockPrivilege 1212 WMIC.exe Token: SeManageVolumePrivilege 1212 WMIC.exe Token: 33 1212 WMIC.exe Token: 34 1212 WMIC.exe Token: 35 1212 WMIC.exe Token: 36 1212 WMIC.exe Token: SeBackupPrivilege 3116 vssvc.exe Token: SeRestorePrivilege 3116 vssvc.exe Token: SeAuditPrivilege 3116 vssvc.exe Token: SeIncreaseQuotaPrivilege 1212 WMIC.exe Token: SeSecurityPrivilege 1212 WMIC.exe Token: SeTakeOwnershipPrivilege 1212 WMIC.exe Token: SeLoadDriverPrivilege 1212 WMIC.exe Token: SeSystemProfilePrivilege 1212 WMIC.exe Token: SeSystemtimePrivilege 1212 WMIC.exe Token: SeProfSingleProcessPrivilege 1212 WMIC.exe Token: SeIncBasePriorityPrivilege 1212 WMIC.exe Token: SeCreatePagefilePrivilege 1212 WMIC.exe Token: SeBackupPrivilege 1212 WMIC.exe Token: SeRestorePrivilege 1212 WMIC.exe Token: SeShutdownPrivilege 1212 WMIC.exe Token: SeDebugPrivilege 1212 WMIC.exe Token: SeSystemEnvironmentPrivilege 1212 WMIC.exe Token: SeRemoteShutdownPrivilege 1212 WMIC.exe Token: SeUndockPrivilege 1212 WMIC.exe Token: SeManageVolumePrivilege 1212 WMIC.exe Token: 33 1212 WMIC.exe Token: 34 1212 WMIC.exe Token: 35 1212 WMIC.exe Token: 36 1212 WMIC.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4728 crashy.io_chromes.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 4804 4728 crashy.io_chromes.exe 86 PID 4804 wrote to memory of 1240 4804 chrome.exe 87 PID 4728 wrote to memory of 2084 4728 crashy.io_chromes.exe 88 PID 4728 wrote to memory of 4008 4728 crashy.io_chromes.exe 90 PID 4728 wrote to memory of 1064 4728 crashy.io_chromes.exe 92 PID 4728 wrote to memory of 4216 4728 crashy.io_chromes.exe 94 PID 4728 wrote to memory of 908 4728 crashy.io_chromes.exe 96 PID 4728 wrote to memory of 5212 4728 crashy.io_chromes.exe 98 PID 4728 wrote to memory of 1804 4728 crashy.io_chromes.exe 100 PID 4728 wrote to memory of 4348 4728 crashy.io_chromes.exe 128 PID 4804 wrote to memory of 2748 4804 chrome.exe 104 PID 4804 wrote to memory of 2748 4804 chrome.exe 104 PID 4728 wrote to memory of 2752 4728 crashy.io_chromes.exe 106 PID 4804 wrote to memory of 2512 4804 chrome.exe 105 PID 4804 wrote to memory of 3708 4804 chrome.exe 108 PID 4804 wrote to memory of 3708 4804 chrome.exe 108 PID 4804 wrote to memory of 4476 4804 chrome.exe 110 PID 4804 wrote to memory of 4476 4804 chrome.exe 110 PID 4804 wrote to memory of 976 4804 chrome.exe 109 PID 4804 wrote to memory of 976 4804 chrome.exe 109 PID 4804 wrote to memory of 5960 4804 chrome.exe 112 PID 4804 wrote to memory of 5960 4804 chrome.exe 112 PID 4728 wrote to memory of 1456 4728 crashy.io_chromes.exe 111 PID 4728 wrote to memory of 5112 4728 crashy.io_chromes.exe 114 PID 4728 wrote to memory of 4336 4728 crashy.io_chromes.exe 116 PID 4728 wrote to memory of 4920 4728 crashy.io_chromes.exe 118 PID 4728 wrote to memory of 1212 4728 crashy.io_chromes.exe 120 PID 1456 wrote to memory of 3364 1456 fodhelper.exe 122 PID 4804 wrote to memory of 3800 4804 chrome.exe 127 PID 4804 wrote to memory of 3800 4804 chrome.exe 127 PID 4728 wrote to memory of 4348 4728 crashy.io_chromes.exe 128 PID 4728 wrote to memory of 3940 4728 crashy.io_chromes.exe 129 PID 4728 wrote to memory of 5788 4728 crashy.io_chromes.exe 131 PID 4728 wrote to memory of 5232 4728 crashy.io_chromes.exe 135 PID 4728 wrote to memory of 2260 4728 crashy.io_chromes.exe 137 PID 4728 wrote to memory of 516 4728 crashy.io_chromes.exe 139 PID 4728 wrote to memory of 180 4728 crashy.io_chromes.exe 140 PID 4728 wrote to memory of 856 4728 crashy.io_chromes.exe 141 PID 4728 wrote to memory of 264 4728 crashy.io_chromes.exe 142 PID 4728 wrote to memory of 3012 4728 crashy.io_chromes.exe 143 PID 4728 wrote to memory of 1700 4728 crashy.io_chromes.exe 144 PID 4728 wrote to memory of 3720 4728 crashy.io_chromes.exe 150 PID 4728 wrote to memory of 2696 4728 crashy.io_chromes.exe 153 PID 4728 wrote to memory of 1184 4728 crashy.io_chromes.exe 154 PID 4728 wrote to memory of 276 4728 crashy.io_chromes.exe 155 PID 4728 wrote to memory of 2276 4728 crashy.io_chromes.exe 156 PID 4728 wrote to memory of 368 4728 crashy.io_chromes.exe 160 PID 4728 wrote to memory of 728 4728 crashy.io_chromes.exe 162 PID 4728 wrote to memory of 6088 4728 crashy.io_chromes.exe 164 PID 856 wrote to memory of 2168 856 cmd.exe 166 PID 2276 wrote to memory of 116 2276 net.exe 169 PID 180 wrote to memory of 2732 180 cmd.exe 167 PID 1700 wrote to memory of 1248 1700 cmd.exe 168 PID 516 wrote to memory of 1452 516 cmd.exe 170 PID 264 wrote to memory of 2140 264 cmd.exe 171 PID 3012 wrote to memory of 1796 3012 cmd.exe 172 PID 2260 wrote to memory of 1056 2260 cmd.exe 173 PID 2140 wrote to memory of 3284 2140 net.exe 174 PID 2260 wrote to memory of 3444 2260 cmd.exe 175 PID 4804 wrote to memory of 5580 4804 chrome.exe 176 PID 4804 wrote to memory of 3976 4804 chrome.exe 186 PID 4804 wrote to memory of 3812 4804 chrome.exe 187 PID 4804 wrote to memory of 1096 4804 chrome.exe 188 PID 4804 wrote to memory of 1060 4804 chrome.exe 207 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe"C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://crashy.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0696c728,0x7ffb0696c734,0x7ffb0696c7403⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,16973094105886512,7104789307535603467,262144 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2004 /prefetch:23⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,11674719304403791371,16740293455558871976,524288 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2268 /prefetch:33⤵
- System Time Discovery
PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,12767486550533737117,17269371500311735482,524288 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2708 /prefetch:83⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,2439206218415279386,18216160488209892024,2097152 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:13⤵PID:976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,17308711856111938984,9204920758357366115,2097152 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4136,i,10126407476189684444,18001591450053492818,2097152 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4152 /prefetch:23⤵PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5080,i,13055531039914307876,11649826132419023348,2097152 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5076 /prefetch:13⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,3488126163185527662,13098467941088694806,524288 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5492 /prefetch:83⤵PID:5580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,10687787607858873318,5334571032682940184,524288 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=208 /prefetch:83⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,10663092127348057092,9173265542407213231,524288 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3352 /prefetch:83⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,5233421739467694374,6119834620125744165,524288 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5760 /prefetch:83⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5932,i,14706278599492971312,1206231742177781086,262144 --field-trial-handle=2008,i,4040801664812864325,16547989873611822401,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5976 /prefetch:83⤵PID:1060
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4008
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1064
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4216
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5212
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1804
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4348
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2752
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe"C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe"3⤵PID:3364
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5112
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4336
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4920
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:4348
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3940
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5788
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1056
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:3444
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1452
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:2732
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\system32\whoami.exewhoami3⤵PID:2168
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3284
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1796
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:1248
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3720
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:2696
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1184
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:276
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:116
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:368
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:728
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:6088
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3292
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exeC:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe1⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exeC:\Users\Admin\AppData\Local\Temp\crashy.io_chromes.exe1⤵PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3432
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260508_014355.jpg
- Size 88KB
- SHA256 66facd5ccf466e71f7cae73edd813dc19014ac5caaf1ef5e7d7c6be1c11cf45d
- MD5 bde32280b50e541aed19d125ab6e8e38
- SHA1 ac70bd265f18b610d571333d31dced28631be5cf
- SHA512 0300bcffa73a9154865508164361df07bcd1ec9d14e2ecd9a4a265f7d85cf670e23658f956d03b72fa642abe292fb768c90236f38cb7b0e835fa7aebc0132e55
- SSDEEP 1536:ImRRRRRRRRRRObSSSSS9Nb5+5pMRfIsCYQtfK7oA+SsUIEL:YSSSSS90pMRfnCY77R+qxL
- TLSH T1BB939A078D498AC3A46D83F8BE071EEC2E092B1CE9567FFF01211FD67A611675D4B12A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 88345deee4b2ae91bab202023167090703aecb94cffc3d29153bbbec1f90d067
- MD5 e115975aa107093668dc66d077d37726
- SHA1 57935d0c0fff99cdecd149cfe19d2f5937c022db
- SHA512 2fafa7d3966c08595f10ee1ff2642c6ae1a52d1f395ec730f194c670b3ddb450fa1e396fb3395d803656a217bfb9f7df23a7092a903f6161f49cb229942a6034
- SSDEEP 1536:PBUhbPTjXe/SUBEVDLK7iwj2usIqrgToRvtsFzL1vc140zzOCBV1KYSv514Ga:PBUBHe/SBLK7xzarVR1k1Ue0zzd1+51G
- TLSH T1FE633A368B33FDC5677E3D80F06039961C883E6787B5667CFAC509AA18E6240DF2E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 037236a6a6f58ddcd71304d30316ed1d2797d1af148e452f827c552f125a64af
- MD5 4f2052994c980ca9a500cc11b82eac06
- SHA1 3628c753ea892c7240e4f25487a3305c9585b1f8
- SHA512 c4b0fee1c0b16db807bd33d1c19e3106dfebaf135b9ce09ebecf16a081293561de1e62b46d9e26d9ce31ca04b545e5eb73a43551d6e9007103f61676599e3c1b
- SSDEEP 1536:vBUhbPTjXe/SUBEVDLK7iwj2usIqrgToRvtsFzL1vc140zzOCBV1KYSv514Gt:vBUBHe/SBLK7xzarVR1k1Ue0zzd1+51B
- TLSH T1966339368B33FDC5677E3D80F06039961C883E6797B5663CFA850DAA18E6240DF2E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 130e9b0f7ccf7ea1d9a6b6c6c91668377a0a2851013f8653297e389210dfe458
- MD5 64cae5f74270d3b441180ee1c1787489
- SHA1 1bb4b3dd521d3ad4cd41f2039ebe82b2bcbd2087
- SHA512 e1a993b473ef069eb18b751ac7eb7f34f61433e70969fb7c4e23b62a97ebec89414937307404dd3c9ad31aeb02f358fe8a06c40ead235f6980ba80325edda5f4
- TLSH T191E061A7DC62EC2708FD17186014170DEF0113576B41550F7A3C864C8FF023B5682C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 3de485b85127c2dcc0623e4ae3737e925fba4605324543a3b292d610be6f9ef8
- MD5 7a6b5e6662d772458ac4fdf7369fb4b8
- SHA1 16033d6b26e38f3ecd7bbcc7403b0339a9e3fc11
- SHA512 c3882cf244f58205a00b2a20962a64587b3d98029ba1579d8e1d367024284f87b67316170b039811eec255a37e3cc561eec85b4cd59fdd437333ee190a6b4e3b
- TLSH T138D08C5427910617CBC240F142D10482727106209EA34F15A1FCA9B9C0213732C006BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 40dafdaf62d6cdcb6588da47b174ff9eba71d16029ad6d01c0ac4d1ab0fba2da
- MD5 abe5f2d1076102e1cd4ca13162678542
- SHA1 458a31fe0a6220291e5e139fdd5920b09a913418
- SHA512 885505392b700d1d11e061e1ecae625cf5b268d4c507aba47b322622370e2e8bc71df413f300bbbb6f890da894dc09d9ae1de69338cfd8a0676be5d8a90384f0
- TLSH T134D022241BE61953DFC74CB21AE30C222A6081041EB30F17A2FCC0C4D0423FB2F00B65
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 64c27f4207392fd4032e0e2656bb441fd6cbe20ad4e45aea5709328dd7f06dad
- MD5 85c1e9aaef266b48b0c590758204def5
- SHA1 4d76dfe452bff8486f17a28e377557ea563d7e67
- SHA512 d73c8eb322c292901556fc551e419a0557f6431e16eb470c3e1c097c68aa38c163851d24434d9030eecdb5faddf909c2ee796dfe10472769a88260a84d4bc4de
- SSDEEP 48:YALlqfS0SwSSXhuSc3afo7XYEgdKsGgmzsW4swOsnQbWzsxascysjjKzsQ+sOjzB:D0DxvozaaIEgdwhwKbVehjKRMPuHm
- TLSH T1B7A19BF7C3E8856E8A1256F5AB157E1BCE6D0924431C3C6589D4AE4B93F2872E20079E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2081bb97c505a10b72a73915f66041f2ea00afa0b8f47d91d7452ea082959325
- MD5 7546540fb3b3280c421fcd7baf6ec311
- SHA1 aa42d70f31b1d1e666cb0dce49b46b967161199f
- SHA512 ad2077c6b8ab02164efdc7c5af57defdca1ddb3aca3043b85a108e0149927d955a96187ba0876d0cb6ce6c5b46d07777808dae01fa2936c374490761e0f53e2a
- TLSH T1F251AEB3C3E89A7D890196E4A7257F2FCD690A14631C3D5AC8D49F0F53E19BBD20064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 dc48857d421fd383afe0269e566b1f162137feb09cdbea1b39240d8f5421f0b7
- MD5 ccf89f595239f00edf3325662b2abfda
- SHA1 80e03cb8ca2ad3236bb63ab110b2927b8bb5af7e
- SHA512 ab02b63d2f43e81b31cf8d20810f45283beb8387b814dc103886313193c4e26861bbaa5c9fbb2b4f9b6a023a706b496cad46a0ba8a58a12a28b9630971992434
- SSDEEP 192:KRDLUGQ3xPqCv7japAPRp2ol19mHsb+WNnm01m6B29LBITbHNUX3VyIsnAUgtaJ:KRDLiwOaUXrIwjh2JBE5OR8
- TLSH T12042E82EB914697F5CDBD229F9667B17DBF5202124D02E88EAFC8E2C14DB6CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 5519713f3867ef0054c638d66d536a584b7c43667698ccc5532660c100b8e924
- MD5 3010d44f107a743b2959381543333cb0
- SHA1 0c58ae1f82d0d26a9219ca40b54e667b4e5a4f0a
- SHA512 217a4a4ebd37967e3cd3b6457e1dcaa65f0171cb97e92e196185882c573c17224aefa40af694242475c46ec4a7354193d7aa4154790369ce484b8ef7f670eeec
- SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLc8IpXODGJ+ErU3DcHG8aklgfPPN:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7p8
- TLSH T15D720AA76C4C9A7B0F94CACCC8177F4FADB5015B65D9886493FB582603D4BCB11091EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 ffa717daf63a4cb9b404a50ebd190de20b7801a85dd09c49704804ed4adabb09
- MD5 7b6de7d39505afaa10d6025167dd7a62
- SHA1 dc8b3be40964afd032402c762c54466446dc91e5
- SHA512 fa1f1d9b32f56efdec1177942bd58e57e858dd1b2b37d9c6db0e6f61eae09be1c9b9fcac483288636c77349d9d6c381f365700e642c3513ff0551c2b079409f9
- TLSH T165B0125190035901C44302F815923888311A9F108B05170363E469719D361914414550
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dbe4.TMP
- Size 96B
- SHA256 3d193b8bd9b0c4eac1eec7599584f221996154d5525b27f7882c01ff27b51557
- MD5 fac2d425c05863341d10435772fd99f6
- SHA1 232bf0fc803a757b5253b77b7e37f8a4839457d9
- SHA512 8596d754087d1436f6f35e30e5b1470234fadd040a989cb10f80c8effe07b474578725dae500420264b0282b6c20eea3633c50ab351ad982a47a6780b5589524
- TLSH T172B02200CA02220BC00203B028C8ACC83020FF28CA03020282E00AA2EC302200830022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 95839db153cb745f6c7962b4ab63d8eab023f03e9fcce6ee17c9c3c3c7450498
- MD5 2d67f88d5c781349f7c241472af8d39d
- SHA1 74157ee4925da2899f49b81eab13faa185a55bd4
- SHA512 826d798283fd2b72787a32656e71969a029dcbb2dc8dc9e805a34ce7124671858d34efbbb26b32ce4e0f1a16a17bafbdd41f589ab62617fa670752c84806ee57
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OFpX6jq2Vump2wkn:jeuvBnhJsueMEGvIW1DcP2OjcVump2nn
- TLSH T178D3974B3A743102EDE59A721CE051BB5E3CB16D8F5595D428B620688EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 38d88ffc03dc17634785fb2cf85260c7aa5f066ea994ef007fbdb59810e65fb5
- MD5 4cc775a1feeec751583fdb22fc4fda83
- SHA1 a8503512283b76282171932d8fea76f0bd9fcf44
- SHA512 a5eb637244e3d3d5257362a74b38d6de1d7aac108f77f1a71ca9062a725513176ececa68d35d719dea970ebc4b56bf67c004928caf5512ba53423dfdbdfc575e
- SSDEEP 1536:0u9dChUcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jP:0c3Qw/xLANk0mUW5GmRntSFCjEENj
- TLSH T1B09312BA9E1A45E795BE46D1729E7809CE13130D709FA9CC7258538C21D41CD2B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 c5fb0482d658e069dfec14e61aaa236923d5ecb44932820f8ea0edd23af638df
- MD5 f8836a8667e59ac6b850041a2797b274
- SHA1 b9721831865f66607995b715931676850ca79f1f
- SHA512 23a56b53138502babd5d2516bb9b2ba5888902099d5c7555cb79bd2e3ce01437c29ddb38d35406c45632d4b65bef2f46abae713841559ae907cacb81388e9341
- SSDEEP 6144:0KlRUhDlUtHJhjkeM4CBrOk0HOGm/SFyEEnd:0KAhhUtjOBrOjuGdF2nd
- TLSH T10C1412BB490B0FFB9E7D81B1749F5D09CF27429D70FBB4941168B2CD728558A2B22932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 b3403a1a52a55d6427b071f2eb06b51fc08a3a6d294aad93490565f6cf07783e
- MD5 276572a95ece39725e70341a69f2bab8
- SHA1 6a910cbf4081699c4ac0818265358e64afdcdb49
- SHA512 479517e08c1a6356a952a3d5d01bbf24f07d71ce709862d21524d0cba06149cb849409006564c9abb843a9ab92ab25686f5d5ef9dbff6ece9dac9587715fb915
- SSDEEP 1536:0cCgcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0k3Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T1099302BA9E2646EB957E468176AE780CCE13130D70AFA9CC715C639C21D41C92B72F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 200KB
- SHA256 54161b564788c59fc585c7a83f17f0db874de4b2091318ce74da778ded746619
- MD5 33f579222f2cb3c6f89c508be83e758c
- SHA1 4c0ef9d8eb1de2a2339db701b2414cb22cbc6659
- SHA512 da1697ac34e745cf2e7ace67b73b93850964e39e2ea8dfc3525310091a66df52486b75afb08599bff6683a7f2a95cfe3dd16906ddb0ded973583b19076483a4d
- SSDEEP 6144:0O9lRUhDlUtHJhjkeM4CBrOk0HOGm/SFyEEnd:0OAhhUtjOBrOjuGdF2nd
- TLSH T1E51413BB58070FFB9E7D85B5705F2909CE63539DB0FAB488215CB68D72C91461F22932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\crashy.io_chromes.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p3itgb3e.ocn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 242B
- SHA256 61ace6af6eeeba41b50156af86ddaadf3796c37510ffbbbaf4b931ac75bb4489
- MD5 aa78ce1343946a29fd83de4c583c8404
- SHA1 a727d578c513dc8ed38af0e76117c119de58b84f
- SHA512 c6b7271a21c3d43c87f97e9ab1501bd7dc5e61c810baa30d3aca114176ad1add71a3618042ce0857750d94ff494bbe1a08b29c18160c752ca3f0a09d549a472e
- TLSH T1C1D0978BB20DC6AC0000123B80F38D4DEDE5482C3B13BE306AA0DC4D328088089F6143
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 243B
- SHA256 e83f50c1d38362deae507d5c009789242adc26aee43f602fff14f7384ee2514b
- MD5 c7e430664ae2921a1c748179ab49dd55
- SHA1 d440d1ae3210e3059f67a7fd833efd0c4b31c7e4
- SHA512 f5b0b001a89b4ccfeeedb326fb58b288ecef41c4bec6c6060adeed7d542198c2ab9e43883b4db5c765a42299f0708893794efd1d73dde966ebec682ae35deb03
- TLSH T185D0A7DBB24DC6AD0001567B80F38D4DEEE6492D3F23AE30BAA5DD4E368188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 118KB
- SHA256 2bf634345bd546293014b1408b4b646cf65dd9578f597e20b1ad7b4a6ed71c3a
- MD5 8331131b000221320fa6ba47ca4b2260
- SHA1 f29544e3578db13eba23edc58146bb283bfccd5e
- SHA512 1270c8dad1e05465051fbbf4fb91cfaffb033ddef2f424f4c4e95b5af0a06e80e5dd6608c59704b5020ed42ee66d0919e3fb19e29b84e0bcc833a87885a6cad7
- SSDEEP 1536:Z48m8CzJeeeeeRfWrG67r3Ll7DPzP6cNeaj0qUiGTES00te/fDypP7zYt:CmCefw7FvPzP6raj04GTpzeQT6
- TLSH T1C7C3B411C6F79E2B05965EAB091627D0F428BBA4D6ED84FE50F2AA73F0634B7C31D205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 118KB
- SHA256 3bc689ab200068b894b78543ae41bda058918a687b1f2a6093f77be70b524392
- MD5 7714edc54d5328dc482a1a09bf0b16b4
- SHA1 9767bd055d1defbe2b3c3bedcc9ab050d1af20e1
- SHA512 a75270b40dfa89cb47369c6ce2af7b3e8a4051235769a3cf2f0d851b130a8a42227e3a96648f5a16b587951e796e7a1d2038dff052a46013698c47a2fa4cf0d1
- SSDEEP 1536:K/48m8CzJeeeeeRfWrG67r3Ll7DPzP6cNeaj0qUiGTES00te/fDypP7zYa:jmCefw7FvPzP6raj04GTpzeQTN
- TLSH T1C5C3B411C6F79E6B05965EAB091227D0F428BBA4D6ED84FE50F2AA73F0634B7C31D205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 e7b64f2670a74da784a3c7ebbd106a1078757b94ca05b2c78331f0b19d8be48e
- MD5 fc7b84002ecf3b2e1c5f0a8daa008812
- SHA1 f3ec648cec5f66504cdfcd94c1ad89fcf71da340
- SHA512 27d66c4f7ce8a5fabc6d3fe2b063a167549f0bd0930933706813ef4fae070e6bf22a507c079bcd9193c08bd2712261b52ddf871d50c74b8b3bc5b32440877a44
- SSDEEP 1536:WVgu+QO0vB+kVwGXvD4GL4tEXGblfLFucq:WSu+h0vBFw2Dr4tEXGJfLFux
- TLSH T11833074477F94611F1BF8ABA48B186019B31B8979C23D79E0AD5058E1AB3780CDE8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH