0f880fb74b057b8c1f0dc558ff9fbeb1c36461f248ff248e7f2f71417b1acdd5

Resubmissions

17/05/2026, 12:18

260517-pgp2msgs5s4

17/05/2026, 12:17

260517-pgh84ags4z4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PixelSee_id2051330id.exe
Size 4.4MB
Sample260517-pgp2msgs5s
SHA256 0f880fb74b057b8c1f0dc558ff9fbeb1c36461f248ff248e7f2f71417b1acdd5
MD5 7e855efdea75c7df881f693957dd02ce
SHA1 c1cd2d3a7f6dd9c35ef394b8cc55025ce500b712
SHA512 006f9c6386ed595538a131362396e0f3f1f24df1b37575fac90872a96eada419531dc5c5a133adddbad0a77f2a77d17dab3ed5921e9bfba49fa8a5abe60c7ab0
SSDEEP 98304:VMQ4z8ue2Vm/aD8reWJtDLLbLYqMcsB+RsY0wKErfuNVsR/h8UGlE:VEAue2VmW8KW/DLLbLxMi0wcER/h8U
TLSH
T12726B011FA058032E9D101B2E2AEAFB2893D9A34177644DB96D05DB599302F37B3CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	3800	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PixelSee_id2051330id.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\IESettingSync	PixelSee_id2051330id.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	PixelSee_id2051330id.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	PixelSee_id2051330id.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	PixelSee_id2051330id.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3800	PixelSee_id2051330id.exe
3800	PixelSee_id2051330id.exe

C:\Users\Admin\AppData\Local\Temp\PixelSee_id2051330id.exe
"C:\Users\Admin\AppData\Local\Temp\PixelSee_id2051330id.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 2132
  2⤵
  - Program crash
  PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Montserrat-Bold.eot

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\Montserrat-Bold.eot
Size 256KB
SHA256 7615a4bb88a5680cfead49c1774013ce48c4c7343cb82d7585f7935c705400b0
MD5 0f722e725ac50271f9d6db477e8c0d17
SHA1 d34259cfe05b2ba9c9e5256a3ce513d4bc5afbe8
SHA512 9a58e7d1537f28f19dc6e63b36d422748d851b68a8b3eedf69f531d502d9163e41f4d9cc9d782fd6fc70fab269f04dc9907422bd80f5dd265edcc0ae6bddc77a
SSDEEP 6144:IN9Fx0zc2Y4wjuhGmvPK1z3tgInaETMqvA:SZaY4na3tgInaEQQA
TLSH
T109443A1BB303D318D9614D358BA6F7E13378FEA13F1686CBE1752E69E89F1E95802244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Montserrat-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\Montserrat-Regular.eot
Size 314KB
SHA256 057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32
MD5 2dd0a1de870af34d48d43b7cad82b8d9
SHA1 440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e
SHA512 83df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff
SSDEEP 6144:9Z/Bu3n5921pv8hj+URIm4WFUh/ttOAA6eTMvf4BAYJT9xFyYcJLhzCx91SRkKoH:rUm16qURIm43xttOAA6eTMvf4BAYJT9h
TLSH
T1EB64F91BBF02530AF9110D315ABED391B314F9B67E1E870B90496E65FCEE0D90D86B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\Roboto-Regular.eot
Size 176KB
SHA256 6cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6
MD5 b9077621ce786b55c176a61456bfc077
SHA1 5f164e1bc0b6573bac876e38ca1bb2e60ff0627e
SHA512 b1f2c599804a2d0ac51d3adfe7b2d0a21c5fa1e3d8d83d932f42d30bfd26aad5972d96555097a60f8fdc4d34ed24bad2876a89cf0b27b8cd01c72c0ba8f4d02a
SSDEEP 3072:KT04ndyjyP3ngaWTj1UIW6/qFFdOzbuI41j3Sya03fYRX+57sLK2WY:KT0dsgo6wdO2ldfOX+lsJV
TLSH
T13E04F601EA42A619CAD5B6797D7CE3BE0D31D82DBD09602B70E5AF3015C9841EC5AFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main-icon-big.png

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\img2\main-icon-big.png
Size 975B
SHA256 81b5f50491579127d13e050847ef6d817265ab4b70d2796fb74021463b778bb9
MD5 0e5fea82cc4f4a8225532e5b2f45c6c8
SHA1 b163d952a4a5b0c3ea40da2b47f95e624e344c96
SHA512 051507296cd4d51ce4d34f0d1dd0a078f7598645ec42321335cec5719152c05dc611c663c67b3265e3baf14fd6e0c93788e2d0b04c6e5c16f4203dbd206b3f44
TLSH
T1BC1194B1D951CBBB0C230673604A25BED25000AC17227F180208FAD22E2994DEFBDE25
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\index.html
Size 38KB
SHA256 e61711a6ca75be19ca65a448eb4c38083670619a077c0c5538967bf97b577dcd
MD5 456cb505fba405d1c9a58dbeb2058968
SHA1 2b4d33c768bc1b4185a300d73a0bb257b6d01fea
SHA512 07617e06df66d5637be0e7fc6d804270e3ccc17ba321ef197935ce6d9f4eeef84753b0455b17e007bd6c4d2fa65830a6028074119ca1eb2cdb3dca236194e759
SSDEEP 384:7qyTa4RvSyngHV6Sm8lRl6Tcx7jzpa8FLM2nAkqb3IIqxZhZbL2QN6uqZSyAmxv/:7VLCIqxZhZZyAW1dpcok6CPT4
TLSH
T140034403735A1828A5BBB216A932439E7434C14B7B539E6C75EC15B2FFD5C718B2B2C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jquery-ui.min.1.8.0.js

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\js\jquery-ui.min.1.8.0.js
Size 202KB
SHA256 8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b
MD5 a4fdd77e182bd2fabe300a47b5617a35
SHA1 e002b335c75b5edefcd251962f61f53a2ab8e0f2
SHA512 ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085
SSDEEP 3072:WpAlcXnwc+NAdbvTdaVhr4aoaj7/cEItIwCkGWCs3T:WqaB+NuchrbrsEItImGWfj
TLSH
T12B14084D7245363A8AEFE275102F260A723391599601C06CF438D9DEAEBDE44217FFB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jquery.min.1.6.4.js

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\js\jquery.min.1.6.4.js
Size 89KB
SHA256 4a62927a380e201c4ee51321dcc1e6b1f7dfbf82049cf349df990629e01e9178
MD5 ea75b2a8f1b4241a872b1cbddbaed154
SHA1 18678dd78c1f5a3525127b442bc70375faf09c16
SHA512 dc69cd4703dcba3c8f4a52058c44a34fa7c0b6096bed20f30ce3dab872461eb6dda9d0d381137b9cb022219ad92ca7f5f25d3964ed33d5f41e9fc05efa5330fd
SSDEEP 1536:wttlIQq8jYAJohe7evhKHIJvuUO7prb3qJz34yfbvTXYActjaO7UX5X8BKg1hJOw:IJjxpIpuVkRECra92Zp8++
TLSH
T1A493D8D9B2D67163C3B731B854AF5107B13698EAB84C8890F068D8E4BE74A48507BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preloader.html

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\preloader.html
Size 826B
SHA256 cf38f4f8663028beff3a7650a9d426b4116891e8547029b66b8d2a13fad63a48
MD5 37a05031bec9d3e093388407848af66f
SHA1 5b48a5b72097ad98eacf54e956e94d26710a0493
SHA512 db3af55b93e901778a74f462af1f80a3e4181b251b061f858a3a6dadc77f2eaf4760c30f4ef9ae5560418eadb6133d474289c3b84c0e89615670af722d8dab9f
TLSH
T11501AF00009A5024B0B6BA1DF953B36B6530815F976B8E5D39E94B73AFC68758E4768C
MD5 SHA1 SHA512 TLSH

Submit Download

translations.json

Path C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\translations.json
Size 34KB
SHA256 d0c9a0c272d8570572a9bb2befc340725fb8f6d6faa88bffa482959a804056b6
MD5 be0d241f5b61d0ba65b1ea4f6fd536a5
SHA1 f2227ae1aebf59f24abcf7ba19b9af07e2358bab
SHA512 3aeb259781867f5cadbaca97395987886baa36e84efa63094a3a028e582ffb898f3b724600a827963d9211dedb260e36d54fcf1ba548014cd4aecc12cea7b3d2
SSDEEP 768:xgnoDGjOiFADZtT35WBqosih7I1/i5At67c4iTgXYXh/:xGfAHcqm766o4Oh
TLSH
T104F2976349CA209609001283F808FF06B79F5DFD37669BD254853C6E37F5628DD26EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download