b80a715055798a6ddf41ff68c407d1c79817d78c7c439f6cc424dcb7012a1686

Analysis

user interaction
yes
max time kernel
898s
max time network
357s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
onlyskills.exe
Size 13.5MB
Sample260819-e7skcawgra
SHA256 b80a715055798a6ddf41ff68c407d1c79817d78c7c439f6cc424dcb7012a1686
MD5 4f74ae47fa5051d2e530bb9c1e253af0
SHA1 7e903fba15ed47e4f9f471f8e7e650114cc463ce
SHA512 5e74dde5a359016a0674ecdf60b3cfdb51ffd313b465373eaa99813a06d7e8e9c6218af9a944883ba8d09a84eb165c9c2dd3a182f5a1573e7ebd9ac4c6224190
SSDEEP 393216:GbNbbv3+quY8TLJ1gqas6ck1CPwDvt3uFKCyMJcsi5aYs:GbNbbv34VV
TLSH
T1CEE6AE6AA7BC0149E4AAD1BCC2975323D771B91927B053CF5A6046F81F23BD52B7E380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution spyware

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4544	onlyskills.exe
4544	onlyskills.exe
2244	onlyskills.exe
2244	onlyskills.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	api.gofile.io
36	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1424	cmd.exe
2288	cmd.exe
628	cmd.exe
1092	cmd.exe
4432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
628	cmd.exe
4220	PING.EXE
1092	cmd.exe
4432	cmd.exe
392	PING.EXE
1612	PING.EXE
1424	cmd.exe
4632	PING.EXE
2288	cmd.exe
3136	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315877570004187"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\onlyskills.zip:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
4220	PING.EXE
1612	PING.EXE
4632	PING.EXE
392	PING.EXE
3136	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 948	4160	chrome.exe	81
PID 4160 wrote to memory of 4304	4160	chrome.exe	82
PID 4160 wrote to memory of 4304	4160	chrome.exe	82
PID 4160 wrote to memory of 4204	4160	chrome.exe	83
PID 4160 wrote to memory of 3688	4160	chrome.exe	84
PID 4160 wrote to memory of 3688	4160	chrome.exe	84
PID 4160 wrote to memory of 2936	4160	chrome.exe	85
PID 4160 wrote to memory of 1844	4160	chrome.exe	86
PID 4160 wrote to memory of 2936	4160	chrome.exe	85
PID 4160 wrote to memory of 1844	4160	chrome.exe	86
PID 4160 wrote to memory of 4016	4160	chrome.exe	87
PID 4160 wrote to memory of 4016	4160	chrome.exe	87
PID 4160 wrote to memory of 4936	4160	chrome.exe	90
PID 4160 wrote to memory of 4936	4160	chrome.exe	90
PID 4160 wrote to memory of 3992	4160	chrome.exe	92
PID 4160 wrote to memory of 5028	4160	chrome.exe	95
PID 4160 wrote to memory of 5028	4160	chrome.exe	95
PID 4160 wrote to memory of 4452	4160	chrome.exe	96
PID 4160 wrote to memory of 1532	4160	chrome.exe	97
PID 4160 wrote to memory of 4192	4160	chrome.exe	98
PID 4160 wrote to memory of 4996	4160	chrome.exe	99
PID 4160 wrote to memory of 4996	4160	chrome.exe	99
PID 4160 wrote to memory of 3184	4160	chrome.exe	100
PID 4160 wrote to memory of 3184	4160	chrome.exe	100
PID 4160 wrote to memory of 920	4160	chrome.exe	101
PID 4160 wrote to memory of 920	4160	chrome.exe	101
PID 4160 wrote to memory of 412	4160	chrome.exe	102
PID 4544 wrote to memory of 1092	4544	onlyskills.exe	108
PID 4544 wrote to memory of 628	4544	onlyskills.exe	109
PID 1092 wrote to memory of 1612	1092	cmd.exe	116
PID 1092 wrote to memory of 3780	1092	cmd.exe	118
PID 2244 wrote to memory of 4432	2244	onlyskills.exe	124
PID 2244 wrote to memory of 1424	2244	onlyskills.exe	125
PID 4432 wrote to memory of 4632	4432	cmd.exe	129
PID 1424 wrote to memory of 392	1424	cmd.exe	130
PID 2244 wrote to memory of 2288	2244	onlyskills.exe	132
PID 2288 wrote to memory of 3136	2288	cmd.exe	134
PID 4432 wrote to memory of 2056	4432	cmd.exe	135
PID 1424 wrote to memory of 2220	1424	cmd.exe	136
PID 2288 wrote to memory of 4912	2288	cmd.exe	137

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4516	attrib.exe
3780	attrib.exe
2056	attrib.exe
2220	attrib.exe
4912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\onlyskills.exe
"C:\Users\Admin\AppData\Local\Temp\onlyskills.exe"
1⤵
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8957c728,0x7ffe8957c734,0x7ffe8957c740
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,1575063286687148398,6063653079135652545,262144 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,5511723917934911770,12512414878615800349,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,9004954018269160661,2654763821619766534,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:13
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,3877561206464462492,2802998273456342323,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,18111910770060846009,7941902400094473917,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,13348153758629253474,7343926984964177826,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,3756641582428815183,5100344732491212715,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,4745039115656224825,8494350730548568795,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5824,i,17675719245274807861,13025109868708230311,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3616,i,12654775334010359112,16784230651531363594,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3644,i,15217441346206376320,7772581583293312888,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,15129953147224597644,4052367542900351306,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4324,i,13308025615046277579,7655351348348323049,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6016,i,1434837291958806573,13044457344375448854,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4836,i,10568284347896241670,11436097062039817237,2097152 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,10382404772635991359,3219356041008176825,524288 --field-trial-handle=1936,i,16732041107212322703,6702245644327460457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  - NTFS ADS
  PID:412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3184

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:244

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1620

C:\Users\Admin\Downloads\onlyskills\onlyskills.exe
"C:\Users\Admin\Downloads\onlyskills\onlyskills.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll" & del /f /q "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1612
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
    3⤵
    - Views/modifies file attributes
    PID:3780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll" & del /f /q "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:628
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4220
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
    3⤵
    - Views/modifies file attributes
    PID:4516

C:\Users\Admin\Downloads\onlyskills\onlyskills.exe
"C:\Users\Admin\Downloads\onlyskills\onlyskills.exe"
1⤵
PID:4908

C:\Users\Admin\AppData\Local\Temp\Temp1_onlyskills.zip\onlyskills.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_onlyskills.zip\onlyskills.exe"
1⤵
PID:2268

C:\Users\Admin\Downloads\onlyskills\onlyskills.exe
"C:\Users\Admin\Downloads\onlyskills\onlyskills.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll" & del /f /q "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4632
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
    3⤵
    - Views/modifies file attributes
    PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll" & del /f /q "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:392
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
    3⤵
    - Views/modifies file attributes
    PID:2220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll" & del /f /q "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3136
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\Downloads\onlyskills\libcrypto-4-x64.dll"
    3⤵
    - Views/modifies file attributes
    PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2c224d769d767f1dc879bf4fcf8704fb228ee25c10b9339c53960fee49d04dc6
MD5 1254d0f2d0f82f60356ccb6811db8579
SHA1 ef647642b331a2c99203403a0b85356c6c05385d
SHA512 91de7df9abe8d07ea12e4c0d19527cdc707be759e988c442c6949d90be642ddab5ed8b17b87b8ad7aca7dbddbdecc6e86aa0fe5383bacdd8322801c06fc0879b
TLSH
T13CE022B9CD21EC3B2CFE1B58A0345646E70003173B81898B3A3D95088FB063B4995CAC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 8a9ed5ebb8fa3593c0d9c390cf9eb9cb4b06677f581e8ddea23811999419ff2e
MD5 f299913c36f55ff156a516a37a7270d2
SHA1 e1144eb0ab185a8366641d92f88fc9b1c36a65bc
SHA512 c7bebd340ac92c513b2a08ffdf7e7fa81ca87606dc5a11bf160d505e04a7e59ca108da463678680de9df51da80d9d758f5dd0c4de0a7365705f7634cfea5564d
TLSH
T1FEC0922454C09142DBA552B45866009125A11A7A01A2A91A82A14EBF94ABEA280024A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a426ccb069b1772db8f0b19ed99ec54caf0c7d31e6b305f47f708bd0cdd37111
MD5 8a67e93b7ac36069c1f12ac8967f7fea
SHA1 e289c65c9fbaf405a02ec8d0edcc496bbaf39777
SHA512 e88189dfa19a98f03955e84d70293726e3da78ce213ba079ee665b4581b0d24bdcc44b8a3f2789dabb2c685b2dabc33a67bc50b9bd7c0e7c284a5cb16e1f090c
TLSH
T1F3213EEDA54C3932DB5392703CC380A5397305822757AD66C3C8CDBB4335F86C5D40A0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 5f1568bdab92f4389c286b0c67275a9b088d160711bd8cbe527cf7cf0d20c56c
MD5 528982c723e842c87490f37dc351b18f
SHA1 bbae270f7bda71df5f3b00e6f08ed84f1ac2193b
SHA512 3d74e78d0d7e1b7c5cf5ce4d1222e227ce3a09f4c45a752ac842ae766ce238eab69b349aeb7728488320c2a1e5697dd4dd42f7b1481d0d5443135ea99aa1a34e
SSDEEP 3:MsEllllkEthXllkl2zE/li47tl:/M/xT02zeJl
TLSH
T1E24402056B801406D90011344051836053B0E85007267743245108337C85E400C10408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4182fef271ca4272cf0b4820a57d61a669d6c08837a9279918fb9a063de98053
MD5 476180da831e2007b9e140d7f90e7c8a
SHA1 55180b376559e048b2f07f3ecf250491eaab92f6
SHA512 1c8c20f096414dcfaf0a4e10aaae7387afd689921d57f29838d1a468206c17ff176725129120ad3db36ba9b49ddfe78377f4e01e1da38bfc7e479e6fb29e59a2
SSDEEP 48:YALlqsqqHh7h4hiaXYfoKs0gmzsTfskfoswKsTUqzsQcs8tsq4saHP+ySbg85zsv:DXzpGYaIHU9fg+wINaHP+ySM8xe
TLSH
T15A91BEF7C3E8C96DC91152F49B166E2FCD290924532C3D66C8D4AE4B93E2872D24078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ebfddc5d1e64118ab85edbd726bbd5a913601e667fd25e03769442b3d7a86e46
MD5 5d3446b5dd82b0a9a460590a75d88448
SHA1 b39b9428e502a0ee3f39928724905e887a6fc66b
SHA512 18b9a55a1706a33c74e0fd46bcfa4f551cbe16b8cfde1a0b319de1af3a4169928ff821a8f6a0a6e7243dd0a9e39ea4db5a2fd0a81fc1c53a8f12717e787e101f
TLSH
T1DD216A97D6BEF89750BD0CAF5D48BC062879A83252826CF4DE97C17CB0905E30B0A863
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d6ee9ffdd4377bc70f443c1dc35dea86206b25608c68eb384aac2d7177ab094d
MD5 2042dff3811eee202ada7ec6762e6ab0
SHA1 1e178f13acc255120e0d1be1fe5a6d328f1504bb
SHA512 75d29ed76d55804c28422e25c290be923cb54bf623dd2160610d879d887eada3615a4fe3e61f6a2482011e123d79a1668bb8e1026020bfe33e91aa9ca8acfb67
SSDEEP 192:IRCRnmARtY2+v7lhAPRp2/rc9+Hsb+WNnZv4us2iUDse225FTVyIsnAUgtaJ:IRCRmARD6R8XJ0wZW2PD025F18
TLSH
T15C52D66ABE20797B6CCBD329FA117B57D7F4102124952E84EAFC892C14E79CC321B44B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 961e16ad3a9aadb3e0bda64a357be7c16ed18d999526bb6c7289bf7392278ceb
MD5 6e3245b722d5911375df7d3be45487f0
SHA1 6018bfdcd7e179259b0070b85559ce5f752acaba
SHA512 ffeff9b34e0d9105b7a4db38fba3aeced678a41083a9a78fa2142750e51fad88b0caf261b23624ede18c06d52bc3e651b4dfaebe17d7861418b1ca8299034750
SSDEEP 192:IRChnmARtY4dv7lhAPRp2/zlBc9+Hsb+WN3xZv3VT+us2JUDse225FpVyIsnAUge:IRChmARNdR8XX0wLRE2CD025FPe
TLSH
T1F252C5AABD20797B6CDBE219FA117757E3F4102265911E84EAFC8D2C14E79CC321B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c4d4a5cf50587808d5c2a3b7e5b65344b42143d06010154ee0d4e7c35447e71b
MD5 300896a75676c3286080f4446870cd40
SHA1 a4fcd62fcee9f9e9e052ecfa1cdafdd46b034f8a
SHA512 852cd97c51433db8ca268c17bd0de5a7820ef6c588a516ea142d2a169e19e174105a2dc9ffd9e41f9d56cf602041f3b5e9acf16460c30952abad98ad846724ef
SSDEEP 192:IRCRnmARtY4dv7lhAPRp2/zlBc9+Hsb+WN3xZv3VT+us2JUDse225FpVyIsnAUge:IRCRmARNdR8XX0wLRE2CD025FPe
TLSH
T17F52C5AABD20797B6CDBE219FA117757E3F4102265911E84EAFC8D2C14E79CC321B44B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aa50c0af74b3a03a268087b5ced31709a87c62b584877cdcd35bfb9a8480eaf2
MD5 21a7e88cb489b1c9238b0cd7439b3bb1
SHA1 bd2de1527517f4f2ea5b15e247a531ff618ce4d9
SHA512 b871b7a52df6ab9e878bd0dbc3bfc40da736515edd45eb8daaebf43773c51857dd9d40f0ae1421c2c6e90b32483e30ed09158206282b73baffc09dae35fe28c1
TLSH
T140B0124084015501C84213F41AC2189CB1149F21970A570263E0E93388393508254060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595d68.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595d68.TMP
Size 96B
SHA256 8f4af9e7111c0d3fae16e419ace49ef849efbf275c86d3c02de53de64d6905c8
MD5 8f8ea80ef642b668ee5b2ecb30e78856
SHA1 3782216071d10f0ef0f460b7fa36d6abea91513d
SHA512 d63042d3607fb58cc2d6afaa8f20a84937c2ab403d720cc9d29b99c43ed08a92e33024b0ac28619f08c9e233c7dbbd9025eaa7f468e95263884ec86f97ec3236
TLSH
T1B1B02280C0033203C08A03B028A0A0CCB0B0CF28C2032232E3E02A33CC302F00030030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 c1bd8c42bd26da06660eafeca4cf533749ee68f641693d58643cd6949b9d01a6
MD5 2eddc52f6900e0b192cb531df1239902
SHA1 353f56ddb666d16aec8e5b7a20bf5bc1aaf4636c
SHA512 b6f0f9dac7980999b48cdd0634343dc75c011b134470c01dfbfe874755004135237f144a5551eac8963bd129028e109056531cca41d24dc916c5fa5b1e443369
SSDEEP 6144:kYutftP750fnpqP/8W3WqJrdOK8YhIBm7Rkm1tYpBeh2BAo+:Mt/0fpmDxQKFGI9oBGcAo+
TLSH
T1343412337E267A7A09AA2F45A0CE1E0F5D61EBE7DD249E058CE86B0417D478C3A44F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 ae823b89cb6eab6020e6d7e4a8a4d2378bfc25ded2b0f8342076289e57e72013
MD5 2bfae072bef678c7847ebb068b7dc938
SHA1 5932f34b8da993f0e93050ebfb17c6bf4e78b57b
SHA512 07ff6386e17595b9f51f7f1eee823c03c004cd5fb5c36ba59d9e5933bd3f05ebd5a436e06c623839a562f4eec27eb20ed1a587eec0051445560400d7fd48d3a6
SSDEEP 6144:vSutftP750fnpqP/8W3WqJrdOK8YhIBm7Rkm1tYpBeh2BAo+:Ft/0fpmDxQKFGI9oBGcAo+
TLSH
T1B63412337E267A7A09AA2F4690CE1E0F5D61EBE7DD249E058CE86B0417D478C3A44F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 34fcac79886d269d8fe1995ea8d9066436a476e569a0913235f3583f839e526a
MD5 2738e8eee8a54127842f3b4e9997fb2c
SHA1 f1f20d3b07063825bf1537683a9907032a5cc7cc
SHA512 4736dfff7ba2c4b86a7bea91873e933560ce4c7285c145a04350a85ab4bb8276e12eb6abb206a68f8f9c9a6af3c59b5cd19d9b53a048fde9e3276e6dd022b4bb
SSDEEP 3072:DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:6m7Rkm1tYpBeh2BAoa
TLSH
T14EC312375E71A97759B9BB4EB08E0B1E1EF149A2D920DE82C8D85B0437F97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 b467fa0a42fda810c97f64f2f5aa8f58e428266ff18649402711de581ae4d077
MD5 c24071cf47ec77d044a6be14494760f4
SHA1 5d0622dec9832edf1ca946d0f198d63d7fcaceb9
SHA512 ce2088d10de8a499edcd6d30e9b6c2dcce258fc48d23dc935388ac8e1a8b04b2988acb63bb704a16d48aba6b5f01576f2c229f534482fbb61e7710777ac77647
SSDEEP 6144:OutftP750fnpqP/8W3WqJrdOK8YhIBm7Rkm1tYpBeh2BAo+:5t/0fpmDxQKFGI9oBGcAo+
TLSH
T12F3412337F267E7B459A2B4AA0CE1A0F9E21DBE7DC259A414CE86B0427D47CC3644B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 e31d1c6d23b7be16c8a610cba235d0e97430da5933f9acf8b84256df42157cc9
MD5 0596db9cbb3dd4ca332dc8e8bc4c7b2c
SHA1 408027f50f4590c96ef7911f4de8b4cfdd923840
SHA512 49cc1d604e067951033e2e2182349dbc4fecf5031854ddeeffe50a8c19b820d5ffd33a39ec6ad731f6db7b429ad692c0464c8b5f4ac9fcf93849e72a7d9a9307
SSDEEP 6144:tutftP750fnpqP/8W3WqJrdOK8YhIBm7Rkm1tYpBeh2BAo+:ct/0fpmDxQKFGI9oBGcAo+
TLSH
T1CB3412337F267E7B459A2B4AA0CE1A0F9E21DBE79C259A414CF86B0427D47CC2644B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-4-x64.dll

Path C:\Users\Admin\AppData\Local\Slotted\bin\libcrypto-4-x64.dll
Size 7.0MB
SHA256 6f4f20a28daec8c04283fbf1060eae8af34f65152d03e651dd6b85d5f914ef49
MD5 0108d4cb9fabba81b12ddc409185d844
SHA1 f52fee4986231e00776232d99cc24afc6b7400e0
SHA512 0198cb64c9a10be3cee76d6f901711d4bd1ed437da38240c7a6d3d09e3997c01914dbc47a8b138946a9e2cc33f1d1fc0a67f3b5a2883559c1dcedf230fc873ad
SSDEEP 196608:RquY8TLJ1gqas7+zAk1CPwDvt3uFk1Cyo:RquY8TLJ1gqas6ck1CPwDvt3uFKCyo
TLSH
T178768B6DA6BC0109F8AA81BDC2875227DB71B92957B013CF596186F81F23FD52B7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-4-x64.dll

Path C:\Users\Admin\AppData\Local\Slotted\bin\libssl-4-x64.dll
Size 1.5MB
SHA256 d4ef34a4634fdf5c3b906db860f92165f2ac5ccc5d22a9f0057452fd983c2a9c
MD5 be2c04bd82db4756c36c7368db373209
SHA1 d723f30e38c5e2cf3947d7c07598bc1e74decd7a
SHA512 7106b567dede58bf51f2d935a97c508799277e85b2d7506abb829e1b534c34c146d10bbe98f3005629b1fa7d7ec94185e86f512d1981a1d6a08950739e321de3
SSDEEP 24576:D75P0Ck4beojAzF2ztS8TyOeRqKJU3uW0lyzZRg5aYshsVO:Z0CTeojAzFES8Eh23p0lQRg5aYsr
TLSH
T1FB756D5BA7B8019CE5B6C17CC6874623D2B6F4193730AAEF065189781F63BD6273E384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onlyskills.zip

Path C:\Users\Admin\Downloads\onlyskills.zip
Size 7.6MB
SHA256 b4db683752675fe3b941ed6a449ffdd3b7f3e438dd72a8d596a5f3a5cd918fa7
MD5 059ae7de65b1063f3a02ee86bf34f5df
SHA1 cb700c2c7f9b5f8ff9cb6553132b12c1cdf06176
SHA512 6b2d8f7da1abc54c7f02f0e511a480427948d41828c892734984506edaf5fedf8e6141b7efcf02a762c833dc5e9e3e3490f8eff555b8023c02b3a00f92700f25
SSDEEP 196608:YkzZmzOvazxZGlW44hekhDXLWaIQF99dv6M17NlofJtc1GNKC:YaZKzkW44hekdis3RV1RAJtc1GD
TLSH
T1D78633F5CD558249CB5EEF737CC44D34B68090EF2A5FB538485762BF60E12BAA220E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onlyskills.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\onlyskills.zip:Zone.Identifier
Size 164B
SHA256 21bd61d02eec3771279dc7e0366b0dbfe0556c43a056581ab6f2c4731a5ffa6c
MD5 fd1cf404123097094b64f990a3ca497c
SHA1 679dae4b08d32508ac5a0ec224978dc306b25e6c
SHA512 8cc4ece48177a99101660feb41e27d989682727afe7c89ad41d3c58343586932cc650e00d16ddd9af88cdd4d38069364eca3e5a359d0410671bda4c558475c1f
TLSH
T19FC08CE78004956A0B4437C83B68A0DCB10FA449C9A94958D401544FA4858A5C5E1C6B
MD5 SHA1 SHA512 TLSH

Submit Download

region.txt

Path C:\Users\Admin\Downloads\onlyskills\build\region.txt
Size 4B
SHA256 acd570ebbb5339ea1e01a9347b60dc5a9c93882485d466d1a4f01fd1e50714e3
MD5 913def31b3a9a3a2bab3e4028c668261
SHA1 30f3efac35a35732b5e9305182309b9fdfadae7e
SHA512 c7768588ca4e996c50adff12b1674524e249b50994e2bae41ce4b286a132d3b061bbfcfd02f64153939f857764b5291ff4402aea988b1555597d0e9640259669
MD5 SHA1 SHA512

Submit Download