Analysis
- max time kernel
300s - max time network
285s - platform
windows10-2004_x64 - resource
win10v2004-20240508-uk - resource tags
arch:x64arch:x86image:win10v2004-20240508-uklocale:uk-uaos:windows10-2004-x64systemwindows - submitted
03/06/2024, 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xylex (1).exe
Resource
win10v2004-20240508-uk
windows10-2004-x64
10 signatures
300 seconds
General
- Target xylex (1).exe
- Size 37.6MB
- Sample240603-mgrjcsbc31
- SHA256 4c5b20b4ca8009ab72a76ed7fa6e09bd1b0b78969980f2b49d9a6641439c8d7e
- MD5 8eacf3f9be7e3735352c4020fc4e05e9
- SHA1 0bb6c048d9e683e152de21f7d368a4c151095504
- SHA512 2f5c54c4561f14fbf9a58075dffe268247f3af3408084c12a8a7ed0fbb33f01448e85a06ba684b037e0489fbcbb7481a825cf23785c7b7c1d60c28467825e3f0
- SSDEEP 786432:R3on1HvSzxAMNjFZArYs4nPv0so7OZJJe:RYn1HvSpNjXm4P5u2e
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation xylex (1).exe - Loads dropped DLL 1 IoCs
pid Process 3620 xylex (1).exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618841659175199" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 2552 chrome.exe 2552 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3320 wrote to memory of 948 3320 chrome.exe 93 PID 3320 wrote to memory of 948 3320 chrome.exe 93 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 2608 3320 chrome.exe 94 PID 3320 wrote to memory of 3420 3320 chrome.exe 95 PID 3320 wrote to memory of 3420 3320 chrome.exe 95 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96 PID 3320 wrote to memory of 4580 3320 chrome.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\xylex (1).exe"C:\Users\Admin\AppData\Local\Temp\xylex (1).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
PID:3620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff99ddfab58,0x7ff99ddfab68,0x7ff99ddfab782⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:22⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:12⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:12⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:82⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4716 --field-trial-handle=1852,i,13600745987457016639,968689691399467058,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 f078dcdceaaaf8d741b6b465f8c1b2669ed83ee570c201857fafa818641ccde7
- MD5 a0ef85536367852cab5d40d31f4edda6
- SHA1 3330b3099f85a9753e4dad1bf0d4eccf139a0bd4
- SHA512 b5fd921968c7fec33930d6d1dc4af51b271c6309c02ee10ad38eb25b64913afd780f3589d6c4cd48eaca8fad02925c5769e2538e10c5ca77e22b02ddd53d852c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 7586fc80f92c5d840d28ee858c950164f080e642b131b5c6e51a408faedfcfd0
- MD5 7859d4f82a0b74729b15c0384c17c1ae
- SHA1 9b2ae7b6390602aede6644c503bc5b2d93857a62
- SHA512 3e3868f10ff5c71d3e995d2c802b58d81990f0c44c9769490a6152b7398e8aceeb0c42e1dd7560cfca55a777dcec0469a5a3cee4e59472086863ef585d8157ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 a6a1a4206ee0edfcf864afd389d55dda9817bf823ba80135b5fbf7449a61a210
- MD5 4d55b0e4ff204da6a8244a83fe1dd7a0
- SHA1 58abcb539dc097545d9d69244f4850dda4bc2885
- SHA512 4efb23097230bfb31a121266979beba7bf6b3e4768e44c7bea2f81e85e3abeb161a193620a746664df31da3225f8598d7e42cc396f3c26544cce8785ff2668ab
- SSDEEP 192:idC5xsRIE8aJG8syh+FCCWeP5tjEsXtScR:wC5xBgMyqpWatIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 d52351d10d64d111f18337db2ec6b3498f59c4e7b90d090ed05597574be055f1
- MD5 7f118ad623f8ddfada7777d9e1133c1d
- SHA1 0d13b51cb3fb8a1a80e51a18947f3a7102341be9
- SHA512 49a154a6545d08aa4140189f7c0ff448c49df271b71b44cbd5778d2dfea8a82858b3066bbdeece27167f3f692c28bea3e4cb4ced32e70e08d71c921b5d935904
- SSDEEP 384:Vx1oLPLeCAXlj1kXqKf/pUZNCgVLH2Hf94hrU8lHGZXjH3:VroLPLXqlj1kXqKf/pUZNCgVLH2HfGhG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 281KB
- SHA256 99d3dd59cf036d67b4e75cd0709f62732042034c83dbd6e87ae2ab1c9fc17509
- MD5 7bba480186b67fb638f6fd116fe2b397
- SHA1 c118a919c57a26e0b7e591b7be1ea13a0a14fc8c
- SHA512 6691557fa0469157eed951986199cb65fa1e0d6dd73416ef8ec57c725cb0e8b8a851917c58bddfaa8ebac4a8a979550a27aa279cb7b02c6490467a031d4b7cf2
- SSDEEP 6144:hlARo7/1F4hp8CxFBa8FwWLCuKcYd6rI1Qo5yzkpeXjnJFzXsWK:zUoz1CxHFwWLCZcYd6EjCkpeXtFbm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 1df5c91317976c90ea4b3c694fb043be203d3f3340ec3545a90693c734945dee
- MD5 1062f81978d5861e6df1124b2049895d
- SHA1 67f35470c03176ee3565384f70c53b7d0eef4ef1
- SHA512 d55531d33f3fbe43e6081175138aaef30c5cdf9e84d0d2b1f3a58170c5abec8e75344d499c6ef71ea908261a386dd386a1b90b177806d56db8b37a719c692349
- SSDEEP 6144:uZrI1Qo5yzkpeXjnJFzXsW6QYRPILxZnhLMJjX0EeGzY2rLn:UEjCkpeXtFbOQ5fnReEFsLLn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 261KB
- SHA256 50bbbf86d04df7b2d7afe72ffb9be0168ec88f2dd4327a3b38d1e1978fb089f9
- MD5 8993c80689082f12550792db3aa6c3bc
- SHA1 875a93c2fc1f374fe1eefb8c2f6a4d58c3366afe
- SHA512 b2b8445766d7cbb51e15b2f45e19a617736b1a7b9ac2d41b8870d798e386d78aa6350701d7234ea263e45a4bfe7c02313f01a7eed63c97d35ae2b337cb93634d
- SSDEEP 6144:hl1F4hp8CxFBa8FwWLCuKcYd6rI1Qo5yzkpeXjnJFzXsWK:f1CxHFwWLCZcYd6EjCkpeXtFbm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 261KB
- SHA256 bd4ef35b2a5ae89b231fd668566b6e9a930bc6a4d17f2ac7acdb9f18aa7e1b18
- MD5 8d38a2d9aaa00aef213ed0bb2336924c
- SHA1 afb8056b3c1a363bd740ea7fbfb58b45ab513869
- SHA512 3b8169442b926413c9bd31769db1f2a6a9c8d5b0212b9189e024cb8ccb8f7aca70dcc804161ca261e3e7d7efd3981c9197ce4f1538b322f07c5b7d2642f47e7c
- SSDEEP 6144:h5G1F4hp8CxFBa8FwWLCuKcYd6rI1Qo5yzkpeXjnJFzXsWK:+1CxHFwWLCZcYd6EjCkpeXtFbm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 93KB
- SHA256 fbe9d3cc532b6109d507c3ea6561218e532d9cf9b70760b85c94b9f505071ab5
- MD5 ef95c2f0e22a000c8a3c4dc1ea654c94
- SHA1 274b33677321b8fc04e2875e40c914537cde2654
- SHA512 5e6902990fc5eff9d4e61d2d6e84c468f9d8ed8f23dc6847dfd7d6d63958b79ad19ee021747687bef3303eea58ca9002534d70ca99869384201b888513ec0b5e
- SSDEEP 384:Q43AxEQvE+cG4XR1fFF3yIPpAQafoEKyIZ3WlQKG4s3BlbforuO+wrbDEqRB8zea:uiQehH+hrtyp/lOK0O3P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5867ec.TMP
- Size 89KB
- SHA256 d954b9e9ec427b166dfa4edc01c8e404c0c6c59e2bedd60554fb1dd24a3c2547
- MD5 9ca09c73bc922c2ca424fa2e2947a2cb
- SHA1 0d8e74b115696c842599672550a3bad20debf67f
- SHA512 1ab40812063ae9cbb0c38305e6c9477c735b3b1305dbf64668edc5d57b0945fd7f9354c681d48ca4a8bc9553edcfab26cadf689414e844976e2abf93c856bf77
- SSDEEP 384:J43AxEQvE+cG4XR1fFF3yIPpAQafoEKVZ3WlQKG4s3BlbforuO+wrZEqRB8zeNXl:3iQehHMhrtyp/lOK0O3q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- MD5 SHA1 SHA512 SSDEEP