Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/05/2026, 04:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
zeroswap.io_chromes.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
zeroswap.io_chromes.exe
Resource
win11-20260130-en
windows11-21h2-x64
43 signatures
150 seconds
General
- Target zeroswap.io_chromes.exe
- Size 50KB
- Sample260510-e91zhaby6m
- SHA256 3d0e83cc665802bfae3b53bcf9ba7191cc7aab1e71b93f479e8d6cb03eab53d6
- MD5 86f48d8f2214752ecac42ac4a3bb1800
- SHA1 12d8c00a82c2c2bcbd3bd59967abc3ebce3af4e3
- SHA512 5d1859db319a8c39dac7f4c8a6cc67c930ef4b6e275abd69175c14e6b6592a087901f10ea117b28722c6f52f6b0deeaa8b9a8950f4e933f7192a2ef93d519f5d
- SSDEEP 768:gdZRdbpCB2X4cB7o8JF8Uo/P/RgL46C1XXGblfppqKFc5xB:UZ7IBjm88D3CPGL46EXGblfLqucV
- TLSH T1BA33F74477FC8111F1BF9ABA89B185119B31B8A39C22D78D0BD9058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4612-0-0x0000000000470000-0x0000000000482000-memory.dmp disable_win_def behavioral1/files/0x0007000000024860-2338.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" zeroswap.io_chromes.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" zeroswap.io_chromes.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4456 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zeroswap.io_chromes.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts zeroswap.io_chromes.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe zeroswap.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe zeroswap.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe zeroswap.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3580 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation zeroswap.io_chromes.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf zeroswap.io_chromes.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf zeroswap.io_chromes.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf zeroswap.io_chromes.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe zeroswap.io_chromes.exe File created C:\Windows\system32\sysupdate.exe zeroswap.io_chromes.exe File opened for modification C:\Windows\system32\sysupdate.exe zeroswap.io_chromes.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3252 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" zeroswap.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" zeroswap.io_chromes.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5076 sc.exe 5880 sc.exe 5908 sc.exe 636 sc.exe 456 sc.exe 5200 sc.exe 5784 sc.exe 1512 sc.exe 6048 sc.exe 5764 sc.exe 3164 sc.exe 5148 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2652 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5028 ipconfig.exe 1572 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4156 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2328 vssadmin.exe 5724 vssadmin.exe 4688 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\WallpaperStyle = "2" zeroswap.io_chromes.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228615937869761" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command zeroswap.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open zeroswap.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command zeroswap.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings zeroswap.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open zeroswap.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.pdf\ = "PDFBotnet" zeroswap.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe" zeroswap.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet zeroswap.io_chromes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell zeroswap.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command zeroswap.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell zeroswap.io_chromes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\zeroswap.io_chromes.exe\" \"%1\"" zeroswap.io_chromes.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell zeroswap.io_chromes.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\DelegateExecute zeroswap.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open zeroswap.io_chromes.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings zeroswap.io_chromes.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2036 schtasks.exe 1980 schtasks.exe 4844 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 4456 powershell.exe 4456 powershell.exe 4456 powershell.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe 4612 zeroswap.io_chromes.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4612 zeroswap.io_chromes.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeDebugPrivilege 4456 powershell.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeIncreaseQuotaPrivilege 1552 WMIC.exe Token: SeSecurityPrivilege 1552 WMIC.exe Token: SeTakeOwnershipPrivilege 1552 WMIC.exe Token: SeLoadDriverPrivilege 1552 WMIC.exe Token: SeSystemProfilePrivilege 1552 WMIC.exe Token: SeSystemtimePrivilege 1552 WMIC.exe Token: SeProfSingleProcessPrivilege 1552 WMIC.exe Token: SeIncBasePriorityPrivilege 1552 WMIC.exe Token: SeCreatePagefilePrivilege 1552 WMIC.exe Token: SeBackupPrivilege 1552 WMIC.exe Token: SeRestorePrivilege 1552 WMIC.exe Token: SeShutdownPrivilege 1552 WMIC.exe Token: SeDebugPrivilege 1552 WMIC.exe Token: SeSystemEnvironmentPrivilege 1552 WMIC.exe Token: SeRemoteShutdownPrivilege 1552 WMIC.exe Token: SeUndockPrivilege 1552 WMIC.exe Token: SeManageVolumePrivilege 1552 WMIC.exe Token: 33 1552 WMIC.exe Token: 34 1552 WMIC.exe Token: 35 1552 WMIC.exe Token: 36 1552 WMIC.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeIncreaseQuotaPrivilege 1552 WMIC.exe Token: SeSecurityPrivilege 1552 WMIC.exe Token: SeTakeOwnershipPrivilege 1552 WMIC.exe Token: SeLoadDriverPrivilege 1552 WMIC.exe Token: SeSystemProfilePrivilege 1552 WMIC.exe Token: SeSystemtimePrivilege 1552 WMIC.exe Token: SeProfSingleProcessPrivilege 1552 WMIC.exe Token: SeIncBasePriorityPrivilege 1552 WMIC.exe Token: SeCreatePagefilePrivilege 1552 WMIC.exe Token: SeBackupPrivilege 1552 WMIC.exe Token: SeRestorePrivilege 1552 WMIC.exe Token: SeShutdownPrivilege 1552 WMIC.exe Token: SeDebugPrivilege 1552 WMIC.exe Token: SeSystemEnvironmentPrivilege 1552 WMIC.exe Token: SeRemoteShutdownPrivilege 1552 WMIC.exe Token: SeUndockPrivilege 1552 WMIC.exe Token: SeManageVolumePrivilege 1552 WMIC.exe Token: 33 1552 WMIC.exe Token: 34 1552 WMIC.exe Token: 35 1552 WMIC.exe Token: 36 1552 WMIC.exe Token: SeBackupPrivilege 5148 vssvc.exe Token: SeRestorePrivilege 5148 vssvc.exe Token: SeAuditPrivilege 5148 vssvc.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4612 zeroswap.io_chromes.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 2760 4612 zeroswap.io_chromes.exe 85 PID 2760 wrote to memory of 4512 2760 chrome.exe 86 PID 4612 wrote to memory of 4456 4612 zeroswap.io_chromes.exe 87 PID 4612 wrote to memory of 5880 4612 zeroswap.io_chromes.exe 89 PID 4612 wrote to memory of 6048 4612 zeroswap.io_chromes.exe 91 PID 4612 wrote to memory of 5764 4612 zeroswap.io_chromes.exe 93 PID 4612 wrote to memory of 5908 4612 zeroswap.io_chromes.exe 95 PID 4612 wrote to memory of 636 4612 zeroswap.io_chromes.exe 97 PID 4612 wrote to memory of 3164 4612 zeroswap.io_chromes.exe 99 PID 4612 wrote to memory of 5148 4612 zeroswap.io_chromes.exe 123 PID 4612 wrote to memory of 456 4612 zeroswap.io_chromes.exe 103 PID 4612 wrote to memory of 1172 4612 zeroswap.io_chromes.exe 104 PID 4612 wrote to memory of 5076 4612 zeroswap.io_chromes.exe 106 PID 4612 wrote to memory of 5200 4612 zeroswap.io_chromes.exe 136 PID 4612 wrote to memory of 2328 4612 zeroswap.io_chromes.exe 110 PID 4612 wrote to memory of 1552 4612 zeroswap.io_chromes.exe 112 PID 2760 wrote to memory of 5312 2760 chrome.exe 113 PID 2760 wrote to memory of 5312 2760 chrome.exe 113 PID 2760 wrote to memory of 2652 2760 chrome.exe 114 PID 2760 wrote to memory of 1540 2760 chrome.exe 115 PID 2760 wrote to memory of 1540 2760 chrome.exe 115 PID 2760 wrote to memory of 3544 2760 chrome.exe 117 PID 2760 wrote to memory of 3544 2760 chrome.exe 117 PID 2760 wrote to memory of 1896 2760 chrome.exe 179 PID 2760 wrote to memory of 1896 2760 chrome.exe 179 PID 2760 wrote to memory of 4240 2760 chrome.exe 120 PID 2760 wrote to memory of 4240 2760 chrome.exe 120 PID 1172 wrote to memory of 5904 1172 fodhelper.exe 182 PID 2760 wrote to memory of 6140 2760 chrome.exe 124 PID 2760 wrote to memory of 6140 2760 chrome.exe 124 PID 4612 wrote to memory of 3676 4612 zeroswap.io_chromes.exe 127 PID 4612 wrote to memory of 2036 4612 zeroswap.io_chromes.exe 128 PID 4612 wrote to memory of 1980 4612 zeroswap.io_chromes.exe 131 PID 4612 wrote to memory of 3964 4612 zeroswap.io_chromes.exe 133 PID 4612 wrote to memory of 5724 4612 zeroswap.io_chromes.exe 135 PID 4612 wrote to memory of 4932 4612 zeroswap.io_chromes.exe 138 PID 4612 wrote to memory of 2508 4612 zeroswap.io_chromes.exe 140 PID 4612 wrote to memory of 2468 4612 zeroswap.io_chromes.exe 142 PID 4612 wrote to memory of 3580 4612 zeroswap.io_chromes.exe 144 PID 4612 wrote to memory of 4588 4612 zeroswap.io_chromes.exe 146 PID 4612 wrote to memory of 3632 4612 zeroswap.io_chromes.exe 147 PID 4612 wrote to memory of 5868 4612 zeroswap.io_chromes.exe 148 PID 4612 wrote to memory of 5164 4612 zeroswap.io_chromes.exe 152 PID 4612 wrote to memory of 5816 4612 zeroswap.io_chromes.exe 153 PID 4612 wrote to memory of 1544 4612 zeroswap.io_chromes.exe 154 PID 4612 wrote to memory of 4844 4612 zeroswap.io_chromes.exe 158 PID 2760 wrote to memory of 2016 2760 chrome.exe 160 PID 4612 wrote to memory of 5784 4612 zeroswap.io_chromes.exe 161 PID 4612 wrote to memory of 332 4612 zeroswap.io_chromes.exe 162 PID 4612 wrote to memory of 1512 4612 zeroswap.io_chromes.exe 164 PID 2468 wrote to memory of 4304 2468 net.exe 166 PID 1544 wrote to memory of 1572 1544 cmd.exe 167 PID 5816 wrote to memory of 5028 5816 cmd.exe 168 PID 3632 wrote to memory of 3252 3632 cmd.exe 170 PID 5868 wrote to memory of 2624 5868 cmd.exe 171 PID 4588 wrote to memory of 4156 4588 cmd.exe 172 PID 5164 wrote to memory of 5096 5164 cmd.exe 173 PID 5096 wrote to memory of 4412 5096 net.exe 174 PID 2508 wrote to memory of 4688 2508 cmd.exe 175 PID 2508 wrote to memory of 864 2508 cmd.exe 176 PID 2760 wrote to memory of 1252 2760 chrome.exe 178 PID 2760 wrote to memory of 1896 2760 chrome.exe 179 PID 2760 wrote to memory of 3720 2760 chrome.exe 180 PID 2760 wrote to memory of 4420 2760 chrome.exe 198 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe"C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://zeroswap.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c3ffc728,0x7ff8c3ffc734,0x7ff8c3ffc7403⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,4997189832930708794,11478716418223068465,262144 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1996 /prefetch:23⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,10185455316961290994,8960282856146293720,524288 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2232 /prefetch:33⤵
- System Time Discovery
PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,4567336598699638155,17667351015154317406,524288 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2340 /prefetch:83⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,2686534300574750004,2581923717058919600,2097152 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3144 /prefetch:13⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,15038611356564006736,14589266111065585174,2097152 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3192 /prefetch:13⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3808,i,3535418484710673793,5074206004203251323,2097152 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4404 /prefetch:23⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5068,i,6262112498553304111,18124756838241622169,2097152 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5084 /prefetch:13⤵PID:6140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,13512986189167264794,15520116126999816818,524288 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5472 /prefetch:83⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,6630230070132314195,7344286903751653400,524288 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5564 /prefetch:83⤵PID:1252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,13000391795324404378,14320560687457955850,524288 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5576 /prefetch:83⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,10316012423236973103,17423683027496693213,524288 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5636 /prefetch:83⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3148,i,4420084514179022358,1918622401599169533,262144 --field-trial-handle=2000,i,17711157395756772603,9458461530331883806,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4408 /prefetch:83⤵PID:4420
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5880
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:6048
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:5764
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:636
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3164
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5148
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:456
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe"C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe"3⤵PID:5904
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5076
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5200
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2328
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:3676
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2036
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3964
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5724 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5200
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:4932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4688
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:864
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4304
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3580
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4156
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:3252
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\system32\whoami.exewhoami3⤵PID:2624
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4412
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5028
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:1572
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4844
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5784
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:332
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1512
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5392
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exeC:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe1⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exeC:\Users\Admin\AppData\Local\Temp\zeroswap.io_chromes.exe1⤵PID:4640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5904
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260510_054143.jpg
- Size 118KB
- SHA256 d9c4180a1fc67a6d0245c969d29770d58c51372fd3a2a4265bbb3cf8ebebc5ca
- MD5 ecf489de285f5080fbaeb4c363cdac63
- SHA1 28b0e50200e5a065a7b02d4537f7bfd1406e56a9
- SHA512 92815980e3ec354c0193edcfbaaf8cafecc66ef8291a44a469dd96f8cb08c4e72c0d4dcb0a22a59e59704080d942b093c35efbe286c2749ad419d3066b8f6055
- SSDEEP 1536:IzuRRRRRRRRRRRRY19vuN51NMLXU+c/XpvPMgcIKVE1+h0tnSYpdizsjtVQ8:mjPvu3rf/ZHlP+h0BSYf4i08
- TLSH T1C0C32B138C04DF83B41987E8BF570EA91B4B6708F5863AFA11224EDF3E516625DCA43E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 fcaa95347dd6448283defcdaa7f69df4a274a6214de4241135f07b36e9b0216b
- MD5 1f99d5c143b6a8a1e9d3055be39b19d7
- SHA1 3b7a7752e38b5d3c35e53ad5159341758cc0745b
- SHA512 a82bd33ebdaa20a2c6f458546ecaa185d41bc801f0b0492f508fb6bc28e215d09f4d94111010e90eb5000d337a0a52dc2b0294e3b26385f13003a36090f862c6
- SSDEEP 1536:5BU/YQ533h3RFbU2WidFp7tOKYE/n59wcdh6uPBJA8ezplLRSku1uJ6Vxv514Gby:5BUnp3hU2WCFrYEBycdsuazplCIS514b
- TLSH T104633C368B22FDC0677E2D40E05039561C893F6B97B56678FAC50DEA28E6980DF2E45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 b97cae3f0d9461866ac83b3e16c84ab9cf28f9556cff4de121bc8a830b3138ac
- MD5 72a2a86c3c7534e4fd07daede2957874
- SHA1 94c1ea4f0ca3eda61c6e2ce7c2d425a98bb079a6
- SHA512 fb929157bb20d443302a35f98d0402ecc970a4a96b98493d8c3d9423596eaf86fc7c04150bdf5725d2b75b3d3600c1c08463ca55877aa7076deaf007ef5b8833
- SSDEEP 1536:ZBU/YQ533h3RFbU2WidFp7tOKYE/n59wcdh6uPBJA8ezplLRSku1uJ6Vxv514Gbl:ZBUnp3hU2WCFrYEBycdsuazplCIS514S
- TLSH T105632C368B22FDC0677E3D40E05039561C893F6B97B56678FAC50DEA28E6580DF2E45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 39cfe9905283e75a325cf91d93b240236ad96d0ea8e2847d022891f24f588579
- MD5 07c8200742bb9c10398d73b816e00c28
- SHA1 e3b78e386b7f0f9d54ab87c642345cc6a0df542c
- SHA512 8d70e3f7d3f071618e5708830321e958b5e71539d0ee8fde55c77c0686f16985f629a425544769cc50d1cc16e180c5e5df530dd64f90224a960ef2865ac9efbf
- TLSH T177E02BAEC821EC2B45FD171954500B85E75417973B90594F7B3DC3088FB457F058685C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 456B
- SHA256 4b36c1674cfeb33b2cfe08446f561418081c6b9048e1cea0ff656b6f6e789493
- MD5 27a197e950777fd817d69d4bd1d5e02f
- SHA1 27fb3b2b51751bdbc1f95efaccfd8c774c1fb66d
- SHA512 f596fd45e1449f65a792e221bb1f25abf9f7e4b56518c9eb2e9f55ec8929dc39ea72685e463d877112d6b55b411262afc69994c392647a95e2a9f284043030a1
- TLSH T10AF0263E96CCB6B1EFB4C2F29CE50F16E29221B803C64F23846901E091F7EC16E44041
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 baa973c603b2c76962a8785606fd5a685533d75f8c0a3d2a6d7430bf0a3a01a8
- MD5 78ba85f6622dd27d0d34cb65175bf4e6
- SHA1 f85bf2d1ca8f82ee8e174af22df09f0ece387c97
- SHA512 c963bbbdcab486e82ce52e1fcf62efc9c547a2295f79a94da9119893c8e42d60540da347f1b6c5d6d4b467908047f30901250f962bcdd4a212be49565d4e72b2
- SSDEEP 96:3J74/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0K/p:3J74/tH+bF+UI3iWGVYWNkqp3XR
- TLSH T128F30B1E6F743312CDFD927668E345A7587CF03F876326C56C6514B1CEE2A52A02C4AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a1a18a12200907dcefb453059cf04c494a0c4a02c909cdb03b97d377de420df7
- MD5 e306fdc9957039e843c255c8a2616c93
- SHA1 106c256f9195b9c819d29534eb1f4523a6415792
- SHA512 e96d79fc1cc9192b3ad33dda5e10651ecc0266c4347317b9e396112712c4f766945d823607e14fb2d215520e58fc85b20a92b96f2a6adec6e31ceef5ead1b721
- TLSH T190518EB3D7DC967E890156F49A243F1FCDA90A64631C3C56C9D4EE0F53E18B6D20064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 f33b1e127979c194cc86a5629487e3add352c558db5e3ab8985a447ce891e72d
- MD5 e96ba0cf5a0f8eb54b13b7304dd7d78c
- SHA1 572470a10205184e7c49c5c899d2d3e53aee328f
- SHA512 2c170ac3eebf283c1694f3dbdbd73b03c4925b118b5304ee2c9664b9426568aabc603703b4e70bb267df608719d23d8469b87a20c2a1d5adb4c138889e830aad
- SSDEEP 192:D03OYIZvKPaIEagdmQN1/rzE5SjAchsMUsGvqCX6zp4:D03OYIZvKPaIEagdmQN1/rzE5SjAchsz
- TLSH T1A5D18AF3C3E88A2DC81151F5AB243E1ECE690924472C3C6A88F5BE0B67F2875D25174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 1d47e9648aa48692775a7d6b2419b31a02926707fc0952633ca605a42c75c023
- MD5 5923489408bb4e218a98a888f4543588
- SHA1 0c55e3d7dce1aec84079dd03630f5f0f409a77d4
- SHA512 95456339a1bb3d782a45481f999ab98c0887eed76a0176c2a053feca3b4b14705e1bc90f186d7841ac622df4e683b44cc64eb8384872ab7b7d3f45d75541ce8c
- SSDEEP 192:lRDprJVAE5RKv7SpAPRp2DlV9QHsb+WNn4VLxG2MZd2Yec0a3D6VyIsnAUgtaJ:lRDp17GeUXEWweM262xaG8
- TLSH T1CF42D66EAA54353B5CDAC22AF926775BD7F5102160D41E84EBFC8A3C29E75CC322701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 2c95ba5cea8a4c55f3dc473702e23be116183f57482bc38defaea731c0fab60a
- MD5 8c54a51360c5227332ae5b211e674c95
- SHA1 37fc294b8d47979bc64de70e5d9286cdc872a85f
- SHA512 72ef8f3e180dadc704f06076e623a6db4304ee6883f61623df25c8bc2b8110f47d31faf2ccdc681cbfc1c661886df661fa150a811c93e2a66f82ccf09e13f159
- SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLc8SzXODk7+ErU3fFHGA3Oc:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7p4
- TLSH T1D972EAA7784C9A770F94CACCDC167E4FADB5024B65E9886482FA982503D5BCF110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f662f615714362284f4567b4eea29e4234e25f1f\index.txt
- Size 137B
- SHA256 fb62c74f40e1a728312815271c5f17c744a77f65b1762914485b84bd241e53ad
- MD5 0fc68ba5b356775cb93c79d4093595c2
- SHA1 ebdda3a86fd3bf973741294d1f1805e4dc0e18ce
- SHA512 f2a762c633153d7bd8f389fc03f7efc5de376412945932b42539e90573801bc9961e4e8fdae47098a4549d09662feb01aff28bab95b446622434f0068a2fcfec
- TLSH T1BCC02B67201D6006FA5FC7C189003B4CC39B53CC0DF294504832E015D5018E036F1D8B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f662f615714362284f4567b4eea29e4234e25f1f\index.txt~RFe5924a5.TMP
- Size 144B
- SHA256 ce07bfdab549addf2abd31f174d8f5f79c45123b75cb47bb2e2d41a4c7b771d5
- MD5 7d96a30aea8c9038ba781836408aa28a
- SHA1 3925530109f5b76fdd36077bea829ef54fb693e1
- SHA512 0f8dcbff15b35b2fbc8cef934940e3941ac85d598af1ee4972a1b4af9a0889eb9571b1236c5bbc77aed7882ca9799687467b1770eec36f492173e125d4e652c0
- TLSH T11CC08C27202D1006BA1B82C289102A8883AB4FCC0DA294108C23B015E1314E066B0E8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 f974fa28aeffb6a1861d698b53f38485aa091965184b8ea62cd244d8ad355b5f
- MD5 bad90f218fc70b3164b4f1463170bf45
- SHA1 e1c51a0361753b898248a976898cec65083856fe
- SHA512 4126dc7f8506a6c73796b15e8e39f81bc28de521852280f86c9b6ef0ccccabc508b511ee7e462da3e134bb1ec3db934296fcc9d66f12860087cc0228ee2ed672
- TLSH T1DCB01291C082D122C01503F42984849C7338FF10CA0A230771E82786EC3526006141C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 0b7d5f730bfe4a97f08e2d160a2b4da7396f88d438a4f2bb34309f3df71c863d
- MD5 34ec5dd58e310622dc7320e1fc1f6830
- SHA1 37d86841c2b045d09c0a7afb5b2a788950441e35
- SHA512 004ad562566be58b58a69cbe990d9235f15455af459b5965c45b832844940ce041e4d1ae73f67eabb6ac280399cf693e11be89e4363da975bbd923233b0a6700
- TLSH T177B0126480029603C05303F51186149879649F108706130153F0A971986E3928518150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 84262999a8f1d3d307df438f5e37748a6832e478d711631db43c82911d5c48d7
- MD5 8cb1c11a686280455aa810853f247a29
- SHA1 e7dab37b8593f3da373e54f5c8af2e0c0acf6102
- SHA512 f21b55120780704aa104a6bca36e8dc8ee9a2ebfa40e97245e484efe4e7979c6537ac6965235f9665367aa2ca1d3aeccedb6d587faa09954ae7565f29796f044
- TLSH T12BC01251C415A131C05603B81C8AE8DC7258AF24D705235C96E91A3598B93324825159
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58508c.TMP
- Size 96B
- SHA256 1d963ef1f022d25947f0b440fff66a4e6e11f5691f2f124edd15eed5683dea34
- MD5 8c4a6206d511807138192e264835e8ea
- SHA1 d4a9e1dba2b17eac172501331241f61255bc9c58
- SHA512 6251164f2910ebaa220129254bdee8b61e11a5af2f24bef84746e2cb6a361f1c5896818d43d84414360d7352e8d0cade63fdf39e8c99282d9edda7419626ac74
- TLSH T1B8B02280C0033303C08303B028A08BC83020CF20C2030202A2E00A22CC2832002300A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 bfe1339a81ee1098d912f1201b8c2be13aa14d3175a0b39e50446acf284f923a
- MD5 a2363375581ef1be4e2a880c959df413
- SHA1 5d764b28514c8320435d12cc129fd5be92b4fa7a
- SHA512 7ba4b2f463dd16f16f0bc91b4aa6097902b5d14b4a14e3027d258bc7c42c0386bf7e4e73421c0678dfd81f303946a827199b95e32cd2b22a9134b1495e2b01c5
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Ox0dVumjndM:1nbZeMrv/hGtxendM
- TLSH T154D3984B3A743002EDE59A762CE055BB5D3CB16D4F11A5D528B620588EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 202KB
- SHA256 3e9dc420d09218f18a731a1adfc193e4c1cf4494766cfe8ec8867d28a254f0ff
- MD5 ac3c7f0b9f3948adcc7ce948f0325daf
- SHA1 17d00e7b47a8875fbdc80164bf7727c9322f2ad6
- SHA512 9c106ce5a20328223fa60521d686ff10ef520f0ec10a94c5242de86c0877f4008d44973dcb46609266567dcc798ff774b464099fef100a546ec8d9577fc7ecc4
- SSDEEP 6144:X8JdJxyATKB2qIMkv/LOXDZrOk0HOGm/SFyEEa:Q60KB2qIXvjMrOjuGdF2a
- TLSH T12D1412765F190CE2A6BDD5E67F08700D8D1B6347A28EBC8C4159734A36CA2893B73D93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 b2db8f30c50c43c3e8ce1b639250f8c74d850d31aba75eaaf49b7b7e06523ac0
- MD5 094a1e99d5f196c8e421c2989a35d2fe
- SHA1 472e7d3a361a20dc7279d9fef7bf5eb707d93cf9
- SHA512 5362b1405672ebee999d79e6be7386bab346503d52b8238b040518ac26c7af8ef7772b13619c24a79181df26821fc7f5f8b9d9d362ac4db724434ff6e99adda3
- SSDEEP 1536:s3jlrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:Sph3Qw/xLANk0mUW5GmRntSFCjEEND
- TLSH T1F29312BA5E2606E7957D4AC176AE7908CE12130D709FA9CC325C638D61D41CD2B63F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 10adc275e2d188a61b97dfcdded1f56bc4dde03b8f68d8a7fdf2f2ce0ba2f6b0
- MD5 ee16a9123b4b6956117524e1ac5d72a0
- SHA1 a9dbbd8646a25475873cdc65bad8e0b0d1f5c189
- SHA512 b62fae88554d0ed4b85a5d5c5a08b52d7b8a3db1e622b7cc2c2ee1a4c251442423a7eef6729b57a9d0f8bd2200df800b808bebe9818e623e2572de3ca7bbc454
- SSDEEP 1536:2kE3M2cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRk:sH3Qw/xLANk0mUW5GmRntSFCjEENO
- TLSH T12C9312BA5E2606F795BA46D1725E790ACE12130E309FA9DC32A8138C61C51CD3B63F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 39ef1b8bbd3b810d032e6642cef8b85f079244cdba1b8fd3f4b201b6eb641862
- MD5 f84f6549adfd063793c2903c426df83d
- SHA1 01a83ab1563c294abef04e3164875d3e8fc09148
- SHA512 4b0eff4605aa552ef25b866194c44800f9097f2f0225c1da7cf34dba4605245e447c3c9fa435a5ac6695e2c4b53465bc9a8832fc477abf2c260b65511d0b9a63
- SSDEEP 6144:XidJxyATKB2qIMkv/LOXDZrOk0HOGm/SFyEEa:M60KB2qIXvjMrOjuGdF2a
- TLSH T16F1412765F190DA2A6BDD5E67F5C700DCD176303A28FACC80159734E36CA2892BB2D93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\zeroswap.io_chromes.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nsqz4bn.za2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 244B
- SHA256 880c2495284e7a828c9590cc2dd399af2d0bf5b3db7fd22a026bbda97e535f48
- MD5 eb6f6887749df7e30c639aa3fff08814
- SHA1 ebb61a2f9b3ff5031875d402dccc8143dbc4fd70
- SHA512 1f285e6cce487eabf5a976993f10f190b72961d430e22390fc8ede58c0b3d0fdcc2e79c057b942f2d980b7f62078ffabdac5373bab1defd89ece7861a6830a13
- TLSH T186D0A79BB24DC6A90001127B81F38D4DEDE54A2C3F27BE706AA5DD4D369188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 245B
- SHA256 60a21763fc3501745ce483099f8c90f431a790c2a4fb4cf4aedce33be6fcce55
- MD5 325ab3524bb2e45892f6240b1fe3a9e7
- SHA1 2d3c86d9a7b4c4ec2cd96da0f4a1536b61e000e0
- SHA512 40ff297a05d8315bc24e7f523ff6502426c47cf965366535fdc7aeaf3f7eb8ba181e5d303a131e871e94d671432892db3e1107e6a51ebd20c7e0dba87b5dd835
- TLSH T183D0A5D7714DC5690001117B41F38D4DDDD1461C3F276D306565DD0D364184545F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 129KB
- SHA256 b3456072bdd52a67d92f0ea84eca5c09421ca1a61780600ec2095f724c7adf74
- MD5 30c227c4c0f86963e552ed9d5a66a84e
- SHA1 8043a4e2fdd10a7bb443903e39553e8be81353bc
- SHA512 20744d388278c9028a05b6b986c8ac404eb11187197a51be752de77f0663b49903fe049c18b26b00756f07490b041d022f6951f6b14e7a850fce56b715814963
- SSDEEP 1536:DX5H8960UvjLU15s8pCvOjUDILsSuPU4X3xJufxVtv4FOxidacQnqbBqeq8F5g4N:z5Hy60ojAKQCvbcLmTX3ruIQnq4UHg4N
- TLSH T193D34411C3B69E3A15975AEF185636D4A43CB7F083DCD1FB30A2AE63F062CE2C609655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
- Size 50KB
- SHA256 3d0e83cc665802bfae3b53bcf9ba7191cc7aab1e71b93f479e8d6cb03eab53d6
- MD5 86f48d8f2214752ecac42ac4a3bb1800
- SHA1 12d8c00a82c2c2bcbd3bd59967abc3ebce3af4e3
- SHA512 5d1859db319a8c39dac7f4c8a6cc67c930ef4b6e275abd69175c14e6b6592a087901f10ea117b28722c6f52f6b0deeaa8b9a8950f4e933f7192a2ef93d519f5d
- SSDEEP 768:gdZRdbpCB2X4cB7o8JF8Uo/P/RgL46C1XXGblfppqKFc5xB:UZ7IBjm88D3CPGL46EXGblfLqucV
- TLSH T1BA33F74477FC8111F1BF9ABA89B185119B31B8A39C22D78D0BD9058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 130KB
- SHA256 309acfa05a07c2036074d819132199b4e995d090d6071f329f3bc953f480d852
- MD5 e062ef068d9fa4cb86dfa6194a97de14
- SHA1 0f22c2862d5b2bd40cb1e975c7fb3b75641300fa
- SHA512 233d4ad0d8a1e01d9077eb5acebf5767d3c1c445c8cbd8b9234c1467816957eb2ca333fdb633c1121f1882b5fcf863477139307cd41b55716c97cd9d8c16bec7
- SSDEEP 1536:cX5H8960UvjLU15s8pCvOjUDILsSuPU4X3xJufxVtv4FOxidacQnqbBqeq8F5g49:Y5Hy60ojAKQCvbcLmTX3ruIQnq4UHg49
- TLSH T1D6D34411C3B69E3A15975AEF185636D4A43CB7F083DCD1FB30A2AE63F062CE2C609655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH