kutaki | hxxp://smartechinfosystems[.]in/images/assh

Analysis

max time kernel
600s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://smartechinfosystems.in/images/assh

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe	Payment_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe	Payment_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe	Payment_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe	Payment_Copy.bat

Executes dropped EXE 2 IoCs

pid	Process
380	ybgusbfk.exe
1556	ybgusbfk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	3932	WerFault.exe	44

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2168	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133382467971077574"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000008fca13854fdcd901d39aedb755dcd901924c3103a6ded90114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
3736	chrome.exe
3736	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3656	Payment_Copy.bat
3656	Payment_Copy.bat
3656	Payment_Copy.bat
380	ybgusbfk.exe
380	ybgusbfk.exe
380	ybgusbfk.exe
5028	Payment_Copy.bat
5028	Payment_Copy.bat
5028	Payment_Copy.bat
1556	ybgusbfk.exe
1556	ybgusbfk.exe
1556	ybgusbfk.exe
432	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2144	2780	chrome.exe	84
PID 2780 wrote to memory of 2144	2780	chrome.exe	84
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 5092	2780	chrome.exe	88
PID 2780 wrote to memory of 4932	2780	chrome.exe	89
PID 2780 wrote to memory of 4932	2780	chrome.exe	89
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90
PID 2780 wrote to memory of 1932	2780	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://smartechinfosystems.in/images/assh
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x84,0x88,0x80,0x74,0xe8,0x7ffe5f8b9758,0x7ffe5f8b9768,0x7ffe5f8b9778
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2992 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1732 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3824 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5796 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5920 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5396 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4540 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6020 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4944 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6120 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5256 --field-trial-handle=1872,i,16886335381585216043,16778254347300180763,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\Temp2_Payment_Copy.zip\Payment_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp2_Payment_Copy.zip\Payment_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:3656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4916
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:380

C:\Users\Admin\AppData\Local\Temp\Temp2_Payment_Copy.zip\Payment_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp2_Payment_Copy.zip\Payment_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im ybgusbfk.exe /f
  2⤵
  - Kills process with taskkill
  PID:2168
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1556

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 3932 -ip 3932
1⤵
PID:3944

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3932 -s 2108
1⤵
- Program crash
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
180KB

MD5
497835d373e12af4cd257487dd5d3612

SHA1
425950e9427926ac0aa7940c4a18a44ab59df47a

SHA256
e11ff08dff0a884b311133e2469146b2a54319cf60094511e098df0c3677c4e0

SHA512
aa05611f56185e02289345f9c286ca98f96d5e1d24c8d152605e866e60013dc2945fc60f826e81459003ca9c2b7d439c0f6fdd173cbee57cd751ee51b18d2bf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
969110947344da791aa7af19687dea7f

SHA1
74731e532082b97f4eaa8ecf091a3a59ca311bab

SHA256
f040c4c94e1fbf693040250861344af774e3aed92c4b3f05e5262759cbe5148d

SHA512
1c4f1800e4e1ea0bb718f272d6806d203c58de8d8a596f7806d28fe4605f292fcb72acfd0b55db7e14f3cc6004c77669874b888b63f319ca02c1ea66ff233262

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
d2877244fc00af5cf79da699b9d83f01

SHA1
bfcb8fc58df0811b125abb082e43695219d7179a

SHA256
f752855f1db86cdf81b80d6748253cb0ce71cbf5a64fa6ed9a40d71c31961f1f

SHA512
9bc556eb1da9cce4b1e784a5d3e24de27ad9bffc7d386af5707ce681180e4bf45a2ec4c524fa497a5238142cdf13a7cfde7e81b74646aca416e2b1e1790eebec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
be775e03f4a7128f27a3f6ae32a10307

SHA1
4ed462192a8204c84b21dbd3f0b45345bac53020

SHA256
a60ad1a14bc318dfe01f0c6529bdc1fb10ca4a8e95a85c906345edb6767a1e87

SHA512
4353e1b1fda0bddf4750de60214ca81ecd28ca5b0a99a6e364321e44d04a58a69859b0d25eb36f1f87168c3ade7e3a2cf1873d0387a2ccf7b82e979ee6abf06e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
661f31f279e0e62b207c9abb57a1fae5

SHA1
548c62441019559c81e71c3e8eecf63af06b56bf

SHA256
92b73eb9c687921f49d495630f88189bd82e7a7843c5ab87924068527fedd792

SHA512
0d546fc623e362160c403260a3caf0f71200a82f3403fbd4a660a33c7c88a8e201b4eaaa310a617e49edee3eb816435cc726589b5a415b0815e4867ff11be914

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
fd50d6fe4dc27d459b11ce7fa6f4b3e0

SHA1
f452e5acb91b49f915e07f073fe88bc95c56021b

SHA256
0483516a6198939d4cd61efd60584d3d6c41c41d2a89b9d16effa37f9ac0cf5c

SHA512
9df9d985599bd330c9e3bdcd49d07e0d038899782254147d4948d7af09b33e87c2a98d5f1cf9a2d2c353f684ce04fa17dd30b3fe89f351e3437fde3d4ae4165d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
86f6a88b8c3631e196b0b070805a9540

SHA1
604157bf91e582ad02d561480991114861c3c5d6

SHA256
653af2d5c308e3fce283f287565ea48ea948f5c5859465b752d7439b69097a1d

SHA512
4d12bf2c35d10c986dddff5c7dbb2b45b37fb2777f8ea2c6b1956e24e045ef89de222b36eaa4ff81e36a6195e29fd33c543207ed2b3cfa7c242002f677ce4bb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
f847bb96aeb531e7cea0e341948193c9

SHA1
0233205a15ce17dacac3742010f5697ff2f16bf0

SHA256
b6a6f386957dccf5deec6f1d9d08be08ccaff7e0c947c5a6c23f2a9888da825f

SHA512
b80f601d11fab56a67a8de2d6e4c1f37403ef29d35752849533d7a116924c0dde051ed73d0e2f8857fb09ca508dcfe0f55d08c98286cf24aa1bdad9cb300b137

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
cfe5faf7f24bbfa01ea82262c165356e

SHA1
791379e35ba077b9f358ed2a19bdbd6df76ff2cd

SHA256
e912f6984a05e3d8abdbb3be3bc582a5e10260647fd4e0385414b06a61c28fa5

SHA512
92e345fa1d0be1efa35e8dd6b223382e267b176f0b6c494329b1731828948a1b78df614e4aceee3e65143bf6c4c1a6a67d107d126030c89c9285212d5ab7479c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1d813e9c84cfba1b21936021f439a171

SHA1
08d4a1a99ff625723474529a85bf4b253ab6cc1f

SHA256
5410646a907986e31fb1cff6090558f82fcb9c1b9015eb1c74916a4ca6efad18

SHA512
68b6001b3f6ac6eb09d69077cd44b34633a036580aa898cbbd8ad35d5ec81272cc8e79c8d97c22f2f81abfdb84a23d7b12a74a2cc1f78968e833c736bb21bff9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f0c42fd3373bc90c77ee6329898f3948

SHA1
35ef5a433f84bffc2b6aeacef1793c1ce09b2966

SHA256
538b35061a0b7d99e08dc4890384328c1d682a686cbdd7cfb24fd4472e74caec

SHA512
fef9c84d3b73656732c10fe9e649040d88b7e76f46cefb92689ece9293dd1429c5e788f2e36168c64f76886253e26d1062cd7d84d1feae63a18d3b8b58c581a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2fa931c1d7fa0fb94ba2ce201957b11f

SHA1
281c88dcebe21e0e545e472a6ddbea621f89d5d8

SHA256
da60b3547e0673964cce11ca10d37619c3c6216ba8f69e142e107f31b8140e30

SHA512
1dab0281a5b0399c0216abddaa64bbb3c4803e06d06e737a7cffd30e3f07e05ab174093cb83f348030a5e417c497940abb41879e7ba5586f23ba4d871641594e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5901db.TMP

Filesize
48B

MD5
a4bd6d0d97379dae60b33c5fb501456c

SHA1
45910c7c4ff455d78c745f8c3f3250113a79ecb8

SHA256
f339cad8a9596f51dd669a43c833692de8b19a5f90a3656e37e60f44682ead25

SHA512
66c6448926379d936ac798842b4f683a1d36ceef7170b5b267b0fa3bb304730635478056685d61c2519cc56dc431aab449b0768656e5ffdd17fe17dd2e95518c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
97KB

MD5
0b5b8cae47146fe24fec372eece6fc43

SHA1
3cb95368ebd62433407f829b26c3bf4b1a1d0ba8

SHA256
5382623e610f2e9324963e7eb25fde42fbf9e4e30099915259dbf850c26d9873

SHA512
5bae41134de0a36b70608aa8c74489e76ff472e40a340919cdf86a76bd987655b05d723c90935a1f5eca595386d1fe7b2c6166e83964f54787491dc8cfcbe943

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
97KB

MD5
6bc62c00e89fdac869dfcfa2bbc3d82b

SHA1
1a483348c986164f125e332ae61dda0be50a1b07

SHA256
002eed05f2e960b7ad06e859649484a437945ad6f688cdb2fae480463f10d079

SHA512
3b11a4ec68714f0ae16fb760ec00239cdf22c91e1a984998f7bea0be7134332eee887c65cd155b66ec497697b8e468f495b8f098f87f42f75ad089474e155fe3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
f051ce66eb4b02172db0037c6a6f30ed

SHA1
52e86c10904e955973f706aa4df037843b524d04

SHA256
0e3e2f7f6c8615731bc9adadd5203e11bb62a7909816f2d795ee06c7ca88b857

SHA512
33695591cbd1ca96ab3c82ffb64359c9300f1df640f9d58d8634bc777886a053f007441ed0ec09097b7f31790bbc5e84d49119ca8f5a22f9d926e531c5ac7f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe596538.TMP

Filesize
110KB

MD5
9fc3ce6e0e9fc66a29d9f824a579a912

SHA1
cb9604dcbc6fc2ce432b816f9b0310e57afb4113

SHA256
563ccd39ddc1d14f0c77cb5f39cafe2b3825f1b9f46d9315f49588c2127aa7d2

SHA512
c06772060c6640af1d1a6a06de9dbc4f949d8c9031b82ff1112c539c1d97365a7fc63369ba91332609179a41ad21fdf08e684bb77097639b2382281dd78e0abc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe

Filesize
2.3MB

MD5
c591b0acc0df2406355e774f173e815d

SHA1
c6a7d9c4bedf6fee2c142ac5d192c72ff2f2e0af

SHA256
1cd39cb40659f2a2fc0c379cdc87c2150fa3f7421d7760930677d6e9ba6c9dda

SHA512
f11f9df649f9d4cafdb750d8276f555773e26c657183d34b27bb284522b017e207b67950ab4f282a2f0e859b416183623db937abc028f429161de8fd10c646e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe

Filesize
2.3MB

MD5
c591b0acc0df2406355e774f173e815d

SHA1
c6a7d9c4bedf6fee2c142ac5d192c72ff2f2e0af

SHA256
1cd39cb40659f2a2fc0c379cdc87c2150fa3f7421d7760930677d6e9ba6c9dda

SHA512
f11f9df649f9d4cafdb750d8276f555773e26c657183d34b27bb284522b017e207b67950ab4f282a2f0e859b416183623db937abc028f429161de8fd10c646e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe

Filesize
2.3MB

MD5
c591b0acc0df2406355e774f173e815d

SHA1
c6a7d9c4bedf6fee2c142ac5d192c72ff2f2e0af

SHA256
1cd39cb40659f2a2fc0c379cdc87c2150fa3f7421d7760930677d6e9ba6c9dda

SHA512
f11f9df649f9d4cafdb750d8276f555773e26c657183d34b27bb284522b017e207b67950ab4f282a2f0e859b416183623db937abc028f429161de8fd10c646e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybgusbfk.exe

Filesize
2.3MB

MD5
c591b0acc0df2406355e774f173e815d

SHA1
c6a7d9c4bedf6fee2c142ac5d192c72ff2f2e0af

SHA256
1cd39cb40659f2a2fc0c379cdc87c2150fa3f7421d7760930677d6e9ba6c9dda

SHA512
f11f9df649f9d4cafdb750d8276f555773e26c657183d34b27bb284522b017e207b67950ab4f282a2f0e859b416183623db937abc028f429161de8fd10c646e2

Download Submit
C:\Users\Admin\Downloads\Payment_Copy.zip

Filesize
2.1MB

MD5
4f75fcc3c86996544f0f83fef7aa3337

SHA1
1d70114e29de616e943bb5e9be66fefa2905c8fa

SHA256
8ce13d0e37be82bdefcc6f8ab5433bb335ebd9f2e3632d5cf6c339474cde197e

SHA512
ef07c893da64c9c270f582dc38f6803554a104adfb163418a5f09b394dc1d282ce5cae4f5c4099574a4bf487dc95c828f5688f7cbda3d22daf810316c5ed0f44

Download Submit
C:\Users\Admin\Downloads\Payment_Copy.zip

Filesize
2.1MB

MD5
4f75fcc3c86996544f0f83fef7aa3337

SHA1
1d70114e29de616e943bb5e9be66fefa2905c8fa

SHA256
8ce13d0e37be82bdefcc6f8ab5433bb335ebd9f2e3632d5cf6c339474cde197e

SHA512
ef07c893da64c9c270f582dc38f6803554a104adfb163418a5f09b394dc1d282ce5cae4f5c4099574a4bf487dc95c828f5688f7cbda3d22daf810316c5ed0f44

Download Submit