046e6f623ed02fb000b8fba989be1c7b6e46ec60a8bed764f6fae2c25bd5ae05

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
done/BASLAT.ps1
Size 813B
Sample260910-txr86avtet
SHA256 046e6f623ed02fb000b8fba989be1c7b6e46ec60a8bed764f6fae2c25bd5ae05
MD5 d7b6377e890f19898188492e79692c4a
SHA1 9d1f48e3a159d0ba9e33735c95f18fd2f086a5bd
SHA512 924355113f879bbd6c3fae92ca5ed977706291fee9f7ce4db982625711e43d73072196ed36a574ca38a8857c12b43d66bafd7950f98cef063071cd78eb08d913
TLSH
T15C018614113CB9DAC6D3AB4BF7936E0368FC855C80161955903CF0587F5116A43482B6
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2452	PowerShell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2888	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335313638866429"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2452	PowerShell.exe
2452	PowerShell.exe
2452	PowerShell.exe
3568	chrome.exe
3568	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2452	PowerShell.exe
Token: SeSecurityPrivilege	2452	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2452	PowerShell.exe
Token: SeLoadDriverPrivilege	2452	PowerShell.exe
Token: SeSystemProfilePrivilege	2452	PowerShell.exe
Token: SeSystemtimePrivilege	2452	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2452	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2452	PowerShell.exe
Token: SeCreatePagefilePrivilege	2452	PowerShell.exe
Token: SeBackupPrivilege	2452	PowerShell.exe
Token: SeRestorePrivilege	2452	PowerShell.exe
Token: SeShutdownPrivilege	2452	PowerShell.exe
Token: SeDebugPrivilege	2452	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2452	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2452	PowerShell.exe
Token: SeUndockPrivilege	2452	PowerShell.exe
Token: SeManageVolumePrivilege	2452	PowerShell.exe
Token: 33	2452	PowerShell.exe
Token: 34	2452	PowerShell.exe
Token: 35	2452	PowerShell.exe
Token: 36	2452	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2452	PowerShell.exe
Token: SeSecurityPrivilege	2452	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2452	PowerShell.exe
Token: SeLoadDriverPrivilege	2452	PowerShell.exe
Token: SeSystemProfilePrivilege	2452	PowerShell.exe
Token: SeSystemtimePrivilege	2452	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2452	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2452	PowerShell.exe
Token: SeCreatePagefilePrivilege	2452	PowerShell.exe
Token: SeBackupPrivilege	2452	PowerShell.exe
Token: SeRestorePrivilege	2452	PowerShell.exe
Token: SeShutdownPrivilege	2452	PowerShell.exe
Token: SeDebugPrivilege	2452	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2452	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2452	PowerShell.exe
Token: SeUndockPrivilege	2452	PowerShell.exe
Token: SeManageVolumePrivilege	2452	PowerShell.exe
Token: 33	2452	PowerShell.exe
Token: 34	2452	PowerShell.exe
Token: 35	2452	PowerShell.exe
Token: 36	2452	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2452	PowerShell.exe
Token: SeSecurityPrivilege	2452	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2452	PowerShell.exe
Token: SeLoadDriverPrivilege	2452	PowerShell.exe
Token: SeSystemProfilePrivilege	2452	PowerShell.exe
Token: SeSystemtimePrivilege	2452	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2452	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2452	PowerShell.exe
Token: SeCreatePagefilePrivilege	2452	PowerShell.exe
Token: SeBackupPrivilege	2452	PowerShell.exe
Token: SeRestorePrivilege	2452	PowerShell.exe
Token: SeShutdownPrivilege	2452	PowerShell.exe
Token: SeDebugPrivilege	2452	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2452	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2452	PowerShell.exe
Token: SeUndockPrivilege	2452	PowerShell.exe
Token: SeManageVolumePrivilege	2452	PowerShell.exe
Token: 33	2452	PowerShell.exe
Token: 34	2452	PowerShell.exe
Token: 35	2452	PowerShell.exe
Token: 36	2452	PowerShell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 6068	2452	PowerShell.exe	81
PID 3568 wrote to memory of 1252	3568	chrome.exe	89
PID 3568 wrote to memory of 4068	3568	chrome.exe	90
PID 3568 wrote to memory of 4068	3568	chrome.exe	90
PID 3568 wrote to memory of 2888	3568	chrome.exe	91
PID 5476 wrote to memory of 4916	5476	chrome.exe	93
PID 3568 wrote to memory of 3524	3568	chrome.exe	94
PID 3568 wrote to memory of 3524	3568	chrome.exe	94
PID 3568 wrote to memory of 436	3568	chrome.exe	95
PID 3568 wrote to memory of 436	3568	chrome.exe	95
PID 3568 wrote to memory of 2992	3568	chrome.exe	96
PID 3568 wrote to memory of 2992	3568	chrome.exe	96
PID 3568 wrote to memory of 1680	3568	chrome.exe	97
PID 3568 wrote to memory of 1680	3568	chrome.exe	97
PID 3568 wrote to memory of 412	3568	chrome.exe	100
PID 3568 wrote to memory of 412	3568	chrome.exe	100
PID 3568 wrote to memory of 728	3568	chrome.exe	101
PID 3568 wrote to memory of 5184	3568	chrome.exe	104
PID 3568 wrote to memory of 5188	3568	chrome.exe	105
PID 3568 wrote to memory of 5800	3568	chrome.exe	106

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\done\BASLAT.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python3.exe" "C:\Users\Admin\AppData\Local\Temp\done\fakeauth_server.py"
  2⤵
  PID:6068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff78d7c728,0x7fff78d7c734,0x7fff78d7c740
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,7776116430196405770,1028085748627166331,262144 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,17500768936510687809,1516326462933545509,524288 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,11392362467224128323,8955106832102288713,524288 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,1716907593878698420,9801244639553758568,2097152 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,17972423988080096292,128552519929636252,2097152 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,10332628192086823040,4655728803880792697,2097152 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4284 /prefetch:9
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,13798844112641350783,8230932005864574621,2097152 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,7853852648408382765,14686088647229482015,524288 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,12975738492111136594,7712945434475875332,524288 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,1074921196916310422,211221753012273867,524288 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,5798249478771981318,9691298767585728763,524288 --field-trial-handle=1876,i,17159963212643332759,2648698869863713015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:5800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff78d7c728,0x7fff78d7c734,0x7fff78d7c740
  2⤵
  PID:4916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 62943e86a1df19d3b3008bc9f5468bf708a204376798193da8120ab1ea31c435
MD5 9e7234efee55692aa3877233e769f1d6
SHA1 821b9927ed54b4123aced604e85481b1b7de4b5e
SHA512 b636b177b9b6f361dac911cd716f2f2cb3e76bf334c788a6a3753c0989ab2b204785e6259c4a8539139703711e220e4ce2b3aa6711b79aebe25daa8fb77ba1cb
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 57d9bdea68e6bc2f4ba797a8846fe081ab2ec55aa0ef5e7e5d9b364a7e6afa9f
MD5 d913d421f62e05a33f459d2a1d500414
SHA1 eac4d8839520fb4cf344e905e06680e03d694a5e
SHA512 8ead30a00c4638ab38ad0492a80e52aaacb941a132240680d78eeb1e6c89338e7debdd3793674abc86052834862623dca0dcaaa1dee639a518333a8b42e1e925
TLSH
T15DE02BAAC921EC271CFD1F3C61951745D66003172B805A0B3F3C810D8FB1B3A814681C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 77254ddd5fbafc140e398e63daec9afdc13ccca65de71b0846f8a782d6c98b06
MD5 332b38481559bd8167de466b6666d8a5
SHA1 3253859dad597951e8a31ccea2fabd7d26da286e
SHA512 37cdb0fdbabe523acae1c01efb23fc4fa5dc1113bb0319901f468f8ed87854e0873a827ac0a1770c17899e97a1de914fe4d0c0bc531cea54ca900b6aba0eff08
SSDEEP 192:ARFsjvI04kjUDv7HpAPRp2y9DHsb+WNncbn742lEpNEyaVyIsnAUgtaJ:ARFsbeL7jUXR5wUnE2lEpNG8
TLSH
T12142D72EAD107A3B5CDBD26AFA667B57D7F5103121D42E88E6FC892C14E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 66b867b7d16ca25da6c19fd3373247ac3214fe8642f9b8a596b65d77bf081938
MD5 ecec4899f83d110afa5bd560f332f772
SHA1 a6c1bbc78e0d814ba084429f1a0b9dfaf3a347f4
SHA512 eae9db4590bd6c5c96b65824db805e4a166f1c4a724bff1f2d8b89d20bec848eb4ef48213faf0623ce05be60fbcc12dc84d17590c15f59b0c227a0f895773b54
TLSH
T138B0120180025551C08A03B421426488B1545F10970B174243F0A922CC2A1A18324050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a52c5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a52c5.TMP
Size 96B
SHA256 674f8b9b1a55cb50b567c9d9c59752392880f05bca96a68a2872e362d54136d9
MD5 5e3279b8298f9aa302047b582ebb8aea
SHA1 dcb4018916b61cca4356fd152b8c1c491f2e9aea
SHA512 e68ba36486dd123717cf2024cb30cd6cfdc50aa67cb567233f7e12396c82008d268a4d9e8421c66a4c60b7feb898307c9082aea0d0f4063bf2c6b87ed810269e
TLSH
T1B5B02200C0033282C20203F030A88ECCB030CF2AC3030202C2E00A23CC232B008200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 e21a1e9a6cf1ed28d6793c66f27dff4c8f924525670f41c9b450201330460638
MD5 44283a4762f0b066e7c5b04eef5b9d09
SHA1 4b5144dfdd531a5d5ebecbb90481dfed0da013a1
SHA512 8abde392ab810272909d7ad1030b389329b3073c3304c9f2803d5e9f6b7588d4621af80d86898490baa32c7eb211df83b9114e30834ea97a2fa93d41e31f7eca
SSDEEP 6144:IQ5tTbRIn7e2f7vwO62m7Rkm1tYpBeh2BAoE:I+38eiCB9oBGcAoE
TLSH
T11E34221B6DA0E93B15FB9F6EA48F0F2F6EF35981E910C6D188D07E05D695BC0184AE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 03b01b3695f646a8bd394d8a3d9e0ab7db0a9e8ecc017e352efaf07aa1901448
MD5 d6ad8c1f5739676d0daa8948e9891d14
SHA1 921ad0470d74aec4dc4b55763dc4f9e3f8ec1f12
SHA512 41c6fba56dd5f6e2f3e5b150a41085fadd4efe715ca07b2030f2747a8a67bb01510810c64da25f3ace685241de8c9ba9d06629bf1462dd6e376f1dcf76398af8
SSDEEP 3072:uGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:pm7Rkm1tYpBeh2BAo+
TLSH
T12BC3122B5D71A93658B5B74EB08E0B1F1EF149A6C930DE82C8D86B0477FA7CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vh121hpd.mai.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vh121hpd.mai.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2452-23-0x000001F720A50000-0x000001F720A5A000-memory.dmp

Download

memory/2452-27-0x000001F7210D0000-0x000001F7210FA000-memory.dmp

Download

memory/2452-31-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-30-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-33-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-32-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-34-0x000001F720A50000-0x000001F720A5E000-memory.dmp

Download

memory/2452-35-0x00007FF43FA60000-0x00007FF43FA70000-memory.dmp

Download

memory/2452-28-0x000001F7210D0000-0x000001F7210F4000-memory.dmp

Download

memory/2452-29-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-26-0x000001F720A70000-0x000001F720A8A000-memory.dmp

Download

memory/2452-25-0x000001F720890000-0x000001F7208A0000-memory.dmp

Download

memory/2452-24-0x000001F720CC0000-0x000001F720CDC000-memory.dmp

Download

memory/2452-0-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-22-0x000001F720A90000-0x000001F720B43000-memory.dmp

Download

memory/2452-21-0x000001F720A70000-0x000001F720A8C000-memory.dmp

Download

memory/2452-14-0x00007FF43FA60000-0x00007FF43FA70000-memory.dmp

Download

memory/2452-8-0x000001F71D830000-0x000001F71D840000-memory.dmp

Download

memory/2452-7-0x000001F720560000-0x000001F720582000-memory.dmp

Download