Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 01:23
Behavioral task
behavioral1
Sample
txsync.io_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
txsync.io_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target txsync.io_chrome.exe
- Size 57KB
- Sample261102-br42nadh35
- SHA256 a3abb0f95cf886a84f90e45341d83d6f6f5ae2a9b813b5638d9fd16f6317d1c6
- MD5 94182453287de205c285576c7bbe00fe
- SHA1 3a71c4b941ae9f08cb203f47fb4b118f241ec0b6
- SHA512 c57c2bc1197b5f752ce5a3ecfcad7a46f8c81599e1aa8e3b92f0a2872e1a92bdc2c9c12f5bc36284c0ecd5d1bbd3e1bb965d58805526760d33cc713ab52578ff
- SSDEEP 768:S1looaNMFTCCL2/p05KFweXLdXYMs43N1XXGb5fAdOTyKFum1G:S1+93CyEKhXJoz43LXGb5feOTyuuh
- TLSH T12A43D64473FD4611F2BF8EBA4DB191114732B8A76D32D78E06D4068E09B2B44CAA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://txsync.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://txsync.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/468-0-0x0000000000E60000-0x0000000000E74000-memory.dmp disable_win_def behavioral1/files/0x000700000002466c-2265.dat disable_win_def behavioral1/memory/468-2270-0x000000001BC90000-0x000000001BCA0000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" txsync.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" txsync.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 840 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" txsync.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts txsync.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe txsync.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe txsync.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe txsync.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4536 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation txsync.io_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf txsync.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf txsync.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf txsync.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4080 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\sysupdate.exe txsync.io_chrome.exe File created C:\Windows\system32\svchost.exe txsync.io_chrome.exe File created C:\Windows\system32\sysupdate.exe txsync.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 2008 wscript.exe 3212 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" txsync.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" txsync.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4908 sc.exe 4712 sc.exe 1532 sc.exe 4072 sc.exe 1540 sc.exe 1896 sc.exe 4560 sc.exe 4100 sc.exe 3352 sc.exe 2444 sc.exe 1340 sc.exe 4516 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3044 cmd.exe 684 cmd.exe 3732 cmd.exe 4216 cmd.exe 3488 cmd.exe 540 cmd.exe 3224 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname txsync.io_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain txsync.io_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1932 NETSTAT.EXE 3100 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4156 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 992 vssadmin.exe 456 vssadmin.exe 720 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallpaperStyle = "2" txsync.io_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command txsync.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open txsync.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command txsync.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell txsync.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command\DelegateExecute txsync.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe\" \"%1\"" txsync.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\txsync.io_chrome.exe" txsync.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command txsync.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell txsync.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open txsync.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell txsync.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open txsync.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings txsync.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings txsync.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.pdf\ = "PDFBotnet" txsync.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet txsync.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1272 schtasks.exe 4772 schtasks.exe 992 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 powershell.exe 840 powershell.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe 468 txsync.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 468 txsync.io_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 840 powershell.exe Token: SeIncreaseQuotaPrivilege 4400 WMIC.exe Token: SeSecurityPrivilege 4400 WMIC.exe Token: SeTakeOwnershipPrivilege 4400 WMIC.exe Token: SeLoadDriverPrivilege 4400 WMIC.exe Token: SeSystemProfilePrivilege 4400 WMIC.exe Token: SeSystemtimePrivilege 4400 WMIC.exe Token: SeProfSingleProcessPrivilege 4400 WMIC.exe Token: SeIncBasePriorityPrivilege 4400 WMIC.exe Token: SeCreatePagefilePrivilege 4400 WMIC.exe Token: SeBackupPrivilege 4400 WMIC.exe Token: SeRestorePrivilege 4400 WMIC.exe Token: SeShutdownPrivilege 4400 WMIC.exe Token: SeDebugPrivilege 4400 WMIC.exe Token: SeSystemEnvironmentPrivilege 4400 WMIC.exe Token: SeRemoteShutdownPrivilege 4400 WMIC.exe Token: SeUndockPrivilege 4400 WMIC.exe Token: SeManageVolumePrivilege 4400 WMIC.exe Token: 33 4400 WMIC.exe Token: 34 4400 WMIC.exe Token: 35 4400 WMIC.exe Token: 36 4400 WMIC.exe Token: SeBackupPrivilege 1656 vssvc.exe Token: SeRestorePrivilege 1656 vssvc.exe Token: SeAuditPrivilege 1656 vssvc.exe Token: SeIncreaseQuotaPrivilege 4400 WMIC.exe Token: SeSecurityPrivilege 4400 WMIC.exe Token: SeTakeOwnershipPrivilege 4400 WMIC.exe Token: SeLoadDriverPrivilege 4400 WMIC.exe Token: SeSystemProfilePrivilege 4400 WMIC.exe Token: SeSystemtimePrivilege 4400 WMIC.exe Token: SeProfSingleProcessPrivilege 4400 WMIC.exe Token: SeIncBasePriorityPrivilege 4400 WMIC.exe Token: SeCreatePagefilePrivilege 4400 WMIC.exe Token: SeBackupPrivilege 4400 WMIC.exe Token: SeRestorePrivilege 4400 WMIC.exe Token: SeShutdownPrivilege 4400 WMIC.exe Token: SeDebugPrivilege 4400 WMIC.exe Token: SeSystemEnvironmentPrivilege 4400 WMIC.exe Token: SeRemoteShutdownPrivilege 4400 WMIC.exe Token: SeUndockPrivilege 4400 WMIC.exe Token: SeManageVolumePrivilege 4400 WMIC.exe Token: 33 4400 WMIC.exe Token: 34 4400 WMIC.exe Token: 35 4400 WMIC.exe Token: 36 4400 WMIC.exe Token: SeDebugPrivilege 468 txsync.io_chrome.exe Token: SeIncBasePriorityPrivilege 468 txsync.io_chrome.exe Token: SeDebugPrivilege 2600 whoami.exe Token: SeDebugPrivilege 4080 tasklist.exe Token: SeDebugPrivilege 1932 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 1908 WMIC.exe Token: SeSecurityPrivilege 1908 WMIC.exe Token: SeTakeOwnershipPrivilege 1908 WMIC.exe Token: SeLoadDriverPrivilege 1908 WMIC.exe Token: SeSystemProfilePrivilege 1908 WMIC.exe Token: SeSystemtimePrivilege 1908 WMIC.exe Token: SeProfSingleProcessPrivilege 1908 WMIC.exe Token: SeIncBasePriorityPrivilege 1908 WMIC.exe Token: SeCreatePagefilePrivilege 1908 WMIC.exe Token: SeBackupPrivilege 1908 WMIC.exe Token: SeRestorePrivilege 1908 WMIC.exe Token: SeShutdownPrivilege 1908 WMIC.exe Token: SeDebugPrivilege 1908 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 468 txsync.io_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 468 wrote to memory of 840 468 txsync.io_chrome.exe 84 PID 468 wrote to memory of 1540 468 txsync.io_chrome.exe 86 PID 468 wrote to memory of 3352 468 txsync.io_chrome.exe 88 PID 468 wrote to memory of 2444 468 txsync.io_chrome.exe 90 PID 468 wrote to memory of 1340 468 txsync.io_chrome.exe 92 PID 468 wrote to memory of 4516 468 txsync.io_chrome.exe 94 PID 468 wrote to memory of 4908 468 txsync.io_chrome.exe 96 PID 468 wrote to memory of 4712 468 txsync.io_chrome.exe 98 PID 468 wrote to memory of 1532 468 txsync.io_chrome.exe 100 PID 468 wrote to memory of 2056 468 txsync.io_chrome.exe 102 PID 468 wrote to memory of 4072 468 txsync.io_chrome.exe 103 PID 468 wrote to memory of 1896 468 txsync.io_chrome.exe 105 PID 468 wrote to memory of 992 468 txsync.io_chrome.exe 132 PID 468 wrote to memory of 4400 468 txsync.io_chrome.exe 109 PID 2056 wrote to memory of 1920 2056 fodhelper.exe 111 PID 468 wrote to memory of 2008 468 txsync.io_chrome.exe 116 PID 468 wrote to memory of 1272 468 txsync.io_chrome.exe 117 PID 468 wrote to memory of 4772 468 txsync.io_chrome.exe 119 PID 468 wrote to memory of 3488 468 txsync.io_chrome.exe 124 PID 468 wrote to memory of 4216 468 txsync.io_chrome.exe 126 PID 468 wrote to memory of 3732 468 txsync.io_chrome.exe 127 PID 468 wrote to memory of 684 468 txsync.io_chrome.exe 128 PID 468 wrote to memory of 3044 468 txsync.io_chrome.exe 129 PID 468 wrote to memory of 3224 468 txsync.io_chrome.exe 130 PID 468 wrote to memory of 540 468 txsync.io_chrome.exe 131 PID 468 wrote to memory of 992 468 txsync.io_chrome.exe 132 PID 468 wrote to memory of 3212 468 txsync.io_chrome.exe 140 PID 3488 wrote to memory of 456 3488 cmd.exe 141 PID 3044 wrote to memory of 3400 3044 cmd.exe 143 PID 3224 wrote to memory of 3100 3224 cmd.exe 144 PID 540 wrote to memory of 1932 540 cmd.exe 142 PID 3400 wrote to memory of 3332 3400 net.exe 145 PID 3732 wrote to memory of 4080 3732 cmd.exe 146 PID 4216 wrote to memory of 4156 4216 cmd.exe 147 PID 684 wrote to memory of 2600 684 cmd.exe 148 PID 3488 wrote to memory of 1908 3488 cmd.exe 149 PID 468 wrote to memory of 3684 468 txsync.io_chrome.exe 150 PID 468 wrote to memory of 720 468 txsync.io_chrome.exe 151 PID 468 wrote to memory of 3208 468 txsync.io_chrome.exe 153 PID 468 wrote to memory of 4448 468 txsync.io_chrome.exe 155 PID 468 wrote to memory of 4536 468 txsync.io_chrome.exe 156 PID 468 wrote to memory of 4560 468 txsync.io_chrome.exe 159 PID 468 wrote to memory of 4100 468 txsync.io_chrome.exe 161 PID 4448 wrote to memory of 1648 4448 net.exe 164 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1540
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3352
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2444
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1340
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4516
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4712
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1532
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe"3⤵PID:1920
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4072
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1896
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:992
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2008
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1272
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:456
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4156
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3332
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3100
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:992
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3212
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3684
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:720
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
PID:3208
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1648
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4536
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4560
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4100
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe1⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\txsync.io_chrome.exe1⤵PID:4240
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261102_012445.jpg
- Size 93KB
- SHA256 98086faf569020b70336d89afd0efeaef3036544d04259028764d9a6f99e0559
- MD5 d00665ef5256dbe39cc9d23be4d47483
- SHA1 2dd850abd75a6bd2463bbf8aabba10d439b51cc9
- SHA512 67648653fa2c5dc8f34065020018ee7f67be0f2bed9a8bd8e4caea599a86e6a45c2fa7a154cac4f10d6d7283231539d415a2118f5896ae16ce685348c8e3de5d
- SSDEEP 1536:Ifiuz0wytsTFidTIMNN7+Tl/c6Mv5555555555555cIItGvA:AXIwzZ0T1N7+6dm5tGvA
- TLSH T181939C178D088783A46947FDBD570EAC1F1A6B1CE4867AFB51760ECB3E606224C8F02D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 b59c60d666a9d926eba983e5c839d0537bee936838398cc28216d5ae6539fe72
- MD5 20d67a4eba3be73a87fd6bd804ac842c
- SHA1 d6b0b0174520291d70692dc45c000a1fc0b934e7
- SHA512 6e0aee68409798d5e4813065683cda35a26a06cef4ddb6e399b4748034c809d526fb4be074dff29e5cfd763e8f481c17e4c49c192b471ef960791abc148c8a37
- SSDEEP 1536:KOjZTIfhhvns4Vkz7ue3vq3tg9OVdIeVpx1O5uP+BJA8ezplLRSku1uwBKYdKP44:KOjZyhhk/zJUiEVdIG7muPHzplCI+LK/
- TLSH T158732A368F22FCD4673F3D40A0603A561C893E6B8B75677CFA810DA669A5540CF3E5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\txsync.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_li5n2o0l.iyh.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 241B
- SHA256 5a247b024022a916c0110e7407f686247f8f0b3b211f6150d7235834c57d7710
- MD5 abe30dc699dd44cdb09143ecb9a37587
- SHA1 2fc77860ec24662bb3f0b751e61965e5870b9347
- SHA512 a87692b8d7db2330409f96875bf859e111cfb94ad49630b641d54855784b43e1019b528953c6517833824275f77692af6210cdec0ee40a4405395e2edd90146a
- TLSH T116D0A78BB249C6A90001223B81F38E4CE9E548683F13BE706AA5DD4D369188589F6583
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 242B
- SHA256 26094773c0162fe54f881c53a158f980db10f0272ad8ab22ec585ae0ae7b5f4f
- MD5 960ab6f5f2e18856bc5135366b0ee732
- SHA1 1db8d0eb0bd94a9801d45131cc62345f347ffbe8
- SHA512 5df3d077f445c84f16bc6175eea9f51dae773e4b4db08073e9ea4dc669b32877b4d39bda20022590c0b2e5d7cb2436a4af0090dc3575d31fbe929e7efbed03f3
- TLSH T1B1D0A7CBB249C6A90001223B81F38E4CEAE149683F13AE30AA65DD0E369188589F6583
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 125KB
- SHA256 8df9d1da766b9fe927080b9d70fd524a24286f0dffb8e7f15f07a27acfe6c6c3
- MD5 3e0333ed52ba60af089973ac359f3ffd
- SHA1 7074ba1b1339e87bbe3dd30f59ed3e421d3d3234
- SHA512 5162a8521efe21b8155eb390480840d33cdaa811b6fcc8db6ca98598e5c6c929584664662a7777e9dc79895cde205e0c46f6295d68e40c989b78424e972daedf
- SSDEEP 1536:+vMeAWFBldgxo/Pj6sD7o0gOVHCTpWHJXqLfYXD7e:QBnOmPj8EcHfYXHe
- TLSH T175C30A11D6F79E7B45D14AAB181236D1E038B7B1D2ECC0FB60A2AA77F0738B2C758651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 125KB
- SHA256 abf5621b7bd48e678fc9617d475455b384e816c060287081a33fea8f2418f20a
- MD5 b6c22062f9298ad690076694cb8dcfd3
- SHA1 1a943f22b4b9e2c29722ad3a588a8aade28d3b8a
- SHA512 4afef5d4d14b3a29fd9f14ec707aefcd629cd3e261604420ce182bf62ca924c2ca8156433ed124ed50b8db8c97133a825a49c6b94510aa73c0b76287687996d0
- SSDEEP 1536:LvMeAWFBldgxo/Pj6sD7o0gOVHCTpWHJXqLfYXD7k:fBnOmPj8EcHfYXHk
- TLSH T1E2C30A11D6F79E6B45D14AAB181236D1E038B7B1D2FCC0FB60A2AA77F0738B2C758651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 9b6b63fb860186c8d5aca772220a018bdc9683c756cd8dfdf31418427b8702bb
- MD5 7a84842ba1d791a92e1d5e0923d97092
- SHA1 55694cf9c749fa66d34d61cd27941752745a1ccc
- SHA512 0514a329ffc0ed789a52ac2731070ca6df479b33d98a781802b50f6418d2f049155245719577f4f6942e41ec696aa3b0af6b408df79c89818ddb01ce54c85816
- SSDEEP 1536:qOjZTIfhhvns4Vkz7ue3vq3tg9OVdIeVpx1O5uP+BJA8ezplLRSku1uwBKYdKP4B:qOjZyhhk/zJUiEVdIG7muPHzplCI+LKc
- TLSH T115732B368F22FCD4673F3D40A0503A561C893E6B8B75677CFA810DA669A5640CF3E5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 a3abb0f95cf886a84f90e45341d83d6f6f5ae2a9b813b5638d9fd16f6317d1c6
- MD5 94182453287de205c285576c7bbe00fe
- SHA1 3a71c4b941ae9f08cb203f47fb4b118f241ec0b6
- SHA512 c57c2bc1197b5f752ce5a3ecfcad7a46f8c81599e1aa8e3b92f0a2872e1a92bdc2c9c12f5bc36284c0ecd5d1bbd3e1bb965d58805526760d33cc713ab52578ff
- SSDEEP 768:S1looaNMFTCCL2/p05KFweXLdXYMs43N1XXGb5fAdOTyKFum1G:S1+93CyEKhXJoz43LXGb5feOTyuuh
- TLSH T12A43D64473FD4611F2BF8EBA4DB191114732B8A76D32D78E06D4068E09B2B44CAA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH