cc8a03b2902ccae9941828f4d3a06be678e0d97ef171c9c77c3186dbec54ec4a

Analysis

user interaction
yes
max time kernel
899s
max time network
899s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
R2R.rar
Size 734KB
Sample261022-2ksyxsys9k
SHA256 cc8a03b2902ccae9941828f4d3a06be678e0d97ef171c9c77c3186dbec54ec4a
MD5 348b8c4fb418a8fb9c9505e39b47e90f
SHA1 aa4fb698b9838ff283b5a73d508376f33d08b158
SHA512 628c54c225d8f9b3020ac7e63d2b2423ec882d65891ca7a7f2fbd60fc294222e44b94b7e2a3a26089ca1ec76fb1cff9207508a4e31676f54079b17e5949d654d
SSDEEP 12288:9LkPYdkA9XA5XoQECvV3m1stvnNjM650sCKB2vlv1ocGOdKUAWle05skegW6zRYU:yPYd39QVoQE241G1VLSvBWJPgWORP
TLSH
T1D3F4235938968D455F7C2B62B9259AF3C3EC324F219C3E2C198FCAA4465BE8D4361CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4016	XLN_KeyGen.exe
4416	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
4416	keygen.exe
4416	keygen.exe
4416	keygen.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XLN_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3160	chrome.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x00020000000235f3-68.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	keygen.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{C8A2420D-8931-4140-9C1E-45D9E0B95FFD}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	keygen.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3672	NOTEPAD.EXE
4468	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
3400	chrome.exe
3400	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4740	7zFM.exe
4416	keygen.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4740	7zFM.exe
Token: 35	4740	7zFM.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeSecurityPrivilege	4740	7zFM.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe
Token: SeCreatePagefilePrivilege	2988	chrome.exe
Token: SeShutdownPrivilege	2988	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4740	7zFM.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
4740	7zFM.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4416	keygen.exe
4416	keygen.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3776	2988	chrome.exe	99
PID 2988 wrote to memory of 3160	2988	chrome.exe	100
PID 2988 wrote to memory of 4604	2988	chrome.exe	101
PID 2988 wrote to memory of 4604	2988	chrome.exe	101
PID 2988 wrote to memory of 4920	2988	chrome.exe	102
PID 2988 wrote to memory of 4920	2988	chrome.exe	102
PID 2988 wrote to memory of 716	2988	chrome.exe	104
PID 2988 wrote to memory of 1736	2988	chrome.exe	105
PID 2988 wrote to memory of 716	2988	chrome.exe	104
PID 2988 wrote to memory of 1736	2988	chrome.exe	105
PID 2988 wrote to memory of 4904	2988	chrome.exe	106
PID 2988 wrote to memory of 4904	2988	chrome.exe	106
PID 2988 wrote to memory of 3748	2988	chrome.exe	107
PID 4016 wrote to memory of 4416	4016	XLN_KeyGen.exe	114
PID 2988 wrote to memory of 3288	2988	chrome.exe	123
PID 2988 wrote to memory of 1608	2988	chrome.exe	124
PID 2988 wrote to memory of 3416	2988	chrome.exe	125
PID 2988 wrote to memory of 3400	2988	chrome.exe	128
PID 2988 wrote to memory of 1120	2988	chrome.exe	130
PID 2988 wrote to memory of 1120	2988	chrome.exe	130
PID 2988 wrote to memory of 4288	2988	chrome.exe	132
PID 2988 wrote to memory of 4288	2988	chrome.exe	132
PID 2988 wrote to memory of 4428	2988	chrome.exe	133
PID 2988 wrote to memory of 4428	2988	chrome.exe	133
PID 2988 wrote to memory of 4432	2988	chrome.exe	134
PID 2988 wrote to memory of 4712	2988	chrome.exe	135
PID 2988 wrote to memory of 4712	2988	chrome.exe	135
PID 2988 wrote to memory of 4348	2988	chrome.exe	137
PID 2988 wrote to memory of 4348	2988	chrome.exe	137
PID 2988 wrote to memory of 2080	2988	chrome.exe	138
PID 2988 wrote to memory of 2080	2988	chrome.exe	138

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\R2R.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff96b65c728,0x7ff96b65c734,0x7ff96b65c740
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,838474947971220837,513876962153462293,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,10291157432343370917,3163871515058296566,262144 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,8620559796883666981,2851377736445117475,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,4028366126040312547,12159036516584891818,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,1439436479329627825,15378692276124333756,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,16351250614620155884,10938583371760912667,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,18349801311277449292,17477179687512857005,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,8233619678120892386,1039300426877544131,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,4196993160695902416,8586038206820296460,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,3001835507030231561,16301319657928741965,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2456,i,13005591356993656684,8416877622212990618,262144 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1268,i,3120351326607209931,16188185922179815596,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=240,i,1493567027747949432,3628384181218502209,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=2904,i,15394346750158671330,680768611039518901,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,7037664832551694071,14384528799884125710,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,6880519751237885035,13339656250392038983,524288 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6548,i,4889840458857881683,14039803789943208124,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6576,i,18282483207118539734,15535896731433294407,2097152 --field-trial-handle=2032,i,17966951809752649529,5492957350850146244,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3248

C:\Users\Admin\Desktop\R2R\XLN_KeyGen.exe
"C:\Users\Admin\Desktop\R2R\XLN_KeyGen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4416

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x2fc
1⤵
PID:3124

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\R2R\R2R.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3672

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LicensesOI.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

056a5e8b-e0e1-4981-b6cc-f1c161e41d7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\056a5e8b-e0e1-4981-b6cc-f1c161e41d7a.tmp
Size 270KB
SHA256 2f5039e562cb61915cb0e45afeddba374a1516cf604b2983cadbefbfa25e0399
MD5 0b0c5dde0516c0900bc8b50690bd1c6a
SHA1 b04006b83a7f55aa1e38783eb9e3bcdd1c8ac6a1
SHA512 e70a770415a409bec68453b748fb087e848f5f369db0b78d30bce8a7e522539b0bf5d955bc1643baebe4898bf578fae2a66dad2d71db1cb73b516595192a1f4f
SSDEEP 6144:HNXLufuPSCbCbJ8xU9/M+hFD+7t56OD9ZfSApprI:HQASCmbJ8GiyFSXD9ZfS4C
TLSH
T1494423327D5DEC6F85712845B23B53018F7DAEDFC489698D5807AAC6E24FC4C9A23C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

834e8a4e-dee4-4388-8241-db848e191afd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\834e8a4e-dee4-4388-8241-db848e191afd.tmp
Size 269KB
SHA256 847fbfa8c244ef90de291c7800dffe6951a064fab047b46c8926f6931e6b9ffa
MD5 2d9550efddfdddf1ffa5bf7e1f5c6d3b
SHA1 a7b5f0f2c2cd88b250c60237c764a198d8316cbf
SHA512 64c2852fdc231ebeeb8cd2e61af7d35bf13c70af85165373385516fabcdfd03f917474545b6db8d94c1a3dbe0d84c573e990a231777a760487055f08dc6eb00d
SSDEEP 6144:HnLufuPSCbCbJ8xU9/M+hFD+7t56OD9ZfSApprI:HCASCmbJ8GiyFSXD9ZfS4C
TLSH
T17D4423326AADFD6F81712441B23F4302DF2DADDF84C9658A49479ACAE24FC4C5623C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1eab6198-3853-4ad3-a829-9b375ab4f447.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1eab6198-3853-4ad3-a829-9b375ab4f447.tmp
Size 12KB
SHA256 e678117534a2dfb691a76b2f58601baad69b838b8fc3f7dfcec5083e065a3597
MD5 68aea929418f64efabd7f9243a023291
SHA1 6e95dbfb0b92858d3730ab5a57ca3f076e6fa511
SHA512 2a23b4961a8cb65513b39b28339aee56fc3497bb26023fe1f382ca7aa73f8e24601958f3cd4b3b5cd2689570906a1e9b371de510fc55b51989543c0657b8e462
SSDEEP 192:7RB0w86ev7Up5PRppv9/Hsb+WNndpI0Ozk2mDEeY/jaUVyIsnAUgraJ:7RB0saA3XphwM0r23aQe
TLSH
T12242962EAD20793B9CDBD21AFA627B67D7F5102124942E84E6FC8D3C19E76CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27b008b5-09e4-4e7d-9183-4f14780033fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\27b008b5-09e4-4e7d-9183-4f14780033fe.tmp
Size 414B
SHA256 cf9bafc8ffd7f2a1a063877c226ef0548efe446f9a974c08a04187280cd81368
MD5 446166f1c90691dff0ce493c2c436755
SHA1 6fcc5b801fd835608c16142c41aa4d3f3f5f0e52
SHA512 085f2353836ab17e74acb131e89dcb5a970d2dc5e19fb53fd92104e58f7f06b793e76e1f0ad2d1e05605f5c327ef2c97b9474e1cb5b8202f0a053348e0b74ed8
TLSH
T1E9E02BE5C851EC7B1DFD476854750746EA5013572741465B373C990C8FF573705868AC
MD5 SHA1 SHA512 TLSH

Submit Download

2ddcb924-9e03-461e-8d7a-1bd9ddf95529.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2ddcb924-9e03-461e-8d7a-1bd9ddf95529.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

355e7815-0379-4caa-975c-b116a895f068.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\355e7815-0379-4caa-975c-b116a895f068.tmp
Size 11KB
SHA256 aea5f3462623a41d2967237e1853028fddf64dfd50c7f8a7bcc484bb3ba3b024
MD5 492d362f88593f17b9ea1793c02afb66
SHA1 8d74f89b3dc20652a1c6de6d5f9a8b37708656da
SHA512 9fff9651e1c0a90261d265a3054f747e57901f5ced641988b5fc216a0e0ada5e44ddc8f2d351c43c7a3e1358943453263e4fded0d03f5f9e78c48a43ebfb45b2
SSDEEP 192:7RB0w86ev7UpAPRp2v9/Hsb+WNndpI0yzk2mDEeY/jaPVyIsnAUgtaJ:7RB0saAUXchwM0f23ap8
TLSH
T14B42962EAD20793B9CDBC21AFA627B57D7F5102124942E84E6FC8D7C19E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cc16eba-5866-4f8e-90ce-98fa109fd188.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3cc16eba-5866-4f8e-90ce-98fa109fd188.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ab2207a-fe4a-4a9e-8895-04ab1e6fcd37.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ab2207a-fe4a-4a9e-8895-04ab1e6fcd37.tmp
Size 13KB
SHA256 7e341303ad210e958d0fc5fdd1d53a71236db5ceb000eb334e053dd5fa42a1a8
MD5 5ea6ada415dd060caff3650fdd1d24f6
SHA1 78a4b6dd2bf1a0c8cecd559d8daf92995bf6817c
SHA512 8681db33ff3a6f3614750b0fbd3ac973133ffb1e40dde6f2f22c39d9d88ea37af09e327339d2fd50a8e2c7ccd880d62ea4da2ab01b227dd697b8f814aca4d709
SSDEEP 192:7RKcBz0j8l0v7xp5PRppcIwv9/Hsb+WNFWPDwr6R9Qvohzk2mDEeY/jaUVyIsnAq:7RKmz00wV3XWhwdoSo223aQe
TLSH
T10852962AAD60697B9CE7C216F922BB6BD3F5202164D41E80E7FC8D3C15E76CD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fdc1e5e-b78c-405a-9fdd-96ae95124aa0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8fdc1e5e-b78c-405a-9fdd-96ae95124aa0.tmp
Size 12KB
SHA256 16af200b3cc19996ca07052700644668a6967860dcc2c7bee1653407ed537e1c
MD5 b29c4fae69b2e4ec09d3759e41e0293a
SHA1 017dc94f4cc11a5b8b95b7f7c1650714994195cf
SHA512 bacae25025866afc51138c3e78da14dedaa92904f27b3cac03a9212d41d368df6d4b59c3dc8a20942b6fd037b1bfe4e5f330bccf468439c7db433bf509975d52
SSDEEP 192:7RKcBz0w8l9v7Up5PRppcIH9/Hsb+WNnDwr6R2Hzk2mDEeY/jaUVyIsnAUgraJ:7RKmz0z9A3Xzhwso2Y23aQe
TLSH
T17352932AAD20793B9CDBC21AF9627B67D7F5102224942E84E7FC8D3C19E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

980174b1-0cc5-4b6a-96c2-47fffd1ba099.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\980174b1-0cc5-4b6a-96c2-47fffd1ba099.tmp
Size 14KB
SHA256 876ff3a47ee3c8753d0b36bffdd937e27ecaba93cca669a44e7140987cc34885
MD5 204ba057209ce1232fa06a109028ec90
SHA1 bd57874357c93ca84940e09e0806f2123447d719
SHA512 a68fcc24703c8bdfdba584969b8a8a052b7c306fb91297bd18fab37b85555099b6a19086e76b7f2487e5635b7d7ed275ac24a3776d1bd5ad6d3eff9d24484e5b
SSDEEP 192:KRKcBz0j8to0v7xp5PRppcIwv9/Hsb+WNFWPUgN7r+6R9QvoVzk2mDEeY/jaUVyr:KRKmz005V3XWhwuRBSo623aQe
TLSH
T13552952AAD20697B9CEBC216F922BB5BE3F5202654D41E80EBFC8D3C15D76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 77KB
SHA256 fa5b48622993f3cc7c569578515d98a06e386deb806f073cb24f66d6b9fa7060
MD5 79e9e708886612aea2075464dc297246
SHA1 43057fa4f4af69c7bed3ba148f177b342554938c
SHA512 130855ae988a3473855cdbc8f78bab4f462858c3a4f129ef5494b846cf0b7b27ebe7287f3c7a8b2a5bc971e5bd02f5523ff68e48d51165ee80a4a4c0958c5dfe
SSDEEP 1536:wwE7bedTOKqryXPbovUHA0Fe0Avodg/2e9XflWSaOkiC:qbKOLryXTzHx40UA1e1lj7C
TLSH
T16473121596A50BB490889A6FE2E0BD09034B0257B54BCE93455AF53BC8EF3283F7C939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 23KB
SHA256 6323c9aef98808354c05595c17f7862b7d628a6306cbdde8a0e63442d3dfda88
MD5 b0b097c87d61c854926b824f20efc0b9
SHA1 99449a9c3c2cd283ef78dbac33343231b751b32e
SHA512 4d92e22cd8e70faa5b4c72cdc3889d75ca974fee59961c5c653829656feed1aff021d3a88f2b09dbfdb7f4c3df46ef886cbd4499915a8720ac0cef18de33c0ff
SSDEEP 384:nnPnYyJWvtQUw5cRgCX9MX0HW4crugOqfNJmMBXOEgsfSMM8KOyuFYksce4Vw5uN:nvnJqtwO2DMvqfNMM9OEvSMM8KOyuOZ8
TLSH
T1CEB2D00B8A13C6B7C6BB660C868223B0AF77DD894D2B173278416D1199B93FDE6D0871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 f1872f18c411f4e6923d1c3e32c3fb24fd60f14236e26506a95a007bc44dcac3
MD5 3c7fbd358e67b03846f38d9f81af0043
SHA1 d339873a10f4edff45452f9fe8d61430d710fd90
SHA512 9a7d977712aa2840c387eecc013224a0e76fc15ca7e8b5664923856f1e7e09cf0d3d2ee4c7bdc977f0a82ac088dc3c620ff0b0f5bdf391cd984bc90807aafcf2
TLSH
T14121723811A34417CBD46A775BE20577E3FCC48089A28F8A42C3BD34CE733B36461428
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 0ca42ec7711d62db0fa927e047f1971f837d0365d07171bce0199e5ee7aaa8cb
MD5 8ba6ede4d8225fdffd5753b45c36dbd5
SHA1 342b3487750345509e395fee3417a1e852865f44
SHA512 6e6b56ba352628f84acbf3e50b87deae481cf3350adc5e9cb5e232117c74c2db155d62606ee5d6ecbc4c399bca355b94f758c45b692316a861a11eb6d41a3002
TLSH
T15731CAA511921807CBD45A7357EA1677F7FCCAC498938F8702D77E348DBB3A71551014
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 4de05a99b5f7eaef27e42e9486738a3b72aae71bfcaa1fbda26bd09deb2bcb3c
MD5 58a91249dc3b0a198d239c32b10f5976
SHA1 df29d6ec3bb88824ca2d51516bee9902c8716e54
SHA512 a6fce22c0f89e8a49f23407b12afda0ee933a5ad6057e21457e987cc5fba5de7680706bbb1ba2f506f6739b6977281fb45619796d18bb7ea372df5ad5f50458c
TLSH
T19221A6A411634407CBC459375BEA0433E3FCCAD058938F8A12E27D70CE777E72151428
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.mediafire.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.mediafire.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

0bfce317-46cc-4e88-ad7f-34afc9e2e73c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0bfce317-46cc-4e88-ad7f-34afc9e2e73c.tmp
Size 16KB
SHA256 9261d5ce8700f0e2c27d9229e4a9943bd1fd20412323950534e0c07a1a16f2b4
MD5 17d3bf13b1760b532c0ae26d90599ae4
SHA1 a86155cc30ea315fa48d5f98c5ce0a81192455cc
SHA512 024abf267ed12384c4293ab084720d18b3b29f60dee736e4f14bea700ef0c2d9340d680535119e560365b463a60ff9b25991f63b3528f4b12630b532257ebe74
SSDEEP 384:DKf8IbCX74hHwmosFGeSerVaIBgh5/c9Gtz60Ivn69KIfI3InII10nNxxYm4Nilp:lQ4IH4xugO5
TLSH
T1E672BBF7C3D5C56E880156F49B256F1FCF290A29432C3C26C8D8AE5BD3E2432D25964E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29f1e7dc-fc05-4a8f-ad05-32f7a76a5708.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\29f1e7dc-fc05-4a8f-ad05-32f7a76a5708.tmp
Size 2KB
SHA256 97f6ddcaa4edd490fbcc277bbc3a98cab218f6a3c83217855e50b8fb4649f854
MD5 a4fc4f36b787fa9f1c0486df2c04432d
SHA1 366883221d977d7b09e7be5f8506150e76956769
SHA512 a2b383632aad75c9e7adfde272b10fdf12f5c8be206682cf34dbcf83dd51cf8ef222517e799f890a3247f7727ec2ea73bd74f0d31ea37087836dfa4ca3391107
TLSH
T1C441ACF7D7E486BD851156E49A11BF1FCE3D0A28121C3C2288D8AF1B83E2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

62f090e2-1d98-45fa-86c2-ff9ca0e1eae0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\62f090e2-1d98-45fa-86c2-ff9ca0e1eae0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

663582ed-c00f-4201-938c-df74fb309949.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\663582ed-c00f-4201-938c-df74fb309949.tmp
Size 2KB
SHA256 6c08b86e99f536f80e5fa054da3563e0c1126f1c0094ffe3de4af38f4a2be7e5
MD5 94a0b860942110f14bbde9dd77893513
SHA1 3a368cfccea332bd90fdb5666aaa215f49fb78bd
SHA512 8d29b35c4daf0383da1eb40e83f5dd9c1cee7fc9564ae58f7ba64897ff2553d03189a8332820269e26f82d3399776fcf6c9a2c8bb460ce8a5ecd4a4f6f609897
TLSH
T127416C5795BFB8AB102D49BB1E04BD052ABDA839029164F4DAFB837C70C55F70B52472
MD5 SHA1 SHA512 TLSH

Submit Download

8b392818-307d-472a-9d19-f8a8944dc939.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8b392818-307d-472a-9d19-f8a8944dc939.tmp
Size 3KB
SHA256 27ad92c1bc9bc685d8aa20c00310017a7f7b5db035fdd8b28b07b84237261692
MD5 c531a8f25aceccb7e35452f71983ede0
SHA1 0a318cb390aecc91d42af93aef98528a49c6819c
SHA512 18dbb3a353221266bb32b141f0be74fe4c24689a2599d0cc032b4bbbfc3587cb7c8e1bb4e56152679fdd47381a1734e95f4e14e526053bd43169355ee6c001ea
TLSH
T126617CF7C3E485BDC91156F49B256F1FCE390A24132C3C6289D8AE1B93E2972D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 d9f3f89b7fb954a855c0c1eed5ab50e7ee5a36a8b489f4d27f8b517643417050
MD5 59ed3cc5912b84bdb91f335a3adf6989
SHA1 6a80c6adc3dfad9e614cb4104761f92d1c2c74fc
SHA512 45b97b23b2a469d01f7092e70124d00f22305c25ee12bf576e9c7535e5ac257a5c6fef8ec83bf7709e70c68549e45718e8efdfb73a2401f8185c03ddd9113c6f
SSDEEP 384:D0uwlxYtOK9fdU4GfBoe1Odopg8aI0/2Gtz60kvn5ZKIfI3InII1HNxxYm4GiGGc:CQ4IW4xXod
TLSH
T11162BCF783E5C56E89015AF89B14AF1FCF280629432C3C66C8D4AE5BE3E2432D15965F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9861d1e-6990-46ae-942c-5577f050e156.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c9861d1e-6990-46ae-942c-5577f050e156.tmp
Size 14KB
SHA256 8e84baf1a37a78b6fef5136c7b14678c3da34533d5025d5a1497f7bf65027320
MD5 70aa6d06ca11f31e40ff13787d9aaa90
SHA1 055ae36fc1a53120d250f9b8d66ad39642cf5e70
SHA512 4d918c42ae08807d19679c2e700f2246b04af5f60c9ea8860ff88b8128f43788ff034da9fdab0c93808e919ad8afb85d5f38c6ee1de97781509d8571934ef1a3
SSDEEP 384:D0ulxYtOK9fdU4GfBoe1Odp+8AGaI0/2Gtz60kvn5ZKIfI3InII1HNxxYm4GiGG6:aQ4IW4xXoj
TLSH
T1B262ABF783E5C56E890156F89B14AE1FCF280629432C3C6688D4AE57E3E3432E16975F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc9426bd-b937-4cbc-b48d-3e3961d60be4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cc9426bd-b937-4cbc-b48d-3e3961d60be4.tmp
Size 17KB
SHA256 92d782a8ed8200d844100c4e069bf7a3f9337c02de7b9e5854cef3ed06d7166e
MD5 fee640c23a579371b117549c98482784
SHA1 9c1c4c7119c9c5d6b73253fdbc07922706a0aefd
SHA512 2511862aed94bfefb27aa5c7a6be81916c8a06913eb7d870010dcfdfb7e0e0d567bc6663ac153ae0a0c8eb23d94bfc4f600e3aac7dc42af9f39c0c55dea0eb67
SSDEEP 384:D0uwIbCX74hHwmosFGeSerNioxaI0/AGtz60Ivn69KIfI3InII1HNxxYm4NiGG6B:uQ4IW4xbOZA
TLSH
T12982ABF7C3D5C56E880156F49B256F1FCF290A29432C3C26C8D9AE5BE3E2432D25964E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fce29122-6999-4080-8006-1a1271c5b011.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fce29122-6999-4080-8006-1a1271c5b011.tmp
Size 3KB
SHA256 9ae9c0fd638e8548207e4745deb146b4e0c3defee24ee1d478f04db30707f26e
MD5 c7c69c6eab8d9ce94cfbafb5451d932f
SHA1 47bf3a1348eb16c75f3cb516b483c5511e40ffbf
SHA512 02a88a17a3422dbc4701b9133f8d391b353df60c026864c084bec327ac0d6f0dd62507cca1a8f6ba165ce7d92ebdaa4c94c717d1de6aeee25db4298d11cb8ffb
TLSH
T14C714CB7C3E489BD851256F4DB256F1FCE390A24132C3C6289D8AE1B93E2972D25174E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 82d23d607990f8c318560f95d9fe6ebe16e11232a927b309a4a4a5714c9e872c
MD5 b84695f6fbe72de08479fa8297f7eb85
SHA1 725d17772271b1261a09167b19b5c9554e38da35
SHA512 42411d3df7d5385d627092412cd94a56b71bd8cf69d242224a4c296913b9771bd5e5b32213737f2fdcd28ec7b5ca54acf56ea52b134b6d01e2f05092e35840d8
TLSH
T11FA002D042450212D00116B293F511E4A3587A240B834F025CD50A5CDC70A465602650
MD5 SHA1 SHA512 TLSH

Submit Download

a0fcb586-15ed-417f-80e5-b3f4b043c8af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0fcb586-15ed-417f-80e5-b3f4b043c8af.tmp
Size 13KB
SHA256 91608d04b22062356d1330a8b7841d443dfd17f364e5d675ef21138751e35567
MD5 3b77eb1e2db8fe6d9b4df00d3fe58d4a
SHA1 772d4f94cbb918da3d678cccf5d60140db6c1ee5
SHA512 f5d6ba9f5afd5ecb37bbf46315e080c0c5e978f1fb105fe569eccf109abc584ac39e222c759bab03580e86bf14cb9be04904447530d0dc4f97573e34a0411290
SSDEEP 192:7RKcBz0j8lQv7xp5PRppcIwg9/Hsb+WNFUDwr6R2Hzk2mDEeY/jaUVyIsnAUgraJ:7RKmz00MV3X1hwBo2Y23aQe
TLSH
T10852A62AAD20793B9CDBC21AF9627B67E7F5202124902E80E7FC8D3C15E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c78d1632-b28e-43b1-a490-ec0db71f2ea4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c78d1632-b28e-43b1-a490-ec0db71f2ea4.tmp
Size 270KB
SHA256 a56c778e596b289ac43d785f89dda595f6cb95b4e2bdb37dbfe6ba4d787d2f9e
MD5 3dff1367b1e51350955e912e58da55d2
SHA1 d52b137b4a97fe2afd40b93e027931e46288b544
SHA512 661f7b97a0fc87b9300df8c558910ba267acbb3e7b97895a412f05c4651b32bda4477bfce663a104ac30a391caca551f70dafe7cb67cea00b5ccc1e6af7c0837
SSDEEP 6144:QNXLufuPSCbCbJ8xU9/M+hFD+7t56OD9ZfSApprI:QQASCmbJ8GiyFSXD9ZfS4C
TLSH
T1794423327D5DEC6F85712845B23B53018F7DAEDFC489698D5807AAC6E24FC4C9A23C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2240983-cdfe-4342-9800-85e916bff106.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2240983-cdfe-4342-9800-85e916bff106.tmp
Size 130KB
SHA256 0d838b8ecb0d532a5b07628c9ab2dfd47f48bd3bf219f1bf997690bf4fa4cd3e
MD5 9232d7375bbb877c9755cd04e1170d06
SHA1 565c8da7c8ab30f42b23dfdd40f3539d0aa5f6e7
SHA512 cfdc33ec73715615d030f91efc8548e0d6df7e44b72d053a180021a65500d67aada2481a3859ef9f5c59880f5837fafc3f4bb86a65db92fac16eb76ea4931923
SSDEEP 3072:xn/+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:1/+hFD+7t56OD9ZfSApprE
TLSH
T1DAD31232AA95D8BBC9F86541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3ba9641-2892-4579-a220-64ef65c620ad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e3ba9641-2892-4579-a220-64ef65c620ad.tmp
Size 270KB
SHA256 9f8a6497a65c734dba1b95af8892893a41f6c2625969dc76bac3f997f9d52728
MD5 fb94a11d421e33c4d3adfe3d08bc1e82
SHA1 e224f3e960e6437e90fec2cb66710bf265806987
SHA512 82a9101f11c5e550bce24bb34e00ec72d8c7e54726b3699ac4998a5ceff70a1c9b214da9235596c2ee3eda82d87ae42d04aeb04a8857d8a422756d6f203bca28
SSDEEP 6144:fNXLufuPSCbCbJ8xU9/M+hFD+7t56OD9ZfSApprI:fQASCmbJ8GiyFSXD9ZfS4C
TLSH
T1C24423327D5DEC6F81712845B23B53018F7DAEDFC489698D5807AAC6E24FC4C9A23C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff586060-4c6e-4cb8-bb91-92cd137f797d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ff586060-4c6e-4cb8-bb91-92cd137f797d.tmp
Size 269KB
SHA256 09d2e8ec5aa77c3fe54ceb2a09f040915f75dc0b25dd2175bbd78d870b91e325
MD5 af2e6bd6fd47b8c0f51af70c70950a5a
SHA1 7c83f3be39d59ec2f379944269b083e7a95689e3
SHA512 2eaee8d989ddb9b3e6599cc6cd0e3b27abc19d36ab53508e3c2efb79ddef5d7e89fe82439fe9ee248b24b1d1d00e71e26993406ce85712b2d7ee6c60947f976e
SSDEEP 6144:QnLufuPSCbCbJ8xU9/M+hFD+7t56OD9ZfSApprI:QCASCmbJ8GiyFSXD9ZfS4C
TLSH
T13B4423326AADFD6F81712441B23F43029F2DADDF84C9658A49479AC6E24FC4C5623C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RXLNKG.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RXLNKG.dll
Size 7KB
SHA256 6dce820b12b8fa96df5e308c4d9c1cfde93b314636bc03c6b945dafdc00a5411
MD5 c1c6c2eabdd4688bda12c8aab5596e7c
SHA1 7660c87b713076ed60126cb21fcb7aec575752b3
SHA512 ee9e21af755f2bb2fddc5076dcf15bdbb712371c908c2bc10dcb33ee1540ad2f793181b2da1a74d0f375d18ae4436507770c0fcecab0bc7a9f298babad6c5f49
SSDEEP 192:oT5mxeH8GGp1PCKYyj4gXi9GsD1jzGgv:eo7q/gLQJ
TLSH
T11FE1D67792C68490F2D502F51BF2EFDC502DB8112B21B7F76732A87518E49D1BA37612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 444KB
SHA256 c10b62df47adfd347748241c8ac86436ca5a3965c0b227d3d148ccbf6728176b
MD5 c1bd67287fcb7d4c3f6753518aac6123
SHA1 01a2cde43e495322d42c7148456740d847029cf8
SHA512 a9ffb90c8e1e8faee286b000c18a28c3f67c4d52bf1c69f393c5eea3f8af387bf2873c1cf81736c7307129a038209e3b6efc4e8f76b9b7dd8c93c93ec763a85a
SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAONEiFGn4eg6QKxE1aal/p:ic/kEPDonR6Y436vREiFGnJEFp
TLSH
T153A47B419382CE78F2DA81B98DFB7B2BE12062245712A5F7C25B3E37ADE42DD1C74215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicensesOI.txt

Path C:\Users\Admin\Desktop\LicensesOI.txt
Size 2KB
SHA256 d5a1e65e1275859b226ef2659cd39055b3e2c792c335af98d2dc1261cd001506
MD5 bac6bc9a5fb42586fac37b1222ada958
SHA1 691eb1d82a93f3a36986880221d83ee64cae9bcd
SHA512 a865b17c7d9f732820696715bafd26424950998d89b686c41c656f1c868d7ce8dc91fcbcd5a4e4388895ca44747628c484cad7180d7f7f6e87326c3c98793996
TLSH
T1A241202F81444D4BB3633D76EAA87F6745EB10754F7F8899F4DBA4B22812306461158D
MD5 SHA1 SHA512 TLSH

Submit Download

R2R.txt

Path C:\Users\Admin\Desktop\R2R\R2R.txt
Size 775B
SHA256 78e3ea522d82c6c4a20a2a0c9cf44ddb3b87f609310c58efd036233fec616ca2
MD5 6d6df4ad48cc28b94d8c6aeda45a176d
SHA1 81d948c05d7ea722fc6f02de4e2a4c49e908107a
SHA512 6ff2a9e9e6deb9f7e98d34f234a9e552650997cc737122e2ba5eaf0eb9d694abf435ae0e290553788b4c3d77324726e9db0b07c8a2854edd3b07302d64438e01
TLSH
T10D01BDA2B10B43A614E043D76E1EA1D5B709D42858607D89F8AC912E238B887E767D7B
MD5 SHA1 SHA512 TLSH

Submit Download

XLN_KeyGen.exe

Path C:\Users\Admin\Desktop\R2R\XLN_KeyGen.exe
Size 799KB
SHA256 0727f0747bbdc0ba30ae6b8ffdd568244c246fd3c794089379c11d53fbf260f1
MD5 a2beab5ab9e3325e28caff996455e384
SHA1 b294dbb724464c2d295a72a3c1ec32ce8c67dd72
SHA512 8ee1fbe4fb6d9d9d41300c8fbd07dbbf5ddad0e5a23fc82aca8c86e6f74e932f46d7b8bf66417025e89ea4f3b0c19e4c591fa2093029a05a55455e543183af1b
SSDEEP 12288:3c9t2Sll4hOQXpouVFn9OciibEgtUSdpJvaUUbx6ls86y9Mx:3cLGR3HAciiptUkvanAs81+
TLSH
T162052350BBD445A7D46D43791573EBD1BBFA7F201266020BBBED3F3E10B2282911A687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4416-85-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/4416-81-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/4416-77-0x0000000000400000-0x0000000000441000-memory.dmp

Download