0484f053f2a343bca52e4045a623b116e9915f8cf523c65dfd4921df103481c4

Resubmissions

29/05/2026, 00:43

260529-a3cacafs2x6

29/05/2026, 00:41

260529-a15twae19z7

Analysis

user interaction
yes
max time kernel
82s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skid-headless-main (1).zip
Size 33KB
Sample260529-a3cacafs2x
SHA256 0484f053f2a343bca52e4045a623b116e9915f8cf523c65dfd4921df103481c4
MD5 78471370bf8931b0599285a45c7707da
SHA1 1b27e15d4e888ef7d58ab53a91497c94c61a5eb5
SHA512 6c34a0722c9e158838e6c9a79c387d80dd9a758d9d0c7b04c6100b8edaed8efbfef82c8ce726bbf6bf6a90ae480426da1f1b3e768266551d8987ddc71663e0c6
SSDEEP 768:u4rQZh6F5BBf8f7KnyB9iMaHUfVeqzayHo1XNGVGN11eP:PI6F5Hf8f7K49iAtKyHMKGNC
TLSH
T1ECE2D17DA3CC094AC4BAF9BF667C1609438871C5C63C48AF2935F96969F62B9670501C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
36	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244891063046067"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{E97C091E-3AD0-423C-9C90-11108596273C}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	chrome.exe
764	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe
Token: SeShutdownPrivilege	764	chrome.exe
Token: SeCreatePagefilePrivilege	764	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe
764	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4568	764	chrome.exe	90
PID 764 wrote to memory of 1912	764	chrome.exe	92
PID 764 wrote to memory of 5076	764	chrome.exe	91
PID 764 wrote to memory of 1912	764	chrome.exe	92
PID 764 wrote to memory of 3832	764	chrome.exe	93
PID 764 wrote to memory of 3832	764	chrome.exe	93
PID 764 wrote to memory of 3336	764	chrome.exe	95
PID 764 wrote to memory of 3336	764	chrome.exe	95
PID 764 wrote to memory of 4480	764	chrome.exe	96
PID 764 wrote to memory of 4480	764	chrome.exe	96
PID 764 wrote to memory of 1404	764	chrome.exe	97
PID 764 wrote to memory of 1404	764	chrome.exe	97
PID 764 wrote to memory of 392	764	chrome.exe	99
PID 764 wrote to memory of 392	764	chrome.exe	99
PID 764 wrote to memory of 2932	764	chrome.exe	103
PID 764 wrote to memory of 2608	764	chrome.exe	106
PID 764 wrote to memory of 2608	764	chrome.exe	106
PID 764 wrote to memory of 2276	764	chrome.exe	107
PID 764 wrote to memory of 2276	764	chrome.exe	107
PID 764 wrote to memory of 2808	764	chrome.exe	108
PID 764 wrote to memory of 2808	764	chrome.exe	108
PID 764 wrote to memory of 440	764	chrome.exe	109
PID 764 wrote to memory of 6092	764	chrome.exe	110
PID 764 wrote to memory of 6092	764	chrome.exe	110
PID 764 wrote to memory of 1152	764	chrome.exe	111
PID 764 wrote to memory of 2396	764	chrome.exe	112
PID 764 wrote to memory of 4464	764	chrome.exe	113

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\skid-headless-main (1).zip"
1⤵
PID:1448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:3400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0d1cc728,0x7ffa0d1cc734,0x7ffa0d1cc740
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1832,i,6869738503847840688,12920987245972898083,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9793634497669216315,8734639280704400583,262144 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,17313492020473805767,14243706140085695054,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,9496485309686461894,14505309921114454033,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3440,i,6857489193377439867,12101278774840445700,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4100,i,3219975362849753979,238118330960266667,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4108 /prefetch:9
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,7703422980049260221,301163237299475802,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,18002085240350281582,14732309004381671483,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5756,i,1415910264223476417,16066538332514940948,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5740,i,14575428695466901350,617150106217002002,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,2939641223059935271,14215344150114807610,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:12
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3516,i,7244580786321049900,2415142927141269366,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  - Modifies registry class
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6116,i,17201033676615513191,5913227804332638454,2097152 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,4330170999358960641,13433957307452872842,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,728508643686946594,1047385733491649631,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,4463519753982029038,16166829117707198949,524288 --field-trial-handle=2032,i,6548153318877955381,9278901908133951684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:4464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5569bfc1-e660-4d72-9fbc-f1ff3ce94fcf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5569bfc1-e660-4d72-9fbc-f1ff3ce94fcf.tmp
Size 232KB
SHA256 8083736d677a24dd8bd4bb0f947bca7ac0a34b4532494de3a4526b0e6ba8858e
MD5 e9fb64979e4fe56688a0931c4c9c4e31
SHA1 bdf8d4b5661362332cd8c637075d5dcf5e00d47c
SHA512 d2fe39239b2a497b2333d7036c9a7e44da466c9e84ea7d080d2685c3dede01b0fb5701aae4835211abba73c9887d9657f11e270288d161bc7212b0d8d0a0300f
SSDEEP 3072:89iQtxss9Y7V5CnjTiefLO5iHrovlzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAV:wxU7+jPS6roZWDfxA3OnjrYQ9EU0/hEd
TLSH
T16F3412D13D3A7D6309B8D76864193B662EA5ED8982E77CD556DC2F0C20FE2C4062ED70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f78ae0c997bf9f5065dcfb899adbf643ad8a104fb1c70d7be099405c22ae1317
MD5 3ba074279b461764c090c3af0847e2e3
SHA1 fff1136d344a6407d636f5958b201cbb6e4c0b7e
SHA512 18d718ce7de258e4ed96fcd3f72cf1ae62cb1721e0f953949ac105672d0dcb41479dcf63eab4a67510231d560d7c46bf60638734553784a4fc22e00a35559ac7
TLSH
T186F0F4A6D921AC3718FD0B6870A84B8AE755136B2781854F3B3C920C8FB063B459592C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e915f75491e678d93f94c7a07ecab4097859fa424cb086990ec5f429b59889bc
MD5 d51b001b4c95df191d166c95adcc50ed
SHA1 e8d10a9092c4e0bc0ec1a5d6e1aa23145105727a
SHA512 b860495effacf31cb8257a243b2a1a29352562e1039d52236bea9a0949616f18c51e9f7dbd344e504bc79c1db1e0177c3dcac06e77e0415ba9837ed83a4bf44f
SSDEEP 192:eRMPvuqCZxv7H+hAPRp2S19WHsb+WNnhXOuE2MQegMoSVyIsnAUgtaJ:eRMXahi8XhUw9U2ZS8
TLSH
T1E842B62EB954A53B9CCBD319FE657753E7F5102272942E80EAFC8A2C04E75DC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aee9c860d06b1183b7955a3cb9d7128a68f60227fb98db0e0fe5e3edb55e8973
MD5 11039d5f786679aafbf5a0c1df8f95b1
SHA1 69410504fb4ec167335fa42a65341f2e04e89bb8
SHA512 2415674aded7e7a17a9a0612754f341138ec888f1d50709ee93941071fcef542a83a1861ae39b70b85d2861b0fbc8447dffb804bcf0445275c69918fbcf86e78
SSDEEP 192:eRMPvuqCZ2v75+hAPRp2S19WHsb+WNnhXO8KeEQegM5SVyIsnAUgraJ:eRMXaC48XhUw9IecSe
TLSH
T16442C62EB954657B9CCBD319FA657B53E7F5202272942E80EAFC8B1C00E75DC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6ea64a4ee41896b77da31123de535c3d3bdfc8f1c6a1e00f7deff61292d4a02c
MD5 6aaf0ec7846c73d424530411a06dab47
SHA1 df4d03907362b902e797e4e419bd4486e2cd1b46
SHA512 7250a9bb10ce786a04bdd8d6f6384a7ebfd1cee3aa7a13d85b480817880d0f2e081ecab0bcc8cf39dd7837b5a66fd9b9138bf57000981b1dfdc5362b7ab6baca
SSDEEP 192:eRMPvuqCZxv75+hAPRp2S19WHsb+WNnhXO8KeKQegMoSVyIsnAUgtaJ:eRMXah48XhUw9Ie3S8
TLSH
T10A42D72EB954A53B9CCBD319FE657753E7F5102272942E80EAFC8A2C04E75DC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 ef5aec670b56025dce99a3d482a91ca4ff98a53ce4d23dba806f679153ec84cc
MD5 d78e1f71ef07824b4c58a204a0bf6e09
SHA1 2cfea9bdc383c4f09961afaf73b6697fbfe6a970
SHA512 d92ab7ae7677b84bfe501c62ca5890f0f017850090015b67e7defac896ec7f0f43755f9bd4436748d96ddd56b64437d5073149dbc9acff104ca8d69eebe6315d
TLSH
T1C8D0A79FE4684051E6AF8B901A3225BB4B253DC864A4C04D980A3535E844B566153F62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 d907704b90ceb6be3d4c4705326698f64d581a8f4fc96d30d8f596ccd42ad6de
MD5 6d036fabae4e29b825a41d8ebe8044ba
SHA1 eb3c9ed16a27a19cba223137f68328e8fca0ddef
SHA512 449f0f3338cadfffb8f73a0d504f9347564169bb4c07c70519d06c8a2f8f62eb6bae8f178ab5ca93b794e9f231531e2536451727ef8889514f38ede564a7540b
TLSH
T172D0A79FD4750061E7AB8A915A3225AB4B613DC85894C049980B3939A874B46A162F52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59195a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59195a.TMP
Size 138B
SHA256 4f6fe993721f631c4d9fc164993e1ad6565c33d8122bdfea3715f7dfe84b70e8
MD5 1d9a3dd163f292860231031f083118e1
SHA1 7bed6acac89b6146136f6f48de049e917e308416
SHA512 2b735d03aa028c0d745698aed0f3d770dfed47673d24553e0e11bae6b54794f977b5d5e28e958c066fc7073112e7694f2af911bc86cddb72353767b0a7a40794
TLSH
T11EC02BEFE0640011C71186800633507D4B113ECC8CC5844D644735243030F23214FFD1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 415d9236318b546ff58c0301a8196e1a027986081f7fab145bb808beaf5c5985
MD5 2228280d5fd1363f0bad78b7c4ed208e
SHA1 bdbcf118f936e482694b51868b04f1784a3ed87f
SHA512 788f4b77c27c8b9f43d7a4d1303c8519f14bf1a7b1becae2afda009a29a298bea1ba2a7d8397726f6c2f84e69146bc614176d8088ed45453a1b30ecf785b0f1d
TLSH
T1B0B0120084019353C04202F016421488B2149F25A60E270143F0B932C825562C118160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594378.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594378.TMP
Size 96B
SHA256 934e579c271a59c21a30fdce38db43325297b87f7918aa183359acae86cbf02c
MD5 13453184e58016be7e60fe85c3e67426
SHA1 8b900203e03cc29092df0ec5883ef4187c3ca04e
SHA512 a21af21681cbdc26822cf50505de9218525918e6df26d695713d7cd9657867c45bb6758f8cc4cc10810d4363142713ce08c2bc0e5ec1642dd2c394ffcc1d6ac1
TLSH
T110B02283C002B203C00303B0E2A082C8BA20CF38C223022383E80A33CC2AA300220238
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e81601373eda5c2a6f217cafc10a030dc6038b490077fb647f2fbba99d281a61
MD5 93900581d3f562f727ca2e35cea0cc44
SHA1 6e7ad589d4aa3038400dc0e51912424476e280e3
SHA512 db1486688388d16d82a4d2075fc7a3917cc5063939cfaf1dd7b27ac8674fc7b0f1125f568182f053b5ef28d40847bd9bc339ef918c63e03b83bafb1805102c55
SSDEEP 3072:TzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:XWDfxA3OnjrYQ9EU0/hEV
TLSH
T1E6C302A11C3ABD660DF8EE98B44D3A60BFF4AD9A91835DC361ED2F0C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 6b652bc938acf4095aa3514884280c44ada1b287dc977987852d52a718d75de7
MD5 b0be3d76153c4f61ccd23b109a9f17d0
SHA1 f9e696703e2f142d47219f67bff6b458e735d3eb
SHA512 764a0a0be3f9b62b4880660ec298661d9b95560fe2f55bb720029ac02f913036dab8e479ec702bd42defc32b55c505e75eb60d997fd7e2947b63fc9335d110c3
SSDEEP 3072:V9iQtxss9Y7V5CnjTiefLO5iHrovlzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAV:TxU7+jPS6roZWDfxA3OnjrYQ9EU0/hEd
TLSH
T1FD3412D13D3A7D6309B8E76864193B662EA5ED8982E77CD556DC2F0C20FE2C4062ED70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4952-13-0x000001DDCCF00000-0x000001DDCD121000-memory.dmp

Download