hxxp://discord[.]gg/condoverse

Analysis

user interaction
yes
max time kernel
1799s
max time network
1779s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://discord.gg/condoverse
Sample260522-twstasb171

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
13	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1500	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239407077176561"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{E9F653A7-7C0C-4891-B8A9-FD0099FBE5C1}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
2552	chrome.exe
2552	chrome.exe
2488	LocalBridge.exe
2488	LocalBridge.exe
2488	LocalBridge.exe
2488	LocalBridge.exe
2488	LocalBridge.exe
2488	LocalBridge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe
Token: SeShutdownPrivilege	816	chrome.exe
Token: SeCreatePagefilePrivilege	816	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3304	816	chrome.exe	83
PID 816 wrote to memory of 4592	816	chrome.exe	84
PID 816 wrote to memory of 4592	816	chrome.exe	84
PID 816 wrote to memory of 1500	816	chrome.exe	85
PID 816 wrote to memory of 4488	816	chrome.exe	86
PID 816 wrote to memory of 4488	816	chrome.exe	86
PID 816 wrote to memory of 564	816	chrome.exe	89
PID 816 wrote to memory of 540	816	chrome.exe	88
PID 816 wrote to memory of 564	816	chrome.exe	89
PID 816 wrote to memory of 540	816	chrome.exe	88
PID 816 wrote to memory of 4152	816	chrome.exe	91
PID 816 wrote to memory of 4152	816	chrome.exe	91
PID 816 wrote to memory of 3500	816	chrome.exe	92
PID 816 wrote to memory of 3500	816	chrome.exe	92
PID 816 wrote to memory of 5316	816	chrome.exe	93
PID 816 wrote to memory of 5308	816	chrome.exe	94
PID 816 wrote to memory of 5316	816	chrome.exe	93
PID 816 wrote to memory of 5480	816	chrome.exe	98
PID 816 wrote to memory of 2928	816	chrome.exe	100
PID 816 wrote to memory of 4644	816	chrome.exe	101
PID 816 wrote to memory of 2616	816	chrome.exe	102
PID 816 wrote to memory of 2552	816	chrome.exe	112
PID 816 wrote to memory of 5368	816	chrome.exe	113
PID 816 wrote to memory of 5368	816	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://discord.gg/condoverse
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb9fac728,0x7ffeb9fac734,0x7ffeb9fac740
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,7830206080629548719,5142600556627404665,262144 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,3479397738619342710,79515856647493124,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,835740570470006765,16793855178798551590,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2348 /prefetch:13
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,9487047028281614750,14890522008319632067,2097152 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,18260095114669972851,14628737249394023516,2097152 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,10801531148938421426,14726910403296847348,2097152 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,2766904863902200037,6027213037785017283,2097152 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,12787837531310862153,6753425747431467328,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4588 /prefetch:12
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,13867982718111960882,16665510912883723298,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,15510708364387037945,13699479707858048187,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,8473468199096567359,10475179809653092507,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,9459683012675573361,17189229856564646799,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,14691926552056323686,6309371124024968777,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5528,i,14867289963481519876,7398780475775640310,262144 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,11684446008472515931,4363013330709973367,524288 --field-trial-handle=1964,i,18144615223064066525,14199140236517896445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:14
  2⤵
  PID:5368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2852

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 41d526e8c97589fdf211f73f7beed6aad20ac02d8683119fb6f25ccbfb123715
MD5 4b9aae449cddcd4e175c02efad034680
SHA1 c46cff0d69955de18274854a665089cc3e2ef409
SHA512 c23f6c1dfe79bcf55daea512af1f80e2436eae8274d3add83022464095246a7799cbe78646e7ed511ba7f70504469f372f67b92598b52e70af679cb99ee59575
TLSH
T122F0F4A6C821AC3708FD0B1974954B8AEB61136B2B81858F3B3D420D8FB063B469592C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7f32bcd1ad89d8a79e68d7c20bbe085a51fe9dee939876c1c26d34c3c75f850e
MD5 05cf274257066f55b8721e7654702519
SHA1 2de8564efd266f1e1c65e909ff531bb501b56f37
SHA512 6c70577b4fba0eba4cc47cea987368894444244ce9975ed4db674f4f8f958cd1a8217981d8fb89aeb7c6f0c2d6631a17ee71444f131f6ac13b851b43f140f410
SSDEEP 96:lefPuw2Wob8wOMbl9rBuhM0Ao5apE6s2v2M7ddJdBI/gDtGG6cavErf9bN8RMBVk:lef2w2Wob8wbpDuhM0AEam6s2v2M7d/0
TLSH
T1C7C12924F6919C13DB129A3040E7282F367A69440D5F1D8FEB52FC74682B7F53A94ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 301a92f6877eadc408c14bb4250aaac9b36b1b07010343a66f27fe44f88d003b
MD5 f94698ffd8d064f4f995010c0b61b655
SHA1 a481cfbf0f148ac1bf77add4ac7a7a8b99175292
SHA512 6b5eab0267c2694aa5b5e145be989b2355d874dc1df834a5fa7e9ba43c7ddb624474c10d70c59b3425fa27d81e7d327d2afc126a81ad94240dc2997ec8fc4abb
SSDEEP 96:Du9qWzoZMxGiTuynuoueuuz1u3u+mu+kF7uuxueaupc6NpK:DVWzoZMxGiT/BruYirmrkR1rat2pK
TLSH
T186A15CF7C7E8862D891156F8AB152E1FCE290D24535C3C2AC8D4AF5B57E29B1E14068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c043e48d1bd4b9028bf9bade3d9460cfc97721e3b61f0a4a9646783f97f6c71c
MD5 02da8e91ca21b68b17a28398a6e9b50c
SHA1 522bdc8c0f246b8828f70363dadbd171e2e8f204
SHA512 90ad14ef5bffa4d7800d802f581369c96d6682c20021e24f81224b4536a502410daf111daafebd3676bf7319b12826d3e768d53fc61cdd69d559226feb1d8958
SSDEEP 96:DuJup+zoZMxGi9uynuoueuuz1u3u+mu+kF7uuxueaupc6NNuJjhNK:DYy+zoZMxGi9/BruYirmrkR1rat2NcjG
TLSH
T13CB16DF7C7E8862DC91156F8AB152E1FCE290D24535C3C3AC8D4AE5B97E29B1E14068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 56fb021665c6206451f20c26a4b556ba875de3f404147f730c3a0b603c8c4495
MD5 6f85f8b166964017c1bf8686a1d75e5d
SHA1 0a01a0d0eb7c4e7a0b723701817a9ae96cb3574e
SHA512 eaea4156aef988f9a2c7e70216d0bbae5894bbbc7e12a8ae2139f1c1d15ed08e796fbc00387b13604ddd8913a00db41789287501b3c725ffee838976f10b2a3e
SSDEEP 96:DuJHudzoZMxGi9uynuoueuuz1u3u+mu+kF7uuxueaupc6NNuJjhNK:DYHyzoZMxGi9/BruYirmrkR1rat2Ncjm
TLSH
T1CDB16EF7C7E8862DC91156F8AB152E1FCE290D24035C3C3AC8D49E1B97E29B1E18068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 eabd798b65532475f49f031b73ecfc7cabe82c67f7dee97e175d3fa9227cacc2
MD5 25c54b9bbb6a3cc14775531f7f8d8679
SHA1 7b5b05e4d86a4f28ac5768fe734b54739f03e040
SHA512 ab6c2d4b37043fba9bfc5bf29e945d83acf34620a9ae522c67ba512de143a927b4dafe229f59d751174cfc0b14539b7256e0af332829318e7e595b83a6bed86c
SSDEEP 96:Du9qWu/zoZMxGiTuynuoueuuz1u3u+mu+kF7uuxueaupc6NnouAK:DVWMzoZMxGiT/BruYirmrkR1rat2oBK
TLSH
T1FAB15BF3C7E8862DC91156F8AB152E1ECE290D24535C3C3AC8D5AE4B97E29B1E14064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b1f5caa17d9e8a5d0846bb0d1061bcde742250aa76f934461edbab230d75cef3
MD5 9b3bbcaea87151ac7f60e5e967143ca4
SHA1 4ad2fa0fc9aa8f9edffc094b4fa4b0ddb9e4e312
SHA512 f1f438393b60c69fdd32565977de4c021ac1fef03032fac088c3ac5130cb5a23edf94bdbfd03126e82ec4f85292c76c8726ee3df7685728bc564b6940f0ac621
TLSH
T1A9318DF7E6BEF467503D48BB0D047C0A29BAB439528264F4DE7781AFA1944F32B12417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2f961bb1717e0e8577ce689d64d47b68bd188cecb4473ca172be9d548201868a
MD5 2134ce51a0d0e320d739848efe03b4f3
SHA1 0af45abe9a6f9bb8d7ed1979626da52eae25eb5d
SHA512 debdaaebfe181e1687375ab0c2e70b256cebcecd6ac8a5705cd47a2e6768361cb2bb3cc97c0e5044e5ef0e0215de3078296dd6a552696023e615e2ed1ca98f2f
SSDEEP 192:RRWvvxcYyB2v7h+pAPRp2w/c9WHmhb+WNnMVlfIv2fyI2K8kwg6VyIsnAUgE:RRW3yCQUX4UeEVU2fT2/A6E
TLSH
T1E642D67FB910693B9CCBD22AFA227797E3F5102161D12E84E6FC8A1C14E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2e2ac530f002e125375b00e0a72f1abd62566494c15bf96a06ee40c0e70251df
MD5 a15c32bf1451c9864a11fa952a2ca252
SHA1 c26d5cdda94ba922ff0dcdc304c40b720e561e44
SHA512 3030f2f0fd8ddc22fee40e2255aa5277138097c7ac73d93e988c6d96fe9fb05bae2f4acff6c743aad3d70c93a3385a347df92f4f91ac4358c36cc310a230445c
SSDEEP 192:RRWvvxcYyBIv7h+pAPRp2w/c9WHmhb+WNnMVlfIv2fBI2K8kwG6VyIsnAUge:RRW3yUQUX4UeEVU2fm2/m6e
TLSH
T18642D57FB910693B9CCBD22AFA227797E3F5102161D12E84E6FC8A1C04E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9d3768874871ad4acc424995bc95e43a3fe4654cb5cbd4f9c8673a7a37946e2d
MD5 f6244f80af5892c415f994af3c17fa36
SHA1 900132534291cd51d11e3daf9735e0be7d7a62da
SHA512 63166cf07aba7150b6172bd34b6acda50e225d978f0d6ef821d080e7386b5da9b1dca3a94b0d38b1a6777c3d5e3053053d04a588bce563cc98bb0d18eec48ee1
SSDEEP 192:RRWvvxcYyB6v7h+pAPRp2S/9WHmhb+WNnMVlfIv2fBI2K8kwG6VyIsnAUge:RRW3yWQUXjUeEVU2fm2/m6e
TLSH
T16342D47EBD50653B9CCBD22AFA227797E3F5102161D02E84E6FC8A2C14E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a6ccf4f8fae9c5db2f69964e7c04508e82036cd57099a721a2127953cdb43f20
MD5 1945a4cc94e0ee4e4e840b09665a0df0
SHA1 7097e7562fd7bc523db138320f814d1a87e215bb
SHA512 a5180e63a2eb7bcbdc842b449ed72b2b3a2639c65a8fd66719365558a7de29757e001aa25c22d997c2ea9ea3ad3337c43171e2712461bdeb171f3b25e0e80ace
SSDEEP 192:RRWvvCcYyB2v7h+p7PRp/w/c9WHmhb+WNnMVlfIv2f2I2K8kwM6VyIsnAUgE:RRW33CQJXlUeEVU2fH2/s6E
TLSH
T1AA52D57FA910693B9CCBD22AFA127797E3F5106161D02E84E6FC8A1C14E79CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 77b24c94884d2028afb292b683dcc354687639806ad4fc9e1c773ee49308c14a
MD5 b8827deec9d445bcae2782fd69b3a739
SHA1 ec8571818f0e4780f073c69c31d13b6cf6a7b20b
SHA512 b8c379d027e23354d73aaab0c949d89e7512ffce7496a76b81ac83439bce2d211ce717013e7f22c8917ab4f1fda7b0e7184e7a8bbb86e11641dfebdd8678b803
TLSH
T12CD0A727F0654465FB666AC51621825E47603CCC5486A448A543F46E1875B46D222F72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b562431a196126f29e60a86eddc3ebdbba5fab62e1397e9702b690f7234ab352
MD5 9db7c6f109ce0ee2f892d6ae1abfb5cc
SHA1 cc8bfdd22ee090b549a61d8ab172eebb075581b9
SHA512 eb51f60b486d62f58d8994c012e3aadfba3f21a4c846f2e6cdcc7b888356ef75ced2828827db9e2f4fca25ffe2470ea3309a1d69a1829c1fba04877a5bb165d9
TLSH
T1B2D0A727F0558455FAAAABC51611866E47503CCC549A74487543D46A0C49A56D223F72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582362.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe582362.TMP
Size 138B
SHA256 5643dfdd51e82eee2a4828c1425cfadf409f72dfaa9fa1e2fafe5d6690c239bf
MD5 76b9f3a90eeb8efc809ffc771dfa574c
SHA1 3b1895cb8c664ff97af94d563e78063993ef7b35
SHA512 1c583fd09d96c08e614613dc67831648ec300e7b15f10644c81cc9b33cee37a87d33a003122fc268dca4e1cc48954fe50c82f22699db8684058d4864a8696f0b
TLSH
T153C02BA7B080015ADB1147C10232864D47002CCC0C87844C6513B0192074E136213FB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0c096fbc2b925eff8effb63eec1324ab6b76ddf3caac00ea243e01daf4e5686f
MD5 3fbfffe67ef01e0abd706575e7c4e020
SHA1 a02c44b72dfc83b4152c308335b28c7c2b13a640
SHA512 de8ac2b106801aff24ec5a0a28d3ab111bc8749f6a2b00cff41eb749d25a66bca087cd81181689f1411d4b7b7f410d8a526d8734d4a5b06329ecafb05017a2a5
TLSH
T1E0B0120080025131C09303B021421488715C6F20A60E1F0257E06923E8351628418092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58608a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58608a.TMP
Size 96B
SHA256 33c75675209b0fc7b739aa2b85f7f20cfa3a1482add06a74269210ac4d4d849b
MD5 21d00637b702caf7e5fe58b42c3d1280
SHA1 b0ce319c705c45aa461b68b32277bf02b0c4bcc3
SHA512 0059de0cdb4e92038d968d5ae98302ca895683f963be8ac09a6f5769a7ec7a9bb9bab169b189b3974843ed76a72dc55fa9e6a5673ab40e6cad22f71fafbc9867
TLSH
T128B00255C102A312C14643B02595A5D87164EFA5D74B2313E2E51E76EC35BB149691A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e56ff77c8fb08986f242e1ed3dd8002f391b4d3f63b3338c9bdc16770e598a76
MD5 d88a0b3c12eb921f1de200d598cc907b
SHA1 b5946981d42d62320807356c6a02c6708cb20c33
SHA512 2c44a82647cc5e1230144c35d2a06efcd79e6ef0b0d1b5fda1a59a6a01f71385c12212b87278dd2bcc0810235030beab72708fe3227b3f5c6a14b98aab7db00e
SSDEEP 3072:shzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:KWDfxA3OnjrYQ9EU0/hEV
TLSH
T154C302A11C3ABD660DF8EE98B40D3A60BFF4AC9A92875DD352ED1F4D14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 db80a4d9b4470f3075cbfbd27d12c7360de8677081d564dcb12770ff17f8d04d
MD5 7e83e698d15e3f50201f4813643e905d
SHA1 4176efe599df606bd3fbfc4293d6e91c865beb3f
SHA512 51d5ead3c65ba2fa56757f660d460e0219d09b78024d1435201a6a131e83de8f4108deb3d2d59089983598b4e5d8fcd3776201a404abac7d4a25e75345b167fe
SSDEEP 3072:NhzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:bWDfxA3OnjrYQ9EU0/hEV
TLSH
T13BC302A11C3ABD660DF8EE98B40D3A60BFF4AC9A92875DD352ED1F4D14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 cb4a85017d26ce2e79ef6b5c2c8febff3c25d4ef7220e632ac66d3f08fb9e8cd
MD5 216c8256bd6409f6fe8ad549b3dfe03f
SHA1 965697f32406e864892daa0a1b8b4fdab824d70a
SHA512 ff270892f1cd5f23c7bbdb67be8869663f6f1b310c13da6e0d5a5609b3b152f6b86438ca5caf70967709f7b8528b1e0b43ce2add41e70d6a6528dcb2d5152b58
SSDEEP 3072:1ymzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:1DWDfxA3OnjrYQ9EU0/hEV
TLSH
T1BBC302A15C3ABD660DF8EE98640D3E60BFF46CAA91476CD3A2ED1F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3c15062342e897ae4c9383b0b7c9f137d5c1fd1746344447ad1d2641e55fe538
MD5 f5cd6187d52cc1b2916dc1de8716aaa2
SHA1 7e41d03cb2f9c7985202ccfdef2b9b1c99091db5
SHA512 7642dbb32273950a582297431a39672eb7db5c2fd351bd9532ff6422580c402aea4dfe613a1ff498a96132eaad85d47efb03042317bb79e44579f5f32f312d4b
SSDEEP 3072:8zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:yWDfxA3OnjrYQ9EU0/hEV
TLSH
T1D3C302A11C36BD660DF8EE99B44D3A60BFF4AD9A91435DC352ED2F0C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4b09741edef6a3dd62bf23e2e9c205c41e056c615a67792e6e949642621227b3
MD5 9281f851292862bb228b78cb58535a51
SHA1 06ff3c74d39bcb49c972d68b81cb364806f9f9fb
SHA512 25315afe514e91c6ed1d8feade87aa4720d17d58b32857cac9f6de9e696d9a20addac7c1873f41324667236561cbdea9d68b45178173160fd67c5669a9728c3c
SSDEEP 3072:8hzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:aWDfxA3OnjrYQ9EU0/hEV
TLSH
T14FC302A11C3ABD660DF8EE98B40D3A60BFF4AC9A92875DD352ED1F4D14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 ca42f76adc72eb5ec66398efddf020940fbb744965699d660e2be897aad4e80e
MD5 26e9b9e2b030cbf74a4fdae7b965447e
SHA1 01c8f3374c55842383289cdf27477bc17e948211
SHA512 d0342c9e8e4e2d7a13e9a401f56a09913e4a01619022463e48b9e5ad030ceb90789bf7d021224d1dcb0abc68a966aff3e5c8993aa2a5d00d91c2a640656bfdb6
SSDEEP 3072:dymzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:dDWDfxA3OnjrYQ9EU0/hEV
TLSH
T1F5C302A15C3ABD660DF8EE98640D3E60BFF46C9A91475CD3A2EC1F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2488-897-0x000001BED8A30000-0x000001BED8A5C000-memory.dmp

Download

memory/2488-899-0x000001BED8FB0000-0x000001BED8FB8000-memory.dmp

Download

memory/2488-898-0x000001BED8F80000-0x000001BED8F8A000-memory.dmp

Download

memory/2488-901-0x000001BEF4600000-0x000001BEF46A8000-memory.dmp

Download

memory/2488-902-0x000001BEF2D50000-0x000001BEF2D72000-memory.dmp

Download

memory/2488-903-0x000001BEF2DE0000-0x000001BEF2DF4000-memory.dmp

Download