a7c46602fce8e6eebc09c303b9e6d2a5258f35dc9b8846c312c8601bf5eba67d

Resubmissions

03/08/2026, 12:39

260803-pvm47sy1et3

03/08/2026, 12:30

260803-ppmlgsbj2w3

Analysis

user interaction
yes
max time kernel
44s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RoCookie.ps1
Size 1KB
Sample260803-ppmlgsbj2w
SHA256 a7c46602fce8e6eebc09c303b9e6d2a5258f35dc9b8846c312c8601bf5eba67d
MD5 044d42b477e094818c2041d4c2c7a59b
SHA1 f6c65a5d24f3852f94f1d1f72d5215e08e2e52bc
SHA512 b61f2be6d24d9be8b81c3208fc6f3dd36fcc41fccd4ec2aba285a67800cfa41e260e7bda77a1d205ef86b7755473598fa4b00511e92f8d7905e46d74f3d9f61c
TLSH
T15C11B1899F52552D49F0C7E69C504316D96E512554F30502F6EA81547EE0FC24AEC1DE
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5416	PowerShell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4860	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302338348962020"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5416	PowerShell.exe
5416	PowerShell.exe
2188	chrome.exe
2188	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	PowerShell.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeCreatePagefilePrivilege	2188	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 4860	5416	PowerShell.exe	81
PID 5416 wrote to memory of 2188	5416	PowerShell.exe	83
PID 2188 wrote to memory of 4040	2188	chrome.exe	84
PID 2188 wrote to memory of 1220	2188	chrome.exe	85
PID 2188 wrote to memory of 2484	2188	chrome.exe	86
PID 2188 wrote to memory of 2484	2188	chrome.exe	86
PID 2188 wrote to memory of 5172	2188	chrome.exe	87
PID 2188 wrote to memory of 5172	2188	chrome.exe	87
PID 2188 wrote to memory of 1000	2188	chrome.exe	89
PID 2188 wrote to memory of 1108	2188	chrome.exe	90
PID 2188 wrote to memory of 1000	2188	chrome.exe	89
PID 2188 wrote to memory of 1108	2188	chrome.exe	90
PID 2188 wrote to memory of 4236	2188	chrome.exe	91
PID 2188 wrote to memory of 4236	2188	chrome.exe	91
PID 2188 wrote to memory of 2732	2188	chrome.exe	92
PID 2188 wrote to memory of 2732	2188	chrome.exe	92
PID 2188 wrote to memory of 3636	2188	chrome.exe	93
PID 2188 wrote to memory of 5848	2188	chrome.exe	95
PID 2188 wrote to memory of 5848	2188	chrome.exe	95
PID 2188 wrote to memory of 2692	2188	chrome.exe	96
PID 2188 wrote to memory of 2692	2188	chrome.exe	96
PID 2188 wrote to memory of 3000	2188	chrome.exe	97
PID 2188 wrote to memory of 3000	2188	chrome.exe	97

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\RoCookie.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff23a5c728,0x7fff23a5c734,0x7fff23a5c740
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9265861373145216764,13516348038921238516,524288 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2120 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,482755670068702831,4989247059963006505,262144 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,15558158794201415153,16777899182974541044,524288 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:13
    3⤵
    PID:5172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,7553755412185538404,6641597062214566811,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,9466823256625561454,2485180342751556817,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,3964548072345816823,18314879874146684099,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:9
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,12107778518741194107,10829710036605271415,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,1721871797093093563,9750822260233282619,524288 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:3636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,2053261545136544417,3977618807336650527,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3332,i,5977174257093423518,16250058916518880223,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3440,i,2290371321887473834,3259612209366077559,2097152 --field-trial-handle=2044,i,9754110517700941988,4337133346030781667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:3000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 53406932a2c62a78583de0d08f398355a9980e2e47589625306f51752cd424f6
MD5 97e4c990f46debc928b8335899cb7b5b
SHA1 6bb2b11c279de6877dde162295cdb08ab80b2216
SHA512 5ba5ce48eda1004b04986cf80013aa46dd2d2106df9f18c92a30e9a3da6fcc54c8df912322f55702ef9d1443fe0a47133689e1fd6fc81c33f0064da2b3efedaf
TLSH
T17DE02BADC861AC270CFD1B6C61550785D76403172B809A6F3B3D901D8FB1A3E554581C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 27d9012f570ca4d9169ee04f49be86cff0891de5c4faffd82709891d09be5870
MD5 bfaea51c197061f92d7bd769e2823c4e
SHA1 a65188e59768a7ac4534ad2c5bf34c79ee61e329
SHA512 9894b481a5a18c4abb3bcfcb286c0397619edb948243bf71c346a4ebc268c186567f539fdb91a2503b92474a463e51c7352c9596847182d1d89a39c972566e70
TLSH
T1B0518AF3D7F4866DC91556F4DA21AE2FCE2D0A14131C3C6688D4AE1B53E28B2D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 4c97a53dbb4a23243709026f9fbbc03447af3388d54fe87997f9ccb7988d7c9f
MD5 7d99e81f3c66f467b9f875cceee890b6
SHA1 960d257b6c462603ed759a83d37b40b1bc10e8c2
SHA512 5a324d2be0aae6d5aeaa4771b084190f64a83ded4cb57ed9c633837d795c29640768e32efd619e9a31498f43c0f0868d7e6c636e711eed45125cb53dc09b31ce
TLSH
T12FF0C9E7F67C383B50B910AB5E00BC09B8BAA8350150ACF4CF9B412CD0810F30F12023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fae91aa12b4836ae7c330dbb481e66b37341be8d46a571d662cbf125558bcb55
MD5 18911515e28ba8746e6abcb39da4fc73
SHA1 16cb5ba37884e98025bf558e24e894d7f54a0cc2
SHA512 3be920d2604ff73d19bf4a05873dfd80a20c4ed39a2bac7d532af9b0458245f5a369003b7cbd98af8a0712402d973d7b2e7cc9f6e7f1ccef7588078611f03c6e
SSDEEP 192:dRCNv7gRT8v7HpAPRp2y9DHsb+WNNoee1MYn9LB6TkwDr+VyIsnAUgtaJ:dRCNmojUXR5wNAFn9LcTm8
TLSH
T13F52C42DA9003A3B5CDAD22AFA65BB97D7F5102231D41E88E7FC9A2C14E75DC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 344a6149844ac527cd2f5a7de12be4f9439ea1de8117aeb88937a06668121f53
MD5 5bd8a133f123fcf92e145f7e6e0616d7
SHA1 6a8dcba69db7a39982cc46521f5fe0a7996a0f61
SHA512 07e335e0dc4ab92dabd32e50a98d91adc0d0cff806729b0b7ceb8be67197fc91844be304a448276e6098993bf0a384818b128a352c61dbe77cd8d2a8dcf964c1
SSDEEP 192:4RCNv7gRT8v7HpAPRp2y9DHsb+WNngs0ZLB6TkwDr+VyIsnAUgtaJ:4RCNmojUXR5wX0ZLcTm8
TLSH
T10852D52DA900793B5CDAD22AFE61BB93D7F5102631D01E88EAFC9A2C14E75DC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 947b6d2b9c6b24b808ee123605092c6c792aafd06865a8e7f69aae1cd06df38a
MD5 666e79e6ecdf3f1c457b2c83fee733ec
SHA1 258d15bf84f26a1fbe8b531d0b85165370fe28a9
SHA512 a1a91db213a1dcb730e8489b774204cc8cee7d9f5a154cd93d9891276cdbc8b960f9e3e8be0dad95e4cd745b4734e58e265c2ed7ffc248a8c10d75dba86ad3ea
TLSH
T154B0124080416102C14202F4118254987129DF10D60A170143E06A2288256629035151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58726c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58726c.TMP
Size 96B
SHA256 8b3e1d720c448ec1c6d424045a2ecaa4a116a2d8c3389ae43590127e08ef34cd
MD5 fd4a0b5dba25dbba228497be52e23e04
SHA1 715c02ea82828ed20b8129fae55b938393815793
SHA512 6365d8d61bb1e15f58b159773e6dfb292a9bb2807a48c93ea6823faa1945553a36992058f752287dfc048bcfcc72ff3b448502b79629599d2894713cf3e9c32d
TLSH
T154B02202C0023203C00203F238A0A2C83020CF23C303020383E82A22CC20330222B820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7d57a6a85d9a84a8312982edcc060795134d40eb8bd8959955f533939ad057ca
MD5 ff013af9025e3e3985775decee2fbc14
SHA1 90d2c7c411383c6f8aa9d7263f9ad01655b29f71
SHA512 474609a9da4de2c1ec9a5230be5eac3b03957ae44acd3125cc7582cc094e6ccfabba4a9ce45695fb8ac48396642654d895402c568ce4f8c3f92d6e1d5a7f1e98
SSDEEP 6144:2MOjfntnAFzvVMoi39CTm7Rkm1tYpBeh2BAob:KnyzvVid9oBGcAob
TLSH
T1773423668D7DB9B15D98971DA08D1F1F3AF38CD79934EA62C2E41B0413E27CF4A05A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 e460101c77814839f7b3a519d11c535b0ed18f4be8fad2af33d04657868adbff
MD5 77bdbd52357cf226a53d1505cc659301
SHA1 1a72f7a2f12c797b2da6308b0799d0f5fb75c510
SHA512 9e64d45350bd0a75cdbb4b75207d12509c5d7e890865e6b9dd6331a33048720fe166bf59b6adad08b1b8f53537c172307e35ab69be94b575a1e41dd29752fa86
SSDEEP 6144:nMOjfntnAFzvVMoi39CTm7Rkm1tYpBeh2BAob:NnyzvVid9oBGcAob
TLSH
T19A3413668D7DB9B15D98971DA08D1F1F3AF38CD79934EA62C2E41B0413E27CF4A05638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2a91232248b985b3199958a784ec4401bf41959566ffaf455b257c2de5312bd9
MD5 92f62c235dcac398596fd2678396ad00
SHA1 e5286487c25db2982dbc33f0be600d49d9a738c8
SHA512 cafd3c37212f953feec64e5078efbbb25064271d0595fa96fd8f1880727364773b73e84db92e11beb0b54417d0818d3edde3f0e213e5c4b95e1e728390ff46ab
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:3m7Rkm1tYpBeh2BAo+
TLSH
T1E9C3122B5D71A93658B9B74EB08E0B1F1EF14DA6D930DE82C8D86B0477F67CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f7a70e85fd534d04acd253de2e04bdcec4a603bfaf0cfcf7ab757b8ccc9247a7
MD5 4855f886ec06520647950bd4032916df
SHA1 255ed61165dc22b53b152ea843eb22fc4b5cca58
SHA512 40042291aa19a9bc4463b2b6520d5b014d0bdb056b9776a8a6cb8615abbec887f4687d92ccae38953513d78da799ec961d403e9bf58026804ade354ba4a41fa8
SSDEEP 6144:OMOjfntnAFzvVMoi39CTm7Rkm1tYpBeh2BAob:SnyzvVid9oBGcAob
TLSH
T1B03413668D7DB9B15D98971DA08D1F1F3AF38CD79934EA62C2E41B0413E27CF4A05A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_wmckb3gk.rbf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wmckb3gk.rbf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5416-18-0x0000022B32490000-0x0000022B32543000-memory.dmp

Download

memory/5416-25-0x0000022B327F0000-0x0000022B327FA000-memory.dmp

Download

memory/5416-24-0x0000022B327E0000-0x0000022B327E6000-memory.dmp

Download

memory/5416-23-0x0000022B327B0000-0x0000022B327B8000-memory.dmp

Download

memory/5416-22-0x0000022B32800000-0x0000022B3281A000-memory.dmp

Download

memory/5416-21-0x0000022B327A0000-0x0000022B327AA000-memory.dmp

Download

memory/5416-20-0x0000022B327C0000-0x0000022B327DC000-memory.dmp

Download

memory/5416-19-0x0000022B32460000-0x0000022B3246A000-memory.dmp

Download

memory/5416-1-0x0000022B2F410000-0x0000022B2F420000-memory.dmp

Download

memory/5416-17-0x0000022B32470000-0x0000022B3248C000-memory.dmp

Download

memory/5416-16-0x00007FF441280000-0x00007FF441290000-memory.dmp

Download

memory/5416-9-0x0000022B2F410000-0x0000022B2F420000-memory.dmp

Download

memory/5416-8-0x0000022B2F3B0000-0x0000022B2F3D2000-memory.dmp

Download

memory/5416-0-0x0000022B2F410000-0x0000022B2F420000-memory.dmp

Download