47ce7bb1d2ce73ac8ba39c1c7ccb99802db75f6978eefa449e4f7fa1ec0d3d22

Analysis

user interaction
yes
max time kernel
275s
max time network
331s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 325KB
Sample260711-ttxdpsez3q
SHA256 47ce7bb1d2ce73ac8ba39c1c7ccb99802db75f6978eefa449e4f7fa1ec0d3d22
MD5 01799c3a6d1962910d00a0eb6a1ced6f
SHA1 ed59a1a8c0164e149a2469f6fca26aab250b36f8
SHA512 9015620f28ee384129b74e3e576dacfd9eab08939b9a8237ea5ed20cebc1c6b0ebc35b292231ce1a301e10246aae3f4a6c4a8fb3edb403070f15b44e8d2d8596
SSDEEP 3072:DYigAkHnjzxQ6KSAiTuH488aW+LN7jxRLlzglKRf2JzR:bgAkHnjzxQBSAlY88CN7DBRf2JzR
TLSH
T17C643C25E5D2607F682B8033F27F3318B73FA483A101C929BA1CC5D5AFD19866177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
143	5036	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5036	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2984-502-0x0000000000F40000-0x0000000001034000-memory.dmp	innosetup
behavioral2/memory/2984-525-0x0000000000F40000-0x0000000001034000-memory.dmp	innosetup
behavioral2/memory/2984-1167-0x0000000000F40000-0x0000000001034000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5040	taskkill.exe
4516	taskkill.exe
4092	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282605770765987"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
1488	chrome.exe
1488	chrome.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid
4
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4304	4360	chrome.exe	88
PID 4360 wrote to memory of 5036	4360	chrome.exe	89
PID 4360 wrote to memory of 252	4360	chrome.exe	90
PID 4360 wrote to memory of 252	4360	chrome.exe	90
PID 4360 wrote to memory of 5708	4360	chrome.exe	91
PID 4360 wrote to memory of 5708	4360	chrome.exe	91
PID 4360 wrote to memory of 2584	4360	chrome.exe	94
PID 4360 wrote to memory of 4648	4360	chrome.exe	93
PID 4360 wrote to memory of 2584	4360	chrome.exe	94
PID 4360 wrote to memory of 4648	4360	chrome.exe	93
PID 4360 wrote to memory of 3668	4360	chrome.exe	95
PID 4360 wrote to memory of 3668	4360	chrome.exe	95
PID 4360 wrote to memory of 3376	4360	chrome.exe	96
PID 4360 wrote to memory of 3376	4360	chrome.exe	96
PID 4360 wrote to memory of 5940	4360	chrome.exe	98
PID 4360 wrote to memory of 5940	4360	chrome.exe	98
PID 4360 wrote to memory of 1604	4360	chrome.exe	99
PID 4360 wrote to memory of 1604	4360	chrome.exe	99
PID 4360 wrote to memory of 1796	4360	chrome.exe	100
PID 4360 wrote to memory of 1796	4360	chrome.exe	100
PID 4360 wrote to memory of 1820	4360	chrome.exe	101
PID 4360 wrote to memory of 1820	4360	chrome.exe	101
PID 4360 wrote to memory of 2164	4360	chrome.exe	103
PID 4360 wrote to memory of 2164	4360	chrome.exe	103
PID 4360 wrote to memory of 5932	4360	chrome.exe	104
PID 4360 wrote to memory of 4284	4360	chrome.exe	105
PID 4360 wrote to memory of 1332	4360	chrome.exe	106
PID 4360 wrote to memory of 1228	4360	chrome.exe	107
PID 4360 wrote to memory of 5368	4360	chrome.exe	109
PID 4360 wrote to memory of 5368	4360	chrome.exe	109
PID 4360 wrote to memory of 2336	4360	chrome.exe	110
PID 4360 wrote to memory of 2336	4360	chrome.exe	110
PID 4360 wrote to memory of 6076	4360	chrome.exe	112
PID 4360 wrote to memory of 6076	4360	chrome.exe	112
PID 4360 wrote to memory of 2492	4360	chrome.exe	114
PID 4360 wrote to memory of 2492	4360	chrome.exe	114
PID 4360 wrote to memory of 3316	4360	chrome.exe	115
PID 4360 wrote to memory of 3316	4360	chrome.exe	115
PID 4360 wrote to memory of 712	4360	chrome.exe	116
PID 4360 wrote to memory of 5924	4360	chrome.exe	117
PID 4360 wrote to memory of 5924	4360	chrome.exe	117
PID 4360 wrote to memory of 712	4360	chrome.exe	116
PID 4360 wrote to memory of 4408	4360	chrome.exe	118
PID 4360 wrote to memory of 4408	4360	chrome.exe	118
PID 4360 wrote to memory of 1488	4360	chrome.exe	119
PID 4360 wrote to memory of 2428	4360	chrome.exe	120
PID 4360 wrote to memory of 2428	4360	chrome.exe	120
PID 4360 wrote to memory of 2700	4360	chrome.exe	121
PID 4360 wrote to memory of 2700	4360	chrome.exe	121
PID 4360 wrote to memory of 4564	4360	chrome.exe	122
PID 4360 wrote to memory of 4564	4360	chrome.exe	122
PID 4360 wrote to memory of 1944	4360	chrome.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb4,0x134,0x7ff9dd5dc728,0x7ff9dd5dc734,0x7ff9dd5dc740
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,9455722096652110377,7637599182248051943,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,3550320908329114247,6588602437991012711,262144 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,5023850535525300266,6503763981655158432,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:13
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,15952855793845768958,14309372849162243045,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,2163108487726336272,12431435921096541456,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4720,i,17918177151147582294,15561102219085262386,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4852,i,9340207888387683911,11880680949658389003,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5592,i,17207123320890107152,17035646886790882864,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5640,i,11220753739539408035,13295472812944694367,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5956,i,17289681610659971224,10493035478503756016,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3460,i,10442345038966168901,4061546064468368747,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4772,i,18265467065808345980,308382267923230784,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,7512988140479076148,16637430894984297856,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,10557683032106982417,12218324699266268450,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,6294149721147014272,6362871097728249598,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,3085391284789793410,3809287435812919950,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6632,i,17908043814572767036,7005874685430187388,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6616,i,13537891361848771735,8780334499349991426,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6600,i,12239166364085047736,17389338396135011568,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4900,i,994222711132920918,12963680792679939140,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6684,i,1020304349625835799,9777216281268676287,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6736,i,2962170480018120050,6341937283758809969,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6600,i,4086513004374433315,12928252604936954231,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6140,i,9310020953051690070,12479974887649037632,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6720,i,11169334431479311766,15707021223216402717,262144 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,15685917465999591651,7220254821907155043,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4736,i,4213831822687321092,15446330818466014414,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5496,i,10243460828660331568,5627571917325431887,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,1415730984948316738,9827656115785155787,524288 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5364,i,16648291279610321091,15046972275649238520,2097152 --field-trial-handle=2012,i,8284895631658478481,12074938418891014766,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4324
- C:\Users\Admin\Downloads\LyXel_Setup_v1.4.5.exe
  "C:\Users\Admin\Downloads\LyXel_Setup_v1.4.5.exe"
  2⤵
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\is-WYETN6YNK0.tmp\LyXel_Setup_v1.4.5.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-WYETN6YNK0.tmp\LyXel_Setup_v1.4.5.tmp" /SL5="$90272,117933950,939520,C:\Users\Admin\Downloads\LyXel_Setup_v1.4.5.exe"
    3⤵
    PID:3652
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM adb.exe /T
      4⤵
      Kills process with taskkill
      PID:5040
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM scrcpy.exe /T
      4⤵
      Kills process with taskkill
      PID:4516
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM LyXel.exe /T
      4⤵
      Kills process with taskkill
      PID:4092
  - - C:\Program Files\LyXel\LyXel.exe
      "C:\Program Files\LyXel\LyXel.exe"
      4⤵
      PID:5244
    - - C:\Program Files\LyXel\bin\adb\adb.exe
        
        "C:\Program Files\LyXel\bin\adb\adb.exe" disconnect
        5⤵
        
        PID:2812
      - C:\Program Files\LyXel\bin\adb\adb.exe
        
        adb -L tcp:5037 fork-server server --reply-fd 756
        6⤵
        
        PID:2896
    - - C:\Program Files\LyXel\bin\adb\adb.exe
        
        "C:\Program Files\LyXel\bin\adb\adb.exe" devices
        5⤵
        
        PID:1716
    - - C:\Program Files\LyXel\bin\adb\adb.exe
        
        "C:\Program Files\LyXel\bin\adb\adb.exe" devices
        5⤵
        
        PID:804
    - - C:\Program Files\LyXel\bin\adb\adb.exe
        
        "C:\Program Files\LyXel\bin\adb\adb.exe" track-devices
        5⤵
        
        PID:1956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LyXel.deps.json

Path C:\Program Files\LyXel\LyXel.deps.json
Size 37KB
SHA256 c26e0bfac36866359a7bc4250760dee344305a4baecc00a04ada32608e82482b
MD5 20289cc98fe3ccbfd961dd5baa34e359
SHA1 13c86486d80c082af676f9a88b34a0b4803abd51
SHA512 c6444b8652d0febc987f9ca0a18c66bfa7ad53840fa5d46645976089bad002b4239d1026a1a59b71aa03df6b1d49a9011517e2c14ae60b5b555b1eb3b19ebbae
SSDEEP 768:Q/N0Ijml0F/CRngEVkywKLFl0wvDg8dNJra4Sl9zk5HqLpE4tJJri7StLIdpYyFk:e0Ijml0F/angEVkywKLFl0wvDg8dNJry
TLSH
T15A03A134C9500EEB0935AB9E28794646F2B5036F7081085EB8BD342E9FB7EBB4155B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LyXel.dll

Path C:\Program Files\LyXel\LyXel.dll
Size 725KB
SHA256 ae91589e62464605a1edd6cc801ee64533c7c256bcf8f963a8899079a6ee1046
MD5 a1a62fc408913022311990d3c26beb0c
SHA1 0fc3d8e41c40be4919bc541a1e2dcbda9be7650d
SHA512 06270da579f54e71981c8fec3fb7def3f6064803923516abf1e7e5257a15033a5d8d37eca997108565254cd1c0fc93c4115d54ae2d45295a73f17ce705c47b30
SSDEEP 12288:iKYdWEoz+Ooh7FeUlozFeUloXck+KUlcdiOYGBUlo:j/2ChCXn+KCcdiC
TLSH
T185F4AD9473F84722F6FF6B79A57061504A727967D93CE68C4EA260E90D30FC0B821B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LyXel.exe

Path C:\Program Files\LyXel\LyXel.exe
Size 248KB
SHA256 39e553eed5b4fd2d385e34d2ac57b278ad8018779c3e1a59d7296c015d3c695f
MD5 ee77e3918407ce6bf5dd73236d55f127
SHA1 480bbc04a942da253c32c64e6bf7bf3171f7f3d6
SHA512 b2feb2e0d296e6c5538bd198c5b20aab00892b83776f6d102a4d7deeb16ef699f88bcd9ce2caa54d1053510c5d38f37415fa1f757feec731268c6a596aadafe7
SSDEEP 3072:EqeXA/4yIg9vkNPNu6H6xCYOihUE265qJafhCjRM42RSSGnFlEPrQw+ueLlOHLKW:EvgvkNFNaxmpEKJa89mSOcTlKJol+
TLSH
T1C6449E07E2A851BDE1B7D679C9A24941FB7378198B71A7CF035089761F63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LyXel.runtimeconfig.json

Path C:\Program Files\LyXel\LyXel.runtimeconfig.json
Size 439B
SHA256 be4a47df4da9aa5a398f2fd018297fc238e0651bf870b9bad29ff051cf349877
MD5 6f3ece0fef385ecdce3f87abe935c1c3
SHA1 ec5fb764096dac297a24be1703f7aceaf62d1485
SHA512 87e0cccd642e27a5e235c0114f15c1178a49ba9030f73f29b78ea88e5aa15cfae9bfd8ffd92d67110083dbf4746fc0f0c7cf00a5989691a6f725efc3c59a7530
TLSH
T1FEF0223AD9246E7714F0277CE02AC1C7FA30236B00040D42B9FD181C2F370A26002F89
MD5 SHA1 SHA512 TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Program Files\LyXel\System.Collections.Specialized.dll
Size 101KB
SHA256 3007823d00ad51279893e51772ddcf146fce40201bc9f9cf67a7ac1b621b0401
MD5 cb9ede33a3927e677b199ca5b4a7f0e6
SHA1 3577688ab52300df134805461276685ef4407c9b
SHA512 ef03864c329d962e466b2bb21f5086c124083f2f06ac08789bc146e37feedbab0e7958597a02e04f11d4bf72145e00247e1456c26b71b1ee7514162c317cf344
SSDEEP 1536:kOtdRfAaP9WSJLeI620hCYCARk4YIAO8xocg450Pd0VIO/zD:kOtfAApeJDPAOSocg4aPOB/P
TLSH
T166A36C2473D84B22C73E92FC85978A81E731F1D31362D2CF1559D9891E9BBC28B7612B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Program Files\LyXel\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 f740bcc73efcbc9d7ab10cfe3abe78e92192e65b07df75dd4147e170ee9ede0d
MD5 f5bab39c8460c73a4e32179eb31073b0
SHA1 e8974be714305592a0d3522a7a60606bf6716164
SHA512 1944c92fb6105676ea209873e4617ce3801663ae46de6c510233c24559ee1e33ad3d0b7ef88d12618c68263de20a150817fe6e5d1f9c98b2b4a096381a942e02
SSDEEP 1536:vA5/UZMu41hd+Cv8A/oqevD2olsgYbktiZzQg:vT4d+S85qKD2omgY1sg
TLSH
T17C734B1823EC0126FBBD427C9673A821E575F6821713D9CF4AA0D90E1F5BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Program Files\LyXel\System.Diagnostics.Process.dll
Size 329KB
SHA256 6c84154fc465ac4e8e94c6f1c977b58191e570e8ab2e4a8979def8abeb6fa565
MD5 5493485f7e5ba237a43c9083a1fcc7e1
SHA1 dd3ac98286654cb78091e8aacbb5b203f5165eb9
SHA512 d8b6abc9888716345ca215f1b1cb2a1e47e1d902e59ca07c7bad23c7fde4890c0f675d445d53e684b9077419b182cfad85a17eb03c88e815d9aaa520fc785a6e
SSDEEP 6144:TUkDNqaP75vD9eEIdghrT9jb3b41PlmFHbZTdiX2JCO:T5DNqAeDdqJ88V
TLSH
T1F6748D247B980506FE6E86788C63D502EB78949707D2EBD743A0D7DA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Program Files\LyXel\System.Drawing.Primitives.dll
Size 129KB
SHA256 afd1c312e64e3e626e619bbbe763a815c742d73c9eddbaa7218f6c0d95c16675
MD5 839d93c891b0d19299d39f2627153c93
SHA1 fe57549210f2fa4a9d9b2493de036f76b72c6eb3
SHA512 82c1ececf2d6e7656a2244dcfa584bda04218c37162a615dcc206e2c869240722bdde707d458c12e0d62b9c5dfb75e6b41a7d31cf3a793ad5cf1bb9c1ccd0c26
SSDEEP 3072:n/bFFi4yeP4SyuvmH00N6no5WvCIwooRcCe:zFFqimpjQok
TLSH
T103D36B5DF34CC4ACDAAC577D61965926DA26B2460321E6CF9DC9808CBF023D8F5B31B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Program Files\LyXel\System.Private.CoreLib.dll
Size 12.6MB
SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
MD5 695786d85671eaf9b505d5ac81fbf68a
SHA1 ffff42a1e41492f9c42803058b4df44cf5dc84ef
SHA512 8acfdd4955f9f760574ecd89a491cc3b8e5c16defe4d947059e8a58ade5a752a338391e4db8278ac52bc1c45d3608e442ba40326f4faa64cdcbef660af6244ba
SSDEEP 196608:Bmhp8mtl5F/v/M5ks5OtsFnyQvHNT/k9B5/:dglb/vE5L5OtsFtHNTaZ
TLSH
T1BFD69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Program Files\LyXel\System.Runtime.InteropServices.dll
Size 93KB
SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
MD5 f5f3247bee18aa61f465b5ddb0d99550
SHA1 0279dfc8e36d261c591987cc8e2894026065b31a
SHA512 ad0faabb46540429eefa91358793894f316397e6d3419bcd92255150f4eb2a86523d37fff092560e86695b38d7100e9c4a4581384968b2b6a9cfcd2afe11a719
SSDEEP 1536:VA62upEelCtJfKS6+67NspnSPM+l5+KkmVxKWHt2zBzl:VA6r3lCto+dSPM+rxkmrNoFzl
TLSH
T13093592037C84666CA2A473D9C375D50C9B1F6CA13A2E6DF5781885E1D9B7C0C3B23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files\LyXel\System.Runtime.dll
Size 42KB
SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
MD5 4905fa612509e3dba44e5d72aa95753d
SHA1 b8a4031632fc953d585a7e2e3ba53316b5e7cc36
SHA512 8617d2412a9de2593c56779d10fa11d8e579edd27f2c1e3e2832477a54e3b77532f1c0634a2b8ea5aca9340ac29f45ea077384210dca6d95c271c0c39ca37486
SSDEEP 768:hT+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDI:htB/LuYdy50b4b7RSHZSpZzIz8
TLSH
T11C13C4A1EE485333CD8AAB719C73AC811DF273C4047A197ED88FD51A53867A48236B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.Primitives.dll

Path C:\Program Files\LyXel\System.Windows.Forms.Primitives.dll
Size 2.9MB
SHA256 fdff8b6988dc848872a2d06d8980cf6aeb47bf97e13cb772a14ab59f7a275846
MD5 15bee23db25ad404ec957430883f40b3
SHA1 aa8532e14a5aefc4f5fede41006a9e6be31d46d8
SHA512 37c7a6cadd038024fe5bbb215b3c9bc6a2b3ca5340bc9e592363f5941f36edef81eade1b04bba456709d38a25412d2f5cce3d6abb3628015fd0480e7b34592ca
SSDEEP 24576:C+whBwGGJ6udkncfb9/v3R7dL7VOyrnMHCH/PLvlvKJdnOL7wLIlcq7VHILraF:reoJbdRh7ECH/PLvlvKJhX/q
TLSH
T1E0D55C00B3A627A1FD29CE7599254E419173AA476382DDE7D0C584B83ED3FC3AB3B191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.dll

Path C:\Program Files\LyXel\System.Windows.Forms.dll
Size 12.9MB
SHA256 a920861ea1a101e5a226c3012d441cebf3f883deb17d62106e5369ab181844d9
MD5 03c6ceb79dadb77025b570074b234187
SHA1 538d9e4b92aa44b6a0df4aa70175377538d6ea2c
SHA512 2a874bfcf2765c574658b68616cae27c422f850ec61cd9269cc37b6827234386dc6aac6dd3311487d29d70f2f9a14b25a135e47e92c6d930c410e3fd58c3b7ac
SSDEEP 98304:p0SExsDDz9cHqTE0PydxeM2EpGCYoy96tyawaMj:p0SExeDzpTEIHhEpGCYoy9Uya5K
TLSH
T1CFD65A5252ECBD86D23A4279E37393E0D7ACDC168351D2CF0590BE063ABE6837636395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-N0VAZSODLZ.tmp

Path C:\Program Files\LyXel\bin\scrcpy\x86\is-N0VAZSODLZ.tmp
Size 71KB
SHA256 6ca69a2ca0e31309c087d288f058977d421ad03500e4c3e1dbd981241a069c60
MD5 70d9408186450f9aae9b284428593017
SHA1 af00109a1596f5faa7aa0038d535c3ed54dfaa76
SHA512 157354d5a866378f854eb3c1e5cb4d3ad8a8dde93931c0f9ca0e786bfda3edf58178212a066c8cf19ca22225363b08eaf68f6d30c986dae52bca512b39804811
SSDEEP 1536:b72doFmOiHizFbPlspcsbj5ZsP+YeTs1pT7+w2:bSSfN9+YeTs1pT4
TLSH
T1F4636C237990C472CC9651B819ECE621A67FBA501BB184C7779C03DB9E203D1ABB9397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-N8KORL9YN1.tmp

Path C:\Program Files\LyXel\bin\scrcpy\x86\is-N8KORL9YN1.tmp
Size 8.1MB
SHA256 957e46b8615f7af5b7292a2ddabe98d2e61940c3fb2b0545756507f080613e71
MD5 f62bbae3edbffbf33f913a536c37f5c5
SHA1 c8cb0d5720e2d34d359a89f4250e0971ba4f2da1
SHA512 f2b79507c0b83006c304c5e3e0fce19c9685465f9e487fc0992e8447a6f43f47a18aa39cfe0d21b2e4a29f134c16b17285d5463547ca82347eed9f72d36a5577
SSDEEP 196608:hQbvGuN6MGAaC1spB/fZEf7t/tg/78gPPvSQpZjXvDD+cNGwFZN:hQbvGuNtGAaC10Xi71tjgPnS0BfyMZN
TLSH
T1C6869D06E153A179C90310F1212EB37D6F244A148B258EFBDBD4EDB86B659E0353FB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-WH75EHGD1E.tmp

Path C:\Program Files\LyXel\bin\scrcpy\x86\is-WH75EHGD1E.tmp
Size 105KB
SHA256 120bef587119c6cb926b86b9be90fdfbce38937588eae28cd91a94ce63c7b965
MD5 47a042211f076ac2ec64a8959f455d02
SHA1 ddaf6836e376c7a5d649e7c66fb0f7f193097ab1
SHA512 134a9484acd567957a6e35fc0a872ed6f8bd3ac6c1526cad2efe2ce392879c5bdf467dd994be4d2c7e78e9849f37710a91d506702a7df5e55e0d852f5734572b
SSDEEP 1536:Rwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPj7+9o:RwqD3L8Tezq0et+ui1yYco
TLSH
T130B36A227891C072C8D361B91AECF76593BEF4B10B6589C7339803DADE643C25B7529B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Program Files\LyXel\clrjit.dll
Size 1.7MB
SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
MD5 ec34ebfe140de879642b87e916343274
SHA1 c3e9602a9b31e507d7edfab1a20b383850811577
SHA512 92f0a3128a9386a9d2be2732a1342e6d1900bde1f03f62a99229256b1957a77226b7071a5ce62ecbd665525b1a318194e084ec85c34bf4798a2cf24d4f682412
SSDEEP 49152:InwlMPM7xNGajT3kXgy1JYBJlXhw5zcQCTH/AtU2gn9wcr8VHM1ndp:IU7ue3kYBjG5XOItUDn9wcrcAj
TLSH
T14A859E43A2F805FCD0AF9534C6574A1BEBB2B45913209FCF42F44A96AF237E2562E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Program Files\LyXel\coreclr.dll
Size 4.8MB
SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
MD5 31fb22d665ceea55d1f064cdb6600549
SHA1 2f761f4bdfbb46068bf378a9b8dc7eade6723f02
SHA512 c94e0ab1eb9c7b48bf1436dd56667ccab99f2808695253294dc6292c03f43c23fa0737a75ced0e29973215256eb71d119a8d915bad4f75c75f4cef5e2212aa9c
SSDEEP 49152:g1/lfvVGhpbaoKUaJR2mqhzpiu9AhYLdSQbNAwJh679nRTCPtIlxlkWDhuWZ7gRp:wVGhpbaoKA7N8vSlGd1ed4+ebYD
TLSH
T1B0368D5AF2BD0098D4BAC0B8CAD30527FBB178591738DBEB06648A651F23BD16B3D351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\LyXel\hostfxr.dll
Size 357KB
SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
MD5 2756893fc2cfe0036b926d1ff5f6c2fc
SHA1 cb4b8b21828ba738e6bfa619f99335756842148f
SHA512 094d8b233facb5983f72b8c624f1f59aeb62063f695d55a79ba343b929015e73fb4b7f5eb16fe39881f8462822f7d7502ac2d62c4fa01c9686035de28d459617
SSDEEP 6144:+E7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE08QxsTZ6H:5MjrFPJ+OyUriJ4E8KtXZPK
TLSH
T1C6741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Program Files\LyXel\hostpolicy.dll
Size 397KB
SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
MD5 4612ceed8b6f626be0945fdd615d50e3
SHA1 adc371124acea8987ddf5a93ccaa11ab269c8987
SHA512 5d7f587aa61ea48e60077a6a5a77a43b365e50abb9beb17777ad580659e4b49381260dbebcbaad1d28e64c1d7a814f9d772f211a014d99603ef70e195d342a5d
SSDEEP 6144:Hvf1pnG2fGDIp/SnOWE5+1TlBVe8Hz7jTl3TtCOa9/Cm8QtxCt2QDZUbN94yKjc6:Hm2Q9rfe819SnKYLpURbSpxoy4rgE
TLSH
T15A842916D6EC0078F0B7E6798AB38941EB72784E47B196DF139089661F73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 399fec45876641fe424603157c64a93bfa84a6d457c7744d232705c72323dae6
MD5 6c1d02cbaff738f3d6f94ec40dbcf008
SHA1 fbbd1bdb6411261370ed82572ad337196bd1b6e9
SHA512 8af560b1fdbb0124f20bafad9327711b7b9736fccee0686b5ff91af74ae58ea556cd2a9ec9178d8b558bb121c7cd6c068368dfb4df136801074042bef2e8fae4
MD5 SHA1 SHA512

Submit Download

63a02ce2-d293-49f4-a488-62d13bb72327.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\63a02ce2-d293-49f4-a488-62d13bb72327.tmp
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5850edfb5575296e62f79096210bf29254c96d9ec87e7246298232e0d7e86c03
MD5 d7ba26a4c01bea60e4fb8293b4cb6502
SHA1 d4ce6e43e1f96a900c66d629b743d3a420334987
SHA512 7e8ff4443c85467d68bb8319345859f47f32d5c74e574c70af4c1c3c08d8e060faed63bb9a240870047bd7198fb59b50080d482d982360a577479b5019d90e74
TLSH
T18B2121105FD2E0D6FB44087AABED099775F0A660446F3F3262886F3C5453B8060BB845
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 bd7ea919eef535e9d37c21def2151db16f27d732d375ae817926cb917ec1f940
MD5 c811cb11cf9431485a0a4397f9c3d25e
SHA1 14b48542956a63b13572db49ee59346925c14ea4
SHA512 7275c2fea27b7d44aad7aca1cb97dd76badf2e1665e2e22aaa699e771ec8b31e650f0e1ba1711ffd4aa39cc74294044317b9c30108348baff9a405a7a52dc789
TLSH
T180F02210ADA77002DB885D77337A18D212F48A45A82E33226086DCAC66136D0853BFD6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 5319558377fdee1c35c1dc27acda6d3f58f778cf6f5c75197a7f866bd2370e95
MD5 a96149f35052dcfaf8990645d53d9acf
SHA1 c6b40b5a3250ef5dfd8529c0dd1ecc34bc3d88ef
SHA512 cd7e8b8561f4037e1c773aebb4dc1722585f0e12c229b81b3bba1ed72c0a4739d41f2dce0f6d50e533e75bf409680ea4e596e47f2d4b659b576fc48bd162cbdb
TLSH
T18201991096E3609ADB440C3BABB2049162F0BB64542F3B2260CC8D3C68016D070F7D86
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 be95c4304ed11db0153c32c108d7ba52a9ee6d1170ecd2a0c984a77ac2594e0c
MD5 792b320122853c5b4cae3da30ae5060e
SHA1 92e9224b61b8a876f46e3f68d63cbadc12ea7f27
SHA512 f1264bc9beaedb16f17242190181a8a15c4b14dc5f7494ebc664b990fdc7bbdcf98d26940e9b40cf9c64aa82ddf7b6a8c663f5c63dc24e4af27243ede6856494
SSDEEP 3:MsEllllkEthXllkl2zEflALM:/M/xT02zt
TLSH
T1304404157FC00405C5001435D371D35013F0D410451577C734D14C775CCF5400C15000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 e2869ab48df7c3fbd7871cea4c2be11c1535ae178eb9727352e9806a330c4718
MD5 0be1bbea857f5c32da2f98ad2a9b4262
SHA1 dbff1173689eb1ff00f28cdb031de9109d7b8c84
SHA512 3f53907dec20edfe54a1c4b35ef7ac38be97c6806d4445cc385079c0b723e7347a959fb14c03d15dfbde7d55a6a719e5b5b2853b7f31edc9dd76f5ba4d37dc6a
SSDEEP 384:DaX68ezKmnFVP62SjfCklkXWNXZIWZ9MiQAZykeAoGLhERZIG7TutaV4IYsHiOQH:wtWiu2jgji1
TLSH
T1B052ADF7C3D8C66E881156F897246E1BCE1D066A432C3C2688E5FE4BA3F2472E15564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 b8fe802bb2f41c1a2bd42d13e88fac6a504d286cd8b0bf9f634ca5fac7d3ec51
MD5 e6f387262620728c0268b520df374140
SHA1 05005ff31d298bc0e69b38262476f41eb62bdd37
SHA512 4ef51e988afbf96016eff14af7df492effbb807ffe46629a91d2b1b22e167a1bb1c4ddd9032003e0c425257a93c157f91abd09dbe9534f3d5b54f4a26e872911
SSDEEP 384:DaX68ezKmnFVP62S5iJL4shfaeSfCklkXWNXZIWZ9MiQAZykeAaLhERZIG7Tuthu:+tWi9zjYYdYyn
TLSH
T1B282BCF7C3D5C62E880156F897146E1BCE1D166A432C3C2688E5FE4BE3E2472D25A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 784ae643a5a457c9b0318e0a1d69b583aa809b1746c8cb98d6e81ca722e8cd0c
MD5 e0f5ceb2d1194bb58c67413e8c364cef
SHA1 9aeed485289b151771a0961b9df884b94c093fa9
SHA512 887aa4995027c5312d1d2c767992fd1d1a3cfcb6ebe81e4d51d70ae34e5642b0b767f3c731f603b43b4cbdd518ccfeea401915050f383a2e09b22612ece3f7f2
SSDEEP 384:D8FoPeUKmnFVP62S5iJL4shfae8XW4aeVfCklkXWNXZmWZ9MiQAZ+k2AaLeERZIJ:o/WiazjYXY5+r
TLSH
T16092BCF7C3E5C62E891157F896146E1BCE1D062A432C3C2688E5FE4BE3E2472D15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 168cc2e85cdc4f1bcaaec0dc3a9335c0d046291ab01ceeb28a31498d100d37e6
MD5 6491f68f183815c9a11ccc4e2e507a10
SHA1 49da17814b33472a3bcf2322b407589c05959849
SHA512 378245d67001757b3766432d118a15cb69c028d5c4502322dea35d836f77f32906f99598636cbfff881a46ab76cc688009d734bd57fff1436a0092918c5693f3
TLSH
T1022137EB91AEA46750785CBF5D447C0A1D7AB835128168F5CE6B826CB0C68FB1B12436
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 32c8e954f36bbbe84a87ab6b775ba1ddbb7686f91334f9ce7d7c8f11dc551084
MD5 98b3ae9f0dc5888fdb60055e6a89bd0b
SHA1 018c6e3a681cd2fd3419b4561574fc8b4c489887
SHA512 aa53ef6f887f459e18bddd34349a749245413c48be521cb4b242942c1db9f62a73c20f62b2cdf8dfe7d50c24b2fc2b32bb66d130ded22126045ad38164f2f2c8
SSDEEP 192:vR5C+3H3kUBv7MsAPRp23+9gHsb+WNnojPW5ecVyIsnAUgR:vR5CKH3kURQNXhqwAPgR
TLSH
T14E22932EBE25697B6DDBD229FE617B93E7F6106221902E84E7FC4A2C10D75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ee19f1b9252b4ee86cfed163d8ddca40e220c3ee5717832ea4be40c627990ae4
MD5 0d8825492996a0ee98fe44c4b1218553
SHA1 d47dca9b07b34635a5585c8fc0e109b28f241d54
SHA512 3e58173275dc7026d65d78ac126c16a228a27c65c09afbcc27a455a9aed45f989d840ee5be50b4b740eda2b57a9b867b6154f38a0f5ba123f21755f38c8de7f8
SSDEEP 192:vRrC+3HMUBv7MvAPRp2riE9J9gHsb+WNqrojPnd5e3VyIsnAUgvU:vRrCKHMURQ6XyqwnPWvU
TLSH
T17A42C82EBD24697B6DDBD219FA617B93D7F6106621D02E84E7FC8A2C10D76CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9def969edd7de514762dba3be2bca9dafbec36e3943e87930231a9479c5e6a01
MD5 365a2d70c8c510d88208dddbd252f1a1
SHA1 7a23ae105e90b0b900b799be2c6208ca20b72bae
SHA512 6e44b3978cd67b76e70228975809772e4a15c9d42306b91d3a16f59ad779509003a64b06b964f2ae5458ebfcdb2135b6124621fbd81d1672a54331fe57994df7
SSDEEP 192:vRrb+3H7UBv7MvAPRpSriE9W9gHsb+WNqrojo2S0Lm5ejVyIsnAUgvU:vRrbKH7URQKXZqwno0RvU
TLSH
T18342A61FB924697B6DDBD219FA617B93E7F6106622902E84EBFC8A1C10D76CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e07e3c5daef0ca0c912d0298415e405c3c302d02abe23f92834435594db1bb17
MD5 c218c239203329c8be20e4605f365806
SHA1 e32ad7d8ba4fc67aecfb46e6cad280302fc1566b
SHA512 8c516512e5ef1bee325321c06637d19be733bd5b1241366a1574e0adc50624f8ffcabe0d4761aac9ac3bb226e9893b4fffcdfe250bcfaee0cca897b4a3a8f02c
SSDEEP 192:vRrC+3HYUBv7MvAPRp2riE9J9gHsb+WNqrojPnd5e3VyIsnAUg5b:vRrCKHYURQ6XyqwnPW5b
TLSH
T19A32A72EB924697B6DDBD229FE617793E7F6106621D02E84E7FC8A2C10D76CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a69c97a7e414067c56bb471a7e7d0f711180781c62557501c9496c76c885d4a9
MD5 25dba1d89745a72d00aa627611bb0e5b
SHA1 c834e292e59bf041bcb5a528d4ae009dcd0704e4
SHA512 d21aaa3d88af79144a0ba77a80c7427511d6b1e18b457594ef7b4123199a42c08e8adb4fab74fabe24609d6ced9de80e35a74bc2f6677a260485b901899c0f83
SSDEEP 192:vRrm+3H7UBv7MvAPRpSriE9W9gHsb+WNqrojo2S0Lm5ejVyIsnAUgvU:vRrmKH7URQKXZqwno0RvU
TLSH
T15E42A61FB924697B6DDBD219FA617B93D7F6106622902E84EBFC8A1C10D76CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 03589f484f3f12d392fc2485517ef8a375f06bfcd50f590554d752b7b33c41f7
MD5 187ec1c22ba8722011cf34084f633ca0
SHA1 42b8d4dc8ba88571350d4b94fc17764866527081
SHA512 e0200b2d26ddcabbe06156cdf4bdafb52754cb8d3c33974a7db760476d7d2f62a747e8347df8c560fe0d63d726c2e473564fc3916d0b6290888d910e3a16521b
SSDEEP 192:vRGb+3H7UBv7MvAPRpSriE9W9gHsb+WNqrojo2S0Lm5ejVyIsnAUgvU:vRGbKH7URQKXZqwno0RvU
TLSH
T10C42A61FB924697B6DDBD219FA617B93E7F6106622902E84EBFC8A1C10D76CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b876355f7c3093bb69cfd452dee0cb0c292266778653e628afb99c083bfeb4fd
MD5 98da80293f7a19f4e906f686266650e9
SHA1 54fa6880e7f21908333e445462541a2217f3e5ef
SHA512 f92437ec6dac9c2e0bfd0277590dd56668aaf0ca11162259f1c0f26209bfa3e8d0d5fa71b66f38385486c5c4b0ad129a3fdd8b98d8d86093266626b7a422d6f7
SSDEEP 192:vR5C+3H3kUBv7MvAPRp23+9gHsb+WNnojPW5ecVyIsnAUg5b:vR5CKH3kURQ6XhqwAPg5b
TLSH
T10032932EAE25697B6DDBD229FE617B93E7F6106221902E84E7FC4A2C10D75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 275afe1992cd1e80fc7685af57c0370a870892189c741b073d103456a39f4bd5
MD5 7d104523216f47c6a874190c068a673e
SHA1 bc30349b9495ccb99ce985285a9810cb3791805e
SHA512 6b442abe1e0ad3d4a4b4c0b99b6b0150cf3366bc6715ee24edee16a6b0ee427aae599090bba88ed527132a04567e82e9cc01b6404a4a1e0746ddc2b9696b8912
SSDEEP 192:vRrC+3HMUBv7MvAPRpSriE9J9gHsb+WNqrojoN626m5ejVyIsnAUgvU:vRrCKHMURQKXeqwnb2YvU
TLSH
T12642D82FB924697B6DDBD219FA617B93E7F2106621D02E84EBFC8A1C10D76CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2df9fcce858630f6f9cb0caa9bd22660d2d40ee731be5c97ae1970b818f344ac
MD5 123076f504568d9c955e224ade02887a
SHA1 ca4700403ac9ec23b1e7ddb9bae0e92fdcc24313
SHA512 706cf3801eb8fb30ef21f30333fc33adb5792506e4ee21d702cad432d3bc9b1f82d7b4d1165fd4033515178dfb836aef4dfdc8388570813b2ba85d4ecffcca5e
TLSH
T10FA002242B904507E550927225D281516314AE757109961560E80C96D9F43544519040
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 1b950a5aa6a40837e9f6bed37640a1aa5173965ed714d5e210a4eb6f70c8cd2b
MD5 073470483f74e8f9791d61c58cd38990
SHA1 545d2b5345d7dec7ba54689abd686f509b2cd02f
SHA512 a6db2e7aac5ba2a16fe9f24822beb72eac3df39cee47666d96455f37bc1220368de77a4bd76e938d33d19da738b3d477ea87f4d01d2725379ac1369033165ea8
SSDEEP 192:xteG4DkG/FZ9KiUDUenuWSEXhwZu8xzLJt:xt14DkI/KVuWhwZu8Bdt
TLSH
T158D1F7B1A46D9DAB59B6A488F1033E43DDA890AB6554BE1CEEED4F0C00E64DD4383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4811ec01aa3fb4138cfc99f59a908152f68cb57f9387cb4375110c0ad78ad8e0
MD5 d32efd24584fa299cc0fa7e4dd9cdfcd
SHA1 00df1f6e4424b378c9833d953445f8eb8e80eca8
SHA512 609b84a6c12328f0b1a944ac850102437a57437bc6b2b7cbe9593324ef7bb580b32e43e3277052bdbb9001a7236ad366ba37e650ce92aadd9dd96b3fd58b036a
SSDEEP 96:RC6jld+OI4Q2k7i/jfTVZ9MT5Sl8h4otop59ZjDeB6fGyvX1f1I0jKHD5Nhwv0jI:RCWG4DkG/FZ9KiU2vXencfm1D5NhwvUe
TLSH
T12BC11831B87CAAB36AB6D14DF1833E43DDA4A15F6645AE28DBE90F0C01E74DD1347822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 06b6c119242c86c7652acfd8a914f9938bc89546b9c561847b0252f2ec26c77a
MD5 ce5e7766bf521e179da735e6341cd67f
SHA1 7f435a782bc24e5aaacd61903c56c7c508f57121
SHA512 026e28c9d192749a505bcc6a36996840a5ab4483df354d26e68b3f382a260f4e6da837e4bb21ee92bb026c54ab19954e2e030d558fab4e4ecef25db01cea0538
SSDEEP 192:xteG4DkG/FZ9KiU2v5enuWSEYhwZuC2JE:xt14DkI/KhuWWwZuCsE
TLSH
T1D9D10871A46D9DAB59B6E488B1032D43DDA8A06F6914BE18EEED0F0C00E64DD5383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 74e5aa1ca74907f660a71fa6d440cc8867c12aa0510fc16308ae2b3572de4e7f
MD5 528f1a073410c2b1cf04cca392845309
SHA1 ca6f4dc0ed8192a1c3edaf6c2387527f06bbed61
SHA512 876a89dd00785de8fe218c4207d1728bee25eb2af523cc072bbbb9b7cdc0447ed17f06101f44d2a424d1c622fccfff310a0e7c5831e2bdee33a899549dca83c9
SSDEEP 96:RC6jld+OI4Q2k7i/jfTVZ9kuT5RDotok596DeB6gGyvXNQwrbfyYv4a:RCWG4DkG/FZ9kGDUDCeMAQwrbfX
TLSH
T101A1F772A47D8EB75976C44CF9923A43DEA4A0AB6251EF88DEDD4F0C10F71DD0342922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e466202bb37f4b0a6cc837696e2aabe10e7620c2e290c8a4bc682d42582dfcee
MD5 465b35c435b4cb60668e8f5eae340bc7
SHA1 e666e9764fb451990c56247c58f3fa586c6042e2
SHA512 266bb8c9e498f553ce78a844c6a4ef76abafc0569c06dfcdaa962402d919b0b35a4cd6ff2072da192005735132f78e616bdad39d5080253b1348db69f597e561
SSDEEP 96:RbJ6jld+OI4Q2k7i/jfTVZ9MT5Sl8h4otop59ZpDeB6fGwvX1f1I0jKHD5Nhwv0U:RtWG4DkG/FZ9KiU2v5enufm1D5NhwvUe
TLSH
T1FFC11831787DAEB369B6D149F1833A43DDA4A15F6645AE28DBE94F0C00E74DD2347822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fdb57340d4adced79c637b6c975980240406d92b9d6c9b497b048685a14307eb
MD5 7828472636df5aed05fc876e09f3eebf
SHA1 03f278470475a1c378f8f15fc427409031208a94
SHA512 4647f760c5d50de93f4f75dd7dbbfe3b4ea847173a0d4aa5b7555bcfdb02b028d249788d323e1c75482af6b12039585448ee3d5df3a2167a6918cac2828deb72
SSDEEP 96:xbJ6jld+OI4Q2k7i/jfTVZ9MT5Sl8h4otop59ZpDeB6fGwvX1f1I0jKHDo3Uyhwp:xtWG4DkG/FZ9KiU2v5enufm1DoEyhwvh
TLSH
T1FEC11772787DEAB369B6D149F1833A43DDB4A15F6645AE28DBE90F0C00E74DD2347822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 4d4bf15285188753dd1022d37c49b60e818eba2971bb97404bc6b3deae9bbc71
MD5 1dbd5e41dc8da1f249bad806c95e1e44
SHA1 8840b3bcf02a279d23144407122df315e7fea334
SHA512 79cc3cef9e0db6e14108facf632d2e6b0780e88660edec47edc7b1e8edc373716fd2fa8b4b4f77a7f9dc8cd66473fbbc31b5f96e0a426b2e25776d62d0a8146b
SSDEEP 192:xtWG4DkG/FZ9KiU2v5enuWSEYhwZuC2JE:xtd4DkI/KhuWWwZuCsE
TLSH
T1FFC10871A46DDDA759B6E488B1033D43CDA8A06F6914BE18EEED4F0C00E64DD5383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LyXel_Setup_v1.4.5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-WYETN6YNK0.tmp\LyXel_Setup_v1.4.5.tmp
Size 4.2MB
SHA256 711d1feee1d8892db305ee5a3ec3bb2391300519a696ce58a0000afd9e784e09
MD5 aaa3eaa59a34f90ee38ad9878295a302
SHA1 06a0a52cfaae165214dfbde0260a3f65dfb9e73b
SHA512 678d5a13c644fa83e7c4d9644b8d92de6fc8d186394410396795cc89f4c00f99070d4d7c620c8b10bafe5aed6bbd6c1c46d0a40033a7d63cc242908dc1441888
SSDEEP 98304:c9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JS333A:LItJj90Z6RgKws
TLSH
T16B268F03B388753EE4B71A3A983FA254583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2984-502-0x0000000000F40000-0x0000000001034000-memory.dmp

Download

memory/2984-525-0x0000000000F40000-0x0000000001034000-memory.dmp

Download

memory/2984-1167-0x0000000000F40000-0x0000000001034000-memory.dmp

Download

memory/3652-1145-0x0000000000FD0000-0x000000000141F000-memory.dmp

Download

memory/3652-526-0x0000000000FD0000-0x000000000141F000-memory.dmp

Download

memory/3652-1162-0x0000000000FD0000-0x000000000141F000-memory.dmp

Download

memory/3652-1044-0x0000000000FD0000-0x000000000141F000-memory.dmp

Download

memory/5548-318-0x000001FC29550000-0x000001FC29675000-memory.dmp

Download