Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 02:16
Behavioral task
behavioral1
Sample
xoilacvn.com_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilacvn.com_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target xoilacvn.com_chrome.exe
- Size 48KB
- Sample260804-cqbjdsbd77
- SHA256 1d47dfcff73a45f362b852d35a259075a00a5c938eb0f58b39eda108b8972ea6
- MD5 c9c748e90c2dc7447d05760d5ab959b6
- SHA1 f8bd5727696f3022d89eba263bdcc82be37ccf00
- SHA512 c955cfe1ff85f770d71e0acd9d1ac1e991d52971ad6cadbfe43f6de44f66a94c3c2c8cd46b34e6d0d74411bfc0941b3962c89db7c11eab08b362b97f170a4e41
- SSDEEP 768:NhHDTj5D++kqzyYj1gn4q//o4cC1XXGblfA0zKFc9:rHL5DISTxg4qI4cEXGblf9zuc9
- TLSH T11F23F60437F98511E1BF5ABA8DB196019B31B497AC23D78E07D5058E1AB3740CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilacvn.com
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilacvn.com
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3864-0-0x0000000000A60000-0x0000000000A72000-memory.dmp disable_win_def behavioral1/files/0x00070000000249a1-2280.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilacvn.com_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" xoilacvn.com_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4660 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilacvn.com_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilacvn.com_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe xoilacvn.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe xoilacvn.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe xoilacvn.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3684 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation xoilacvn.com_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf xoilacvn.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf xoilacvn.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf xoilacvn.com_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3716 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe xoilacvn.com_chrome.exe File created C:\Windows\system32\sysupdate.exe xoilacvn.com_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilacvn.com_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 4780 wscript.exe 2780 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilacvn.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" xoilacvn.com_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3720 sc.exe 4676 sc.exe 4444 sc.exe 3512 sc.exe 4084 sc.exe 4984 sc.exe 1760 sc.exe 5036 sc.exe 204 sc.exe 3780 sc.exe 3116 sc.exe 2976 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4784 cmd.exe 4388 cmd.exe 704 cmd.exe 3236 cmd.exe 2092 cmd.exe 4872 cmd.exe 3512 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2980 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2596 ipconfig.exe 60 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3696 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2692 vssadmin.exe 4056 vssadmin.exe 2444 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilacvn.com_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302834058404608" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell xoilacvn.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.pdf\ = "PDFBotnet" xoilacvn.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilacvn.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command xoilacvn.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilacvn.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe\" \"%1\"" xoilacvn.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings xoilacvn.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command xoilacvn.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open xoilacvn.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilacvn.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilacvn.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilacvn.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open xoilacvn.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings xoilacvn.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell xoilacvn.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacvn.com_chrome.exe" xoilacvn.com_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4972 schtasks.exe 3380 schtasks.exe 1308 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3084 chrome.exe 3084 chrome.exe 4660 powershell.exe 4660 powershell.exe 4660 powershell.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe 3864 xoilacvn.com_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3864 xoilacvn.com_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeDebugPrivilege 4660 powershell.exe Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeIncreaseQuotaPrivilege 3364 WMIC.exe Token: SeSecurityPrivilege 3364 WMIC.exe Token: SeTakeOwnershipPrivilege 3364 WMIC.exe Token: SeLoadDriverPrivilege 3364 WMIC.exe Token: SeSystemProfilePrivilege 3364 WMIC.exe Token: SeSystemtimePrivilege 3364 WMIC.exe Token: SeProfSingleProcessPrivilege 3364 WMIC.exe Token: SeIncBasePriorityPrivilege 3364 WMIC.exe Token: SeCreatePagefilePrivilege 3364 WMIC.exe Token: SeBackupPrivilege 3364 WMIC.exe Token: SeRestorePrivilege 3364 WMIC.exe Token: SeShutdownPrivilege 3364 WMIC.exe Token: SeDebugPrivilege 3364 WMIC.exe Token: SeSystemEnvironmentPrivilege 3364 WMIC.exe Token: SeRemoteShutdownPrivilege 3364 WMIC.exe Token: SeUndockPrivilege 3364 WMIC.exe Token: SeManageVolumePrivilege 3364 WMIC.exe Token: 33 3364 WMIC.exe Token: 34 3364 WMIC.exe Token: 35 3364 WMIC.exe Token: 36 3364 WMIC.exe Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeBackupPrivilege 3448 vssvc.exe Token: SeRestorePrivilege 3448 vssvc.exe Token: SeAuditPrivilege 3448 vssvc.exe Token: SeIncreaseQuotaPrivilege 3364 WMIC.exe Token: SeSecurityPrivilege 3364 WMIC.exe Token: SeTakeOwnershipPrivilege 3364 WMIC.exe Token: SeLoadDriverPrivilege 3364 WMIC.exe Token: SeSystemProfilePrivilege 3364 WMIC.exe Token: SeSystemtimePrivilege 3364 WMIC.exe Token: SeProfSingleProcessPrivilege 3364 WMIC.exe Token: SeIncBasePriorityPrivilege 3364 WMIC.exe Token: SeCreatePagefilePrivilege 3364 WMIC.exe Token: SeBackupPrivilege 3364 WMIC.exe Token: SeRestorePrivilege 3364 WMIC.exe Token: SeShutdownPrivilege 3364 WMIC.exe Token: SeDebugPrivilege 3364 WMIC.exe Token: SeSystemEnvironmentPrivilege 3364 WMIC.exe Token: SeRemoteShutdownPrivilege 3364 WMIC.exe Token: SeUndockPrivilege 3364 WMIC.exe Token: SeManageVolumePrivilege 3364 WMIC.exe Token: 33 3364 WMIC.exe Token: 34 3364 WMIC.exe Token: 35 3364 WMIC.exe Token: 36 3364 WMIC.exe Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeDebugPrivilege 3864 xoilacvn.com_chrome.exe Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeShutdownPrivilege 3084 chrome.exe Token: SeCreatePagefilePrivilege 3084 chrome.exe Token: SeIncBasePriorityPrivilege 3864 xoilacvn.com_chrome.exe Token: SeDebugPrivilege 4060 whoami.exe Token: SeDebugPrivilege 60 NETSTAT.EXE - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe 3084 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3864 xoilacvn.com_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3864 wrote to memory of 3084 3864 xoilacvn.com_chrome.exe 85 PID 3084 wrote to memory of 3056 3084 chrome.exe 86 PID 3864 wrote to memory of 4660 3864 xoilacvn.com_chrome.exe 87 PID 3864 wrote to memory of 3780 3864 xoilacvn.com_chrome.exe 88 PID 3864 wrote to memory of 3512 3864 xoilacvn.com_chrome.exe 137 PID 3864 wrote to memory of 3116 3864 xoilacvn.com_chrome.exe 92 PID 3864 wrote to memory of 2976 3864 xoilacvn.com_chrome.exe 95 PID 3864 wrote to memory of 3720 3864 xoilacvn.com_chrome.exe 97 PID 3864 wrote to memory of 4084 3864 xoilacvn.com_chrome.exe 99 PID 3084 wrote to memory of 2980 3084 chrome.exe 100 PID 3084 wrote to memory of 5056 3084 chrome.exe 101 PID 3084 wrote to memory of 5056 3084 chrome.exe 101 PID 3864 wrote to memory of 4676 3864 xoilacvn.com_chrome.exe 103 PID 3084 wrote to memory of 4064 3084 chrome.exe 104 PID 3084 wrote to memory of 4064 3084 chrome.exe 104 PID 3864 wrote to memory of 4984 3864 xoilacvn.com_chrome.exe 176 PID 3084 wrote to memory of 876 3084 chrome.exe 108 PID 3084 wrote to memory of 876 3084 chrome.exe 108 PID 3084 wrote to memory of 3724 3084 chrome.exe 178 PID 3084 wrote to memory of 3724 3084 chrome.exe 178 PID 3864 wrote to memory of 2284 3864 xoilacvn.com_chrome.exe 111 PID 3084 wrote to memory of 2516 3084 chrome.exe 112 PID 3084 wrote to memory of 2516 3084 chrome.exe 112 PID 3864 wrote to memory of 1760 3864 xoilacvn.com_chrome.exe 113 PID 3864 wrote to memory of 5036 3864 xoilacvn.com_chrome.exe 115 PID 3864 wrote to memory of 2692 3864 xoilacvn.com_chrome.exe 117 PID 3864 wrote to memory of 3364 3864 xoilacvn.com_chrome.exe 119 PID 3084 wrote to memory of 3964 3084 chrome.exe 121 PID 3084 wrote to memory of 3964 3084 chrome.exe 121 PID 2284 wrote to memory of 3712 2284 fodhelper.exe 123 PID 3864 wrote to memory of 4780 3864 xoilacvn.com_chrome.exe 127 PID 3864 wrote to memory of 3380 3864 xoilacvn.com_chrome.exe 128 PID 3864 wrote to memory of 1308 3864 xoilacvn.com_chrome.exe 130 PID 3864 wrote to memory of 4784 3864 xoilacvn.com_chrome.exe 135 PID 3864 wrote to memory of 3512 3864 xoilacvn.com_chrome.exe 137 PID 3864 wrote to memory of 4872 3864 xoilacvn.com_chrome.exe 138 PID 3864 wrote to memory of 2092 3864 xoilacvn.com_chrome.exe 139 PID 3864 wrote to memory of 3236 3864 xoilacvn.com_chrome.exe 140 PID 3864 wrote to memory of 704 3864 xoilacvn.com_chrome.exe 141 PID 3864 wrote to memory of 4388 3864 xoilacvn.com_chrome.exe 142 PID 3864 wrote to memory of 4972 3864 xoilacvn.com_chrome.exe 143 PID 3864 wrote to memory of 2780 3864 xoilacvn.com_chrome.exe 147 PID 2092 wrote to memory of 4060 2092 cmd.exe 152 PID 704 wrote to memory of 2596 704 cmd.exe 153 PID 3236 wrote to memory of 1336 3236 cmd.exe 154 PID 4872 wrote to memory of 3716 4872 cmd.exe 155 PID 4388 wrote to memory of 60 4388 cmd.exe 156 PID 3512 wrote to memory of 3696 3512 cmd.exe 157 PID 3864 wrote to memory of 2648 3864 xoilacvn.com_chrome.exe 158 PID 1336 wrote to memory of 464 1336 net.exe 159 PID 4784 wrote to memory of 4056 4784 cmd.exe 160 PID 4784 wrote to memory of 1052 4784 cmd.exe 161 PID 3864 wrote to memory of 2444 3864 xoilacvn.com_chrome.exe 163 PID 3864 wrote to memory of 2156 3864 xoilacvn.com_chrome.exe 164 PID 3864 wrote to memory of 1508 3864 xoilacvn.com_chrome.exe 167 PID 3864 wrote to memory of 3684 3864 xoilacvn.com_chrome.exe 168 PID 3864 wrote to memory of 4444 3864 xoilacvn.com_chrome.exe 170 PID 3864 wrote to memory of 204 3864 xoilacvn.com_chrome.exe 173 PID 1508 wrote to memory of 4596 1508 net.exe 175 PID 3084 wrote to memory of 764 3084 chrome.exe 177 PID 3084 wrote to memory of 4596 3084 chrome.exe 187 PID 3084 wrote to memory of 4948 3084 chrome.exe 188 PID 3084 wrote to memory of 1772 3084 chrome.exe 189 PID 3084 wrote to memory of 3956 3084 chrome.exe 200 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://xoilacvn.com2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffcb46dc728,0x7ffcb46dc734,0x7ffcb46dc7403⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,5725008002624608180,8002785858863044686,524288 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:33⤵
- System Time Discovery
PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,13808159837171695801,16074639284103088072,262144 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:23⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,10484876820209943607,6983905238102795596,524288 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2324 /prefetch:83⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3080,i,15473215654691135687,14127952708979240225,2097152 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:13⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,13096931138891201577,12701191495490848059,2097152 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:13⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,1736764883974787583,11602100818856585750,2097152 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:23⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4572,i,8266843626053883369,17123309062731016875,2097152 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,10715135459590419236,7932605435669278784,524288 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:83⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,12397607969575332490,5928385901111298074,524288 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:83⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,16685128832999321169,184987945095700736,524288 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:83⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,15974266902721514559,118416065415464453,524288 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:83⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4452,i,1173794534106677394,6406252183667289697,262144 --field-trial-handle=1992,i,10100292487965493725,15783102176557461230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:83⤵PID:3956
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3780
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3512
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3116
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2976
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3720
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4676
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4984
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe"3⤵PID:3712
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1760
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5036
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2692
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4780
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3380
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4056
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:1052
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3696
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:3716
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:464
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2596
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4972
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2780
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2648
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2444
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:2156
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4596
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4444
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:204
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2856
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe1⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacvn.com_chrome.exe1⤵PID:2764
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:4984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3724
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260804_031741.jpg
- Size 87KB
- SHA256 df497eda6f462ad994da74db4e78dec890d63b071d1670a14df0b095caf5e14b
- MD5 ce646aaea22889bb0b874f27973a962b
- SHA1 b836eaff33a07dac091f065ea24e2a5b36edf199
- SHA512 bf4419a7bdcaabda57520ce290645f001450f1e283f934c451ed530e605a4235212144e0c975b3dbc1f836e14b0d86bd3059be7c76ea750161c922435201bb99
- SSDEEP 1536:I7f7RRRRRRRRRRRkl8N+0Y9+W2PSZPjNVDNIXe2Te:KGF0dCb/DNkZTe
- TLSH T1709380135D4D8AD2A12C92D4BE171EDC3E0A2B5CEC926EFF10461FDA7E616631D8D02B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 09f6087c8b3f08beff0d8f4cbe5e8a4b629620b4c9502479803f10e5e2af6d65
- MD5 32181ac66bc72767169f9ef9f3d04998
- SHA1 d7ea2e01b47062463cb8f9acef428ac8555355ad
- SHA512 1500bc4a43e2e8f8669a70c27661ca12c3d5e79e07bc309a3d251e6e1b330b09df3ed62099489f3716e90adb5ea37f65c52b385e84e37460ba364cf12a727fc8
- SSDEEP 1536:wBUaGQCigDpJIgIkoL42GuIeV8hIkuPBJA8ezplLRSku1uJBKYvPED:wBUaGdigDI2L1uIN6kuazplCInZPED
- TLSH T1AA633B368A23FCD0777E3D80E05439561C883E7B47B5667CFA811DAA28A5640DF3F5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 7b8b0d368ef3144efc47ac12178ef301903d72aa6897de09952636677c01b99b
- MD5 0041916b8e2908f859dce2425cfb1f44
- SHA1 ec005b9ea521c66e887b1a00af8c609f149622b0
- SHA512 12c5c363a737dcd6223ea4656d64ecea2c2b9aef1f7fbe1ac096c8f99e53b14fca8adfdaffdc6103b05b543bae6d55f0f4f31f7110181ea3eea8e723fa00eac9
- SSDEEP 1536:QBUaGQCigDpJIgIkoL42GuIeV8hIkuPBJA8ezplLRSku1uJBKYvPEa:QBUaGdigDI2L1uIN6kuazplCInZPEa
- TLSH T135533A368B23FCD0677F3D80E05439961C883E7B4775667CFA811DAA28A5640DF3E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 6bcd61019dea78331d5ba757b41edb880e25f59b178182491ecd8d0079d783d5
- MD5 ee7a74426d99a8dff76f50ccd5a0bd4e
- SHA1 2bc00961e43212c9548eed9fe7f8d28414863201
- SHA512 65e273d9e5eb4c2e427bc1ff70d85af017a2ed7ab036912be3e809c26f86fbe3aee4c9551ea99d21e976694778950b4929a3a637be31063dc0035b4ed05dec66
- TLSH T195E02BB6C861BC7729FD071810964705EF5613162BC0492F7A3CD20C4FB162A4186C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b4d345659be05870e5197789c6c217ad222f1d6d344a09a57354b5520199f497
- MD5 f1696f1888aa473090c33fcd8deb74c6
- SHA1 36ec9c9fcae57ce0ef75ad97335875093dcfe947
- SHA512 d44f8d56663118018fdbdfc5446afda59079faec47ac94428cf5d217613e0a3d43e3d8c3d6a0a891874215a7c609908467039743fdd54fe1df458efcfd34fa45
- TLSH T106518AF387F4896E891192F4AA156E1FCE6E0924431C3C7689D4AF5B63E28B2E10174E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7eb19ff18dc88560951f411f6d7be920f1da3426e5a770009ffa8633fbbf6490
- MD5 f0898973ed03392f3dce31370dd6fd66
- SHA1 2f94abd2631cb60c1636549cfd0b84d974dd87fd
- SHA512 589d691f28dcb26b9b9328843879b00b17b530d3140756b4dfd671d8bdb4dd02e97c08df26f8ecf1a8edf54097775a391cdfa67571c42d0ace74efede7591e9a
- SSDEEP 192:LRuKL7p+VOEWav7hpAPRp2T+95Hsb+WNnKw1VU02PRBhlqvkwgzrNVyIsnAUgtaJ:LRuk9+NW29UXjrw7B2pByeb8
- TLSH T14B42D72EB910657B9CDAC225FD227713D7F7146226942E88EBFC892C15EB5CC321741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 02c350f2797cef3abcbd01174589eb3f77e1f116c6b262051119a6b04129b70e
- MD5 bf8570b876e66ddbb6deea0c1036738d
- SHA1 8b7bac93cc87b0076c8718468e11d052ee384d07
- SHA512 95851cdd76d6c8577ae7d42550a13dd57f1b6cb23a750c4efd53b940f14ee9c4d4bc63ff1789b6d9a8de88bdcd6ea0ab7c7cb57e0c939b77f7c7baac86c936c0
- SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcMsNXOD+F+ErU3qsHGZ45hseHkL:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pv
- TLSH T19172F9677C4C9A770F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF010A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 04c3f319022578b8f3dbe73f981f7270494853853be09f7fcec90ed4b218f9a2
- MD5 0dccee2b91a1a5d4fb69f166547ac18b
- SHA1 7b2d16fad35d8282d5e8c884b10aec5141da1b3c
- SHA512 f1383f0b70d3fd2101aec7e84ecb691182d8e8c64c5377dc0e5778e0634689b0bc75ba2b2a65eb2932598cff7040e8dcfce54aaecae70ff60368e6e5f6b6527e
- TLSH T18EB01250C0815221C00202F4114218987314AF14970F2B0153E069228C392508024092
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f5b5.TMP
- Size 96B
- SHA256 f3515abd1be00fa267dbb20fefdd7451fae1d95375104ccc2f4760600a6c85e9
- MD5 3122cd40458624f10d6cfe86f4988d76
- SHA1 25c03889b9d2cec948d538252702e9c0a1ad3f36
- SHA512 91a44e2f39980e61315316b50ba16ad07c63e65bab298b44e24aed0ccda9325d2082747a373af63a7ce3a1b39b277486180b49cc43199f4c176045deaf0b1f54
- TLSH T17CB02203C2022203C80203B0BC88A0C83022CF20CE03022E82E02A32EC28BE0022B0E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 b4b3b30bd4df0f4e3923f93176532ea8af09a0a9ad370c91bc2a967189907aa7
- MD5 6a14d0a85f9adee1cb75f6e0a51ac60b
- SHA1 937849f8e0275be06eb2c2483c7e1c3e77bb0ff5
- SHA512 ffb9766832b9a3aad35cd23f32e28f690ac3f5f2657a7a049b622b118c76a759466c6d60ba002ef249200ff402352c3b6b56751d2b0c554f54cc1154ffe2e92e
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OCpX68qwRVumkwk4OQ1:jeuvBnhJsueMEGvIW1DcP2OKpRVumknW
- TLSH T1E9D3A84B3A747102EDE59A721CE051BB5D3CB16D4F55A1D428B620688EF2923B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 e4d56a49edf1a9440f6345d8c819e453dbf597726b0f27c23d951adf3235b2cb
- MD5 da1d1493301f0cbf6e7b74aa3f83c824
- SHA1 9f8fb4d9fcd8b20566fd7bcca34a77cd62b9ea5b
- SHA512 57a36e616b7a2a8b0d88de90565f949001510e17274d1fc5fa1198a5cfbcd7a89bf9eb885c815d3fd236ead3963ef181c97d55a605eae762d9a32fcefb30c88d
- SSDEEP 3072:etznNTDfGgzFJik1QB5ssGSuNmdBFt68qGiusrkQ+LiTHx4uAtq0qfd7NtZL8cH6:eFVQk1WssGdN0TDZRA4VVqZ/ZLW3Exg
- TLSH T1F5341236EEC5BF3326809B91B9265E076FF604D784386105EAF6F78B2C47D41D94286C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 5c1d7db2a7873ef97a4e42408c53725553f34082b7352847fbd3312cedd35032
- MD5 8901cb1f126f2d58265663fc50f34dd1
- SHA1 5a1c2801d0a42662d6dfd6302deb32a914b7d2fd
- SHA512 66ba8b086b006b736b42d0840e10b85fc3ff3a9f8a8202f1d8ace38e5ed63f50313db7dac36b00ffe7950c5a8db60e04020b8e0825c476921e74e71fd63c1107
- SSDEEP 1536:6ZUyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Nqfd7NtZL8cHQRZEQ6Sps9
- TLSH T1D4C30237EBC21F335D92CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 eef09e6db280fcb55689f7629e78fb3c5ad9bf3ae5599394d55f789b9326af53
- MD5 00c8404f016164cb71b62e2bea37453e
- SHA1 4ef0d91659a6543b2d82fa899fb0f8c5cd8abf00
- SHA512 3d72dda6f52d1fa677a1c6a574457ac0c64a53e46b5b5c0702e87b9b2451966c734f67ac67387f8b3aae3aff0e8479acc634d6701bc3164a4364970b7941028f
- SSDEEP 3072:WfznNTDfGgzFJik1QB5ssGSuNmdBFt68qGiusrkQ+LiTHx4uAtq0qfd7NtZL8cH6:+VQk1WssGdN0TDZRA4VVqZ/ZLW3Exg
- TLSH T1E5342326EFC5FF3326809B51B9264E076BB604E780786101EBF7F7DB2847D81894286D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a89fa1b2ab433320837884150618cb7762404079439b88b61b724d6b51b151b1
- MD5 db71b07b67dd5b63d555ef4cbdd65485
- SHA1 7f5d84169fc7c013ec322dd131600fff0c736fe9
- SHA512 66328e2894fb3af45aef30378b07bb2cb63be6b2456dff22c5a815171ec9d2260e3e5da9313a98e938d2ee064df6b557e8f85a4c85b64d536ab9ff4f212290e1
- SSDEEP 1536:zpy7yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbb:FSqfd7NtZL8cHQRZEQ6SpsY
- TLSH T1FDC30237ABC21E335D92CB70BA134FD797B544AA9034D301ABBD2BBB689345564824AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xoilacvn.com_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjd12j1j.m3z.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 244B
- SHA256 a6b87a436254dfdd54494d3d0a6b2e8a46023fc70860d133cd828ec773c75c97
- MD5 d11f46fecfcbcb2b503dff7064bb38b1
- SHA1 e8965683260c09f11b3e19b4e31bd4294e161483
- SHA512 2d06a2b6298e17be23562a223db65ddf8485653a4460d2311e623d99085b76c32e85bad29beeb452e8a9059e14f3efbaf76c1507f169d5f4598f0b0bb1792022
- TLSH T19CD0A78FB248C6B90001163B81F3CD4DE9E548683B13BEA09AA5DD4D32918868DF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 245B
- SHA256 cdd116f88f32bbeac01700eec2589e473bd4f5f7c9229e28254f09edddeeb0d3
- MD5 2a6fa1976fdf81ad978dff4f1b0715d7
- SHA1 5edf51ce198dfccf41059aeedf7c31d6c06eb6ff
- SHA512 e0993b2e37ed9dd240573915301d76dc676f7c3703b15a11eba9bab9202d66973b4eaf56068e75c9830a7ddf22cad517c2f0f0339067e4fc14ab4315246fa16b
- TLSH T195D0A78FB248C6B90001163B80F3CD4DEAE148683F13AEA0DAA5DD0E32918868DF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 117KB
- SHA256 5ab396a9ff6a8098691d1d5a3824c6049710b51111ae1001423075a8ba2f3656
- MD5 f046ea5fdc40dae3593fd70f5b491076
- SHA1 a48ac5ea3e6d65c10cce8c703b5fe250012c06e3
- SHA512 bc7c95a6547dbb0b9a8980752ce9c9a2eb0019691b588fa4ee811bbaef3a3e6934505af41a73aa6f9864439d9f29282a01f99f0cc593f0e0eb7414f3cf3c6b85
- SSDEEP 1536:Jdi7+6CbowlPePRUMucgKLNBBQHOc9nLvqtHyT74t:qZC0wBe5uUoOgL4S3e
- TLSH T149C3BF04C6B7CE6B04D60ABB095637D4B038B7B0D6FC90FB61A26A67F4738B2D719215
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 117KB
- SHA256 f7c1eafcf789890accdf8b6f837c989f148abf43db8840657c6d734b056987b6
- MD5 774747b2b004f572dba797b7957b1153
- SHA1 d8dc9aa29ee7b5c64b69d4d928924659250a2c03
- SHA512 2c048e222bf87ec09f4804f1405d0a8407f3f469ff58b780ee7c94648ef2ce4d0e5e5700cdc743ffe8391566466112451f742978184afeb8a064ad027afd7f4b
- SSDEEP 1536:zdi7+6CbowlPePRUMucgKLNBBQHOc9nLvqtHyT74m:8ZC0wBe5uUoOgL4S3Z
- TLSH T1CEC3BE04C6B7CE6B04D60ABB095637D4B038B7B0D6FC90FB61A26A67F4738B2D719215
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 1d47dfcff73a45f362b852d35a259075a00a5c938eb0f58b39eda108b8972ea6
- MD5 c9c748e90c2dc7447d05760d5ab959b6
- SHA1 f8bd5727696f3022d89eba263bdcc82be37ccf00
- SHA512 c955cfe1ff85f770d71e0acd9d1ac1e991d52971ad6cadbfe43f6de44f66a94c3c2c8cd46b34e6d0d74411bfc0941b3962c89db7c11eab08b362b97f170a4e41
- SSDEEP 768:NhHDTj5D++kqzyYj1gn4q//o4cC1XXGblfA0zKFc9:rHL5DISTxg4qI4cEXGblf9zuc9
- TLSH T11F23F60437F98511E1BF5ABA8DB196019B31B497AC23D78E07D5058E1AB3740CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH