Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 07:52
Behavioral task
behavioral1
Sample
workrex.io_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
workrex.io_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target workrex.io_chrome.exe
- Size 48KB
- Sample260808-jqflnsbq21
- SHA256 90fb49a37a0b079c8054445e04806c4548345103d2d5a2b031264840c0156afc
- MD5 6bce0d1f66350e25becd35d3dcbbd199
- SHA1 27f88337dea64d7578101f234dac8331e546318f
- SHA512 079699ca4d119b805209701d43685169cc5c98dd182557314dc83532d950ecc4f43d57941d9221f903fc6352320cf08fb663766b9efe75971e40212be8dbcd8c
- SSDEEP 768:ahACrXoD+LmjXsvFisuF+4j//o4TC1XXGblfA01KFcm:qjEDY2SA9njI4TEXGblf91ucm
- TLSH T1A023070437F98511F2FF5ABA4DB19601AB30B4A79C22D78E06D5058E1AB3740DEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://workrex.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://workrex.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3712-0-0x0000000000660000-0x0000000000672000-memory.dmp disable_win_def behavioral1/files/0x0007000000024857-2329.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" workrex.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" workrex.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 408 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" workrex.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts workrex.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe workrex.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe workrex.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe workrex.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3492 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation workrex.io_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf workrex.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf workrex.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf workrex.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3128 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe workrex.io_chrome.exe File created C:\Windows\system32\sysupdate.exe workrex.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe workrex.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5988 wscript.exe 5528 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" workrex.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" workrex.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3060 sc.exe 1056 sc.exe 3200 sc.exe 3420 sc.exe 1128 sc.exe 4408 sc.exe 1392 sc.exe 2224 sc.exe 4112 sc.exe 936 sc.exe 2724 sc.exe 1848 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5316 cmd.exe 5324 cmd.exe 5332 cmd.exe 5340 cmd.exe 5212 cmd.exe 5284 cmd.exe 5292 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1588 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5736 NETSTAT.EXE 6004 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5728 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3128 vssadmin.exe 5888 vssadmin.exe 6116 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\WallpaperStyle = "2" workrex.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306491471245489" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell workrex.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell workrex.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe" workrex.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command workrex.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command workrex.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open workrex.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command\DelegateExecute workrex.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet workrex.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open workrex.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings workrex.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings workrex.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell workrex.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.pdf\ = "PDFBotnet" workrex.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open workrex.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\workrex.io_chrome.exe\" \"%1\"" workrex.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command workrex.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4628 schtasks.exe 5360 schtasks.exe 2464 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 408 powershell.exe 408 powershell.exe 408 powershell.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe 3712 workrex.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3712 workrex.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeDebugPrivilege 408 powershell.exe Token: SeIncreaseQuotaPrivilege 4524 WMIC.exe Token: SeSecurityPrivilege 4524 WMIC.exe Token: SeTakeOwnershipPrivilege 4524 WMIC.exe Token: SeLoadDriverPrivilege 4524 WMIC.exe Token: SeSystemProfilePrivilege 4524 WMIC.exe Token: SeSystemtimePrivilege 4524 WMIC.exe Token: SeProfSingleProcessPrivilege 4524 WMIC.exe Token: SeIncBasePriorityPrivilege 4524 WMIC.exe Token: SeCreatePagefilePrivilege 4524 WMIC.exe Token: SeBackupPrivilege 4524 WMIC.exe Token: SeRestorePrivilege 4524 WMIC.exe Token: SeShutdownPrivilege 4524 WMIC.exe Token: SeDebugPrivilege 4524 WMIC.exe Token: SeSystemEnvironmentPrivilege 4524 WMIC.exe Token: SeRemoteShutdownPrivilege 4524 WMIC.exe Token: SeUndockPrivilege 4524 WMIC.exe Token: SeManageVolumePrivilege 4524 WMIC.exe Token: 33 4524 WMIC.exe Token: 34 4524 WMIC.exe Token: 35 4524 WMIC.exe Token: 36 4524 WMIC.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeBackupPrivilege 4500 vssvc.exe Token: SeRestorePrivilege 4500 vssvc.exe Token: SeAuditPrivilege 4500 vssvc.exe Token: SeIncreaseQuotaPrivilege 4524 WMIC.exe Token: SeSecurityPrivilege 4524 WMIC.exe Token: SeTakeOwnershipPrivilege 4524 WMIC.exe Token: SeLoadDriverPrivilege 4524 WMIC.exe Token: SeSystemProfilePrivilege 4524 WMIC.exe Token: SeSystemtimePrivilege 4524 WMIC.exe Token: SeProfSingleProcessPrivilege 4524 WMIC.exe Token: SeIncBasePriorityPrivilege 4524 WMIC.exe Token: SeCreatePagefilePrivilege 4524 WMIC.exe Token: SeBackupPrivilege 4524 WMIC.exe Token: SeRestorePrivilege 4524 WMIC.exe Token: SeShutdownPrivilege 4524 WMIC.exe Token: SeDebugPrivilege 4524 WMIC.exe Token: SeSystemEnvironmentPrivilege 4524 WMIC.exe Token: SeRemoteShutdownPrivilege 4524 WMIC.exe Token: SeUndockPrivilege 4524 WMIC.exe Token: SeManageVolumePrivilege 4524 WMIC.exe Token: 33 4524 WMIC.exe Token: 34 4524 WMIC.exe Token: 35 4524 WMIC.exe Token: 36 4524 WMIC.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeDebugPrivilege 3712 workrex.io_chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeIncBasePriorityPrivilege 3712 workrex.io_chrome.exe Token: SeShutdownPrivilege 1452 chrome.exe Token: SeCreatePagefilePrivilege 1452 chrome.exe Token: SeDebugPrivilege 5736 NETSTAT.EXE Token: SeDebugPrivilege 3128 tasklist.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe 1452 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3712 workrex.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3712 wrote to memory of 1452 3712 workrex.io_chrome.exe 86 PID 1452 wrote to memory of 412 1452 chrome.exe 87 PID 3712 wrote to memory of 408 3712 workrex.io_chrome.exe 88 PID 3712 wrote to memory of 1056 3712 workrex.io_chrome.exe 89 PID 3712 wrote to memory of 4112 3712 workrex.io_chrome.exe 134 PID 3712 wrote to memory of 3200 3712 workrex.io_chrome.exe 94 PID 3712 wrote to memory of 936 3712 workrex.io_chrome.exe 96 PID 3712 wrote to memory of 2724 3712 workrex.io_chrome.exe 98 PID 3712 wrote to memory of 3420 3712 workrex.io_chrome.exe 100 PID 3712 wrote to memory of 1848 3712 workrex.io_chrome.exe 102 PID 3712 wrote to memory of 3060 3712 workrex.io_chrome.exe 104 PID 3712 wrote to memory of 3168 3712 workrex.io_chrome.exe 105 PID 1452 wrote to memory of 3048 1452 chrome.exe 107 PID 1452 wrote to memory of 3048 1452 chrome.exe 107 PID 1452 wrote to memory of 1588 1452 chrome.exe 108 PID 3712 wrote to memory of 4408 3712 workrex.io_chrome.exe 109 PID 1452 wrote to memory of 1652 1452 chrome.exe 110 PID 1452 wrote to memory of 1652 1452 chrome.exe 110 PID 3712 wrote to memory of 1128 3712 workrex.io_chrome.exe 112 PID 1452 wrote to memory of 4484 1452 chrome.exe 115 PID 1452 wrote to memory of 4484 1452 chrome.exe 115 PID 1452 wrote to memory of 1804 1452 chrome.exe 116 PID 1452 wrote to memory of 1804 1452 chrome.exe 116 PID 3712 wrote to memory of 3128 3712 workrex.io_chrome.exe 157 PID 1452 wrote to memory of 4800 1452 chrome.exe 118 PID 1452 wrote to memory of 4800 1452 chrome.exe 118 PID 3712 wrote to memory of 4524 3712 workrex.io_chrome.exe 120 PID 3168 wrote to memory of 1992 3168 fodhelper.exe 122 PID 1452 wrote to memory of 4968 1452 chrome.exe 126 PID 1452 wrote to memory of 4968 1452 chrome.exe 126 PID 3712 wrote to memory of 5988 3712 workrex.io_chrome.exe 128 PID 3712 wrote to memory of 2464 3712 workrex.io_chrome.exe 129 PID 3712 wrote to memory of 4628 3712 workrex.io_chrome.exe 131 PID 3712 wrote to memory of 5212 3712 workrex.io_chrome.exe 136 PID 3712 wrote to memory of 5340 3712 workrex.io_chrome.exe 138 PID 3712 wrote to memory of 5332 3712 workrex.io_chrome.exe 139 PID 3712 wrote to memory of 5324 3712 workrex.io_chrome.exe 140 PID 3712 wrote to memory of 5316 3712 workrex.io_chrome.exe 141 PID 3712 wrote to memory of 5292 3712 workrex.io_chrome.exe 142 PID 3712 wrote to memory of 5284 3712 workrex.io_chrome.exe 143 PID 3712 wrote to memory of 5360 3712 workrex.io_chrome.exe 144 PID 3712 wrote to memory of 5528 3712 workrex.io_chrome.exe 152 PID 3712 wrote to memory of 5704 3712 workrex.io_chrome.exe 153 PID 5316 wrote to memory of 5744 5316 cmd.exe 154 PID 5284 wrote to memory of 5736 5284 cmd.exe 155 PID 5340 wrote to memory of 5728 5340 cmd.exe 156 PID 5332 wrote to memory of 3128 5332 cmd.exe 157 PID 5292 wrote to memory of 6004 5292 cmd.exe 158 PID 5324 wrote to memory of 6000 5324 cmd.exe 159 PID 5744 wrote to memory of 5856 5744 net.exe 160 PID 5212 wrote to memory of 5888 5212 cmd.exe 161 PID 5212 wrote to memory of 6028 5212 cmd.exe 162 PID 3712 wrote to memory of 6116 3712 workrex.io_chrome.exe 163 PID 3712 wrote to memory of 3796 3712 workrex.io_chrome.exe 165 PID 3712 wrote to memory of 5564 3712 workrex.io_chrome.exe 167 PID 3712 wrote to memory of 3492 3712 workrex.io_chrome.exe 168 PID 3712 wrote to memory of 2224 3712 workrex.io_chrome.exe 171 PID 3712 wrote to memory of 1392 3712 workrex.io_chrome.exe 172 PID 5564 wrote to memory of 5036 5564 net.exe 175 PID 1452 wrote to memory of 4112 1452 chrome.exe 177 PID 1452 wrote to memory of 2020 1452 chrome.exe 185 PID 1452 wrote to memory of 6080 1452 chrome.exe 186 PID 1452 wrote to memory of 2012 1452 chrome.exe 187 PID 1452 wrote to memory of 4064 1452 chrome.exe 203 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://workrex.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffc0b3bc728,0x7ffc0b3bc734,0x7ffc0b3bc7403⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,502604186436183192,16481879375861549020,262144 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:23⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,8677442123834136162,3495920260328338460,524288 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:33⤵
- System Time Discovery
PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,13504245085802030510,1551116543922342272,524288 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:83⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,1093008144765068735,7000525972191509635,2097152 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:13⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,6222874002719086233,938924426616104697,2097152 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:13⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4396,i,1459668217716159695,2508421643970887014,2097152 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:23⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,2766001777065620830,8094291203504821351,2097152 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:13⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,15414049184603892996,17325375633512205557,524288 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:83⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,3470875517742913374,7481925564243158919,524288 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4404 /prefetch:83⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,16270802520876369574,17026623397755477224,524288 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:83⤵PID:6080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,10771909932776001341,3328750616887525794,524288 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:83⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4396,i,13081679450265367369,7095327262359880011,262144 --field-trial-handle=1980,i,2534467482749103039,3802626754470031336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3784 /prefetch:83⤵PID:4064
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1056
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4112
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3200
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:936
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2724
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3420
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1848
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3060
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe"3⤵PID:1992
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4408
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1128
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3128
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5988
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5888
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:6028
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5728
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\system32\whoami.exewhoami3⤵PID:6000
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5856
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:6004
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5360
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5528
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5704
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6116
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:3796
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5036
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3492
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2224
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1392
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4904
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe1⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\workrex.io_chrome.exe1⤵PID:276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5128
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260808_085424.jpg
- Size 254KB
- SHA256 7bb52560f90dab229c25e2f9e1262143f5e768d096c7d1a70cd419b926b107c5
- MD5 9e243b6e299de0827eee173642c33832
- SHA1 39b557e63a8b34c3d2efe3a62006f099248afb2c
- SHA512 2cc41e5f318d7a383a541039b99a2561ae782b4091fba2fda4016bdffcd3b42913cdac5bc518f5d4450e9e6d8aba843e751017569d9e6c9f3c735aa74f8dbe25
- SSDEEP 3072:+///////////////oywsli9ppCOzMXiKCMaS9/QOuSHUD4xuzPpyo/1aVh4wzOVO:47i9JfKCMaVv99R1a16V52PWbyEd0hJ
- TLSH T1EA447B07AC18DB83616843E97D074F7C2B5B2B1DA9D136FE14225EEB3E647610C8E52E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 a36dfdd28c57826a7812122b5848163ae32426df64386850b79c3a7487834f74
- MD5 0d6d608522116d6a307db144d78ac533
- SHA1 2886c37cc7ea219c826c43fc9b778c86fae78e48
- SHA512 aac907dd923d96b4bcca539e3d2a8553577f7bd9b69ecb8f97c4f1ad451894896fe2a1c3d702dde0dd1a377047b774bb0806514fed1d987b1c17e96fc8b7c101
- SSDEEP 1536:2BUNEMNWF3B4I11I98jVqmo7UKmOvl9w1zts4L1vc140zzOCBVrPEUD:2BUNEmWF3t1E+ily1Rt1Ue0zzdrPEE
- TLSH T1ED632A368B33FCD4277E3D80A0103D561C883E7B97B926BCFA841DA628E5544DF3A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 9ac7ab75dbe8d0c4b0d3a9cecc87f53bfca074bb700045d023628b5af59b1e9c
- MD5 19b4ad2dfb29d3012065bf75268fa59f
- SHA1 2a0cd7ed0d5eb6a758559e30c2ccf02b79005dea
- SHA512 c3e4c6cd9d463a9a962e4c4f2e276b84e0b72177f71a6805c05e2b2e5d591abb1ffcd967b5192d15e71d62771ed4aeeb7e779fd540d6b2a0a359f089f373b606
- SSDEEP 1536:WBUNEMNWF3B4I11I98jVqmo7UKmOvl9w1zts4L1vc140zzOCBVrPEUa:WBUNEmWF3t1E+ily1Rt1Ue0zzdrPEH
- TLSH T10F5329368B33FCD4277E3D80A0503D561C882E7B97B92A7CFA851DA628E5144DF3A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 aca6844e76d645e0a98d486ef861951bbc3c2f42a1130e61ce3632e30380a1a8
- MD5 7b026dad512eb5fc6d5975a9e4ae3c46
- SHA1 c765028b6c97e336c05306ec4f23094abd2355e4
- SHA512 08bbb8d221cd9ac413e68dff1535f855aba87183b74f71a27b01b03aa4c7c12408cc10f072eb5199b1a53aa897986e9ea17b94470bf435f971596e29122834d0
- TLSH T16DE02BA9CD21EC371DFD472D54904B45EB2113572B61855B3B3C91188FB16670585C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 08bf9124dc5eb0e27970b52d88ba7cf419670d22671bf7dafc407ea73ef11bd3
- MD5 299cc6e0907f2fa9d8c228046d7efde9
- SHA1 aee357d8056125fb527866a6de4dbe2217ce5bb9
- SHA512 f1553544b8603442cedcabcf354f49d2b14f754505ac556db141bc76bf300ce4ba8e4fde1a66cdae97692b21852a4d7487b9b29eb786d6f3eae612ed171978d9
- TLSH T1E6D0A920E5E09861CFC222B238F23C0023131E29C91E4BB2A9400CB0ACA35F4E9162BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 0582ac6831c4370445823646e30ca67f32b5e1c14a3d6d2f76ea833486eb56e5
- MD5 54b8800b8872c7a1ec22d781878183d3
- SHA1 2491f00a6aa2fc994524d68388ebcdc5c9d36fc4
- SHA512 a6fdf6341d1f5e22c9c40d320629fdf16e68c69e5bdc1be3ecd7086f710b61f234e9b3ddfebf887bdd48195d3ed7fb99d76e861b1d742ea56abb575e2aed793b
- TLSH T1D3818EF7D3E4867DCA1196F4AB256E2BCE690518431C3C67C9D8AE1B93E2873D24074E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 32a0c7d2fafd1e0f85e6e5234228b3ca9f2568c713324e4efad36df8a72432ac
- MD5 da69def5f9f859e535eceff372cbe7ca
- SHA1 bda6238ba84f9db4c06aa04447d6b1a0f46aa6d9
- SHA512 c446f20d7db00353558c68fa2f123f7c7df6b79b22173aad83778debf2451acc65bce2a8b4fd0434f27831b3b584dfd61fb30b704f26b1216235ef0eb750f0aa
- SSDEEP 192:IRmUrgAP85Bov7ApAPRp2Pl39qHsb+WNnDmrczh/J2UZaenmljVyIsnAUge:IRmUdo0kUXEkw6c2que
- TLSH T17242D82DEE10697BACDBD229FA653B63E7F1202521952EC0EAFC992C24D75CC211701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 15a6fe12e3489cae1c96b38ba5de6096cf6520825d9d3e23718cfb0ecbb1edd6
- MD5 4ecd781f1f73bc4a4a19868116972274
- SHA1 0321c7224a1b57687ddab2755586aa64757f34a3
- SHA512 20ea9ecc523f5bf19c7f9b2b067b031ddeb60cf058b34879fa5ff37a5c34eca80b7f1c7af435362a8ea8b5a4e8df4429b0102b3f73352fc341e2e02b72735cce
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcMvKXODx4+ErU31PHG0/dpS8gfmn:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7p0
- TLSH T138720A67AC4C9E374F94D6CCDC177B4FADB5015B61E988A482FA9C1903D5BCA010A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 cc69d56c0649bba5df829baddf7e2d746b5c0097449deb9fcdc6c3b247bfdefb
- MD5 8d9634dd6d944009985efb49f3930038
- SHA1 c30e2f429c6322a1e86546026ec03fed8e288ccd
- SHA512 d05136c11e142b711dbcd5bcfd7068bf1625b253fef2ab6c48663cfcec56ba0c0aab6f8da5c9c7f4dba7e6546f862e588e55bff5d8fb324a2d04d853addd663e
- TLSH T1AAB012D08801D201C40203F4254764DC7114AF10A60E171143E07936CC262918415050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bac0.TMP
- Size 96B
- SHA256 c5a3a10efbc22d4c67091ce220ef925bba3022e40c2792e56c33e1a71c7b696d
- MD5 c9a5182bcce0d947581e90ca58e61bda
- SHA1 8a47de62d3b4da97f02752c98e89a6c522dcb7e7
- SHA512 4143f9bc9261dda77ddd534fb8369342e5c73794b429ed9bdada7a5205c88fef9b13fa14325c486848dba1ac102fed79a8e871d6d74744a13dfe31638d53b684
- TLSH T12AB00255C542F332C44A17B0399599DD7260DF2DDA031216A2F01AF7DC35E704575560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 70dc53a11b6312280c2de17162c300d0b467f0bdde67d0eedd0be6d142402458
- MD5 8b49bdfbbfd081db90b5016ab60cf794
- SHA1 cbcde62c9da952df6040348c31d48278e148c99b
- SHA512 1a119e00484a5b965eea6c27ae0755faaae248b220629aa2816cabadc5368af0ec287e4f2cdddceed3d819de17746ab4fe2bc1df91e9d42096d18b0e4c7938d9
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O3pX6oq3VumXwkA:jeuvBnhJsueMEGvIW1DcP2OxiVumXnA
- TLSH T19ED3864B3A743002EDE59A721CE054BB5E3C716D8F52A5D428B620588EF2863B63D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 355d2631ba7c175a80a5786862f01c4b2417ca75716444118f24170b3f2526a7
- MD5 acb603f463d30040fc51548d31e0c3d2
- SHA1 5f4280c602acc8a0dc081e40b1e8913435b1cdaf
- SHA512 6926200a22b6dda9aebad55f132ce8a95314082c64e23891228eb00d0b0dc24a9a7a4c0940bf3b102eeff18fb1586f3e7ad16de5fee6728a7b6a9ed00150b40d
- SSDEEP 3072:UQGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:em7Rkm1tYpBeh2BAoB
- TLSH T133C3123B5DB4E8375DB5A71EB08E0B2F1EF149A7C920DE92C8D45B0427E97CD1A44A38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 3b2e921b9101b69718c4ae74385041aa63041b9ef55654a15c2b9e40d0c04e41
- MD5 8173b668f3400a8dcab9313a4299ba45
- SHA1 f5bf649f8598aaf86fa44b474a3698d6f4a81db1
- SHA512 578e5dfa16d97b6fce70efecdc9ef4b83c9d1283238145f313e8aa461ed6fb5be42827b1228d3047b7db5eb8002daf0492376d120d32541e11af0db16c1b6d9d
- SSDEEP 3072:ALGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:tm7Rkm1tYpBeh2BAog
- TLSH T161C3123B5D75ED3B5CB5A74EB08E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 ff3ee686b244039cc8e5a2397a03ec7e7073d9d1919324fccb869c53f71ac9df
- MD5 afe8c48c4f6895973e3be515c67ace42
- SHA1 5250fe01c7d55be86c09166b38ca80cec203b50b
- SHA512 118ca8a425036c584ca7dfd194304caf0f14f7118c7a6c0c5ad239bda02407f091e3be47fcaf25d519de2642400d10f1b2281547434557d02f2778fd8b2e6c0a
- SSDEEP 6144:ZPKO8VY/v/3uukrVEQ0nEPm7Rkm1tYpBeh2BAo1:tZ8VY/XznE+9oBGcAo1
- TLSH T1DC34233B5DB1983B1CA5372F70CE0A2D6EF1097AC22599D794C5B70873DA6C90B92E30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 b411b79828d066f5ceb7d42c3b714ced431da5714c449f8272e8bbdf1de89fa2
- MD5 1a1b7876361b65992c131d7082d2dd53
- SHA1 b2e63064b85c36caa02c5a89d48253c63b95ad21
- SHA512 2e6e1078c1e604f0d255cc1fb621981b07b6e48c9884c96fe180bb525641560708b8b6a634fb8b87ccb97e986041e4d8e6a7769398c2770f974e167001a7ec41
- SSDEEP 6144:FXPKO8VY/v/3uukrVEQ0nEPm7Rkm1tYpBeh2BAo1:FZ8VY/XznE+9oBGcAo1
- TLSH T1AD34123B5DA1983B1CE5371F708E1A296DF10A7BC2259D8BA4C87708B3DA5D40F92D30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\workrex.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ui0ebqf.pww.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 242B
- SHA256 f6f0cfa21eb7a22d3b22417659fcb31237489084626f8a2de72c43d4aa5eff67
- MD5 8393a1a3eaf02994a35901a1fb827420
- SHA1 acf4398809462e065e429653d2ad467c465c100c
- SHA512 5a12828d7beb92b27e688391fb62e26c30c6f4fb17d6d141224aebd6f44df20d5d3fa37e1467e0b6577afdb5a0848ccacba6cf1534f7aaf10e55182ee303ac4f
- TLSH T1D4D0A78BB348C6A90001223B81F3CD4CE9E5482C3B13BE705AA5DD4D369188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 243B
- SHA256 f206cb1a1bb266a4ccc47fdebfaf0088f4c55f73ea4424e05e715a698e04c07d
- MD5 17c9a5c02c8d6ea84140112a3af07a88
- SHA1 ae6884df9a709205e4b84fad7d26427c304abbb1
- SHA512 3cd17d6eb8eb245fb4b7a74336f532f9b8697f2f28aefe03a1edb87c5c0e388f1cbe326cb5b6aa077ce3eb5f1c369d8410f86b05180075a2cf8654f2de9de616
- TLSH T1B3D0A7CBB348C6A90001223F80F3CD4CEAE1482C3F23AE30AA65DD0E378188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 338KB
- SHA256 61cb03b0d42bf061a034cdfcc0d5e554129a060130df46b2e194d9d2103efb3b
- MD5 f0ca26673cc582bb9506007a387622ae
- SHA1 1164999d7de47c2d5a2acea72ee503e24b2d0875
- SHA512 5ba456f9359a6f87026e453e091bdb700ceecf20b0ef33f8f470f905e8fcb5d1807461c5ba9a254ce32505270484785f9a184ce3ac24974017b5f543600c238c
- SSDEEP 6144:sK6hUjgJRggggggUxrAPcKQEcuG6M07JTwHjhorjeW6qoHO1oh/2Ky8Qqd5UBPhk:NuGu7tgloNXwOqhLy8Qqd5cEwa
- TLSH T13E74AE00D6F28E1B05894A9B595A76D0F47CB7F595EC96FB20E3BA53F5729E3C22C200
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 339KB
- SHA256 44d4323aae18ea00bd01148bc30bbe6c422461752c9c0593cc51504b38d31ad6
- MD5 6e95775dbd08d75615767351a01276a3
- SHA1 934a38c4c9e8f9c32903e83480f2d4484e2eda5c
- SHA512 4b4d186962f1cf4750324440b6c0af47cdf27e41219823f4a5302543cfc617d2db39ed02a4ad76ca154f50f92b0a46cb8ca3c99b3e2a346e08bb095214c551e4
- SSDEEP 6144:gK6hUjgJRggggggUxrAPcKQEcuG6M07JTwHjhorjeW6qoHO1oh/2Ky8Qqd5UBPhA:JuGu7tgloNXwOqhLy8Qqd5cEwW
- TLSH T15174AE00D6F28E1B05894A9B595A76D0F47CB7F595EC96FB20A3BA53F5729E3C22C200
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 90fb49a37a0b079c8054445e04806c4548345103d2d5a2b031264840c0156afc
- MD5 6bce0d1f66350e25becd35d3dcbbd199
- SHA1 27f88337dea64d7578101f234dac8331e546318f
- SHA512 079699ca4d119b805209701d43685169cc5c98dd182557314dc83532d950ecc4f43d57941d9221f903fc6352320cf08fb663766b9efe75971e40212be8dbcd8c
- SSDEEP 768:ahACrXoD+LmjXsvFisuF+4j//o4TC1XXGblfA01KFcm:qjEDY2SA9njI4TEXGblf91ucm
- TLSH T1A023070437F98511F2FF5ABA4DB19601AB30B4A79C22D78E06D5058E1AB3740DEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH