fdbf8c7af529c130468331015ae98868c7c16cbe75868660d66b053243d7c10d

Resubmissions

10/09/2026, 10:06

260910-l5jb8a1fqe7

10/09/2026, 09:44

260910-lqyhla1enh7

10/09/2026, 09:42

260910-lpfama1ema3

08/09/2026, 19:34

260908-x97q6aw1dz7

Analysis

user interaction
yes
max time kernel
115s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent.ps1
Size 248KB
Sample260910-lpfama1ema
SHA256 fdbf8c7af529c130468331015ae98868c7c16cbe75868660d66b053243d7c10d
MD5 12b66aae868514d04f4e932ac79babe4
SHA1 9da9cd97703b47ecca28afb88ba041becdeeabfe
SHA512 8e6d0370da2791e76c0e59ca81078a60addc4af2eeef1d190ace9a2ccd00365a3b1e244d7e8f6d0f61151b347b1c4a6d8eebebee672c7738d31f1846891b133b
SSDEEP 3072:kTG5j89c8rkCLuTwwVrLRmVChSpA/yqPWTQIn0BrrU5yMTvVOZvs:2G5jgc8rksuh5sChSpCR+TQInuI5NZz
TLSH
T18744E5457B71CA7BF84A73759827274AF378C1F1F300CF1726A6906AAE96B642C610DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4564	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335069745810044"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4564	powershell.exe
4564	powershell.exe
1828	chrome.exe
1828	chrome.exe
1476	powershell_ise.exe
1476	powershell_ise.exe
1476	powershell_ise.exe
1828	chrome.exe
1828	chrome.exe
1476	powershell_ise.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe
Token: SeCreatePagefilePrivilege	1828	chrome.exe
Token: SeShutdownPrivilege	1828	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe
1828	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1844	1828	chrome.exe	89
PID 1828 wrote to memory of 1936	1828	chrome.exe	91
PID 1828 wrote to memory of 4988	1828	chrome.exe	92
PID 1828 wrote to memory of 1936	1828	chrome.exe	91
PID 1828 wrote to memory of 960	1828	chrome.exe	93
PID 1828 wrote to memory of 960	1828	chrome.exe	93
PID 1828 wrote to memory of 3808	1828	chrome.exe	95
PID 1828 wrote to memory of 2836	1828	chrome.exe	94
PID 1828 wrote to memory of 3808	1828	chrome.exe	95
PID 1828 wrote to memory of 2836	1828	chrome.exe	94
PID 1828 wrote to memory of 3684	1828	chrome.exe	96
PID 1828 wrote to memory of 3684	1828	chrome.exe	96
PID 1828 wrote to memory of 864	1828	chrome.exe	97
PID 1828 wrote to memory of 4488	1828	chrome.exe	103
PID 1828 wrote to memory of 4488	1828	chrome.exe	103
PID 1828 wrote to memory of 2416	1828	chrome.exe	104
PID 1828 wrote to memory of 2416	1828	chrome.exe	104
PID 1828 wrote to memory of 2696	1828	chrome.exe	105
PID 1828 wrote to memory of 2696	1828	chrome.exe	105
PID 1828 wrote to memory of 2156	1828	chrome.exe	106
PID 1828 wrote to memory of 2156	1828	chrome.exe	106
PID 1828 wrote to memory of 4368	1828	chrome.exe	107
PID 1828 wrote to memory of 4368	1828	chrome.exe	107
PID 1828 wrote to memory of 3268	1828	chrome.exe	113
PID 1828 wrote to memory of 2764	1828	chrome.exe	114
PID 1828 wrote to memory of 2904	1828	chrome.exe	115

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\agent.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x4b0
1⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4b74c728,0x7ffa4b74c734,0x7ffa4b74c740
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,13881633531376310740,2321620807017001243,262144 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,9604831394890724807,11246073027275787614,524288 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,5317403954344142272,13609811359716597331,524288 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,13425838435426514677,15527945931463274777,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,18421682585816643968,7388695781916306743,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,6076428466639227503,11683957313291230274,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,1117647422518879199,2384447759673358864,524288 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5664,i,6174116032894107735,9112045742001958232,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3872,i,12346049643349853254,4127364789123880095,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4520,i,16532498851202725328,3637160507023779466,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4580,i,17196217431435652611,8874216252305468560,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=1708,i,662700207413875992,6782994624356827671,2097152 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,7517950977908071787,9135956390299103003,524288 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,1027020074907488676,9600105433447710526,524288 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,11967578318416586,13664681013587290182,524288 --field-trial-handle=2016,i,8634036958031431221,18315558601536402876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\agent.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b16a7277fa1bf27b3ad8a8958b3fa4d3dcaa22cc6e1c4498861a5da6e5c8c34f
MD5 3c79682977ef2c5cb4a2049a16f386c3
SHA1 3b3f13f1d8c29f5535859f09033c275ca89c301d
SHA512 f8198f0efad6c923089853836f1fb3ba37ac554c9df2006cf270518f4657b2b533ecd09b4d0db4116c2cd6389f26a979414ca66e04888ae5f0010f097d677647
TLSH
T18AE02BAAD935AC772CFD472C51980B4AEB4413573F80994F3A3CC20ACFF467A014582C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 db7df68140a08e1e0433d24e2f345b3a8caa97e37936e7c9c93e677248e93b36
MD5 3fa7415061628eeaf43c44f90158b1f0
SHA1 80f2684317624b35d822a274f4218a0d1a815111
SHA512 b44078067c51de8ae436ce7a652ca229d5c2f06a8e49d2653c82ca6f04cd936884e95dbf70c5c928e1bec5f12a50427ed13110ebe6590201bc1b3b2c6d723cc0
TLSH
T153B012214CC031E5FFC00AF121E10B8432E107791273279385C0F0E0C153DD04706001
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ec31d8e3a94c3d3505d87ff279aadfed2fe64240ea8fab258ffa5ae452299b96
MD5 7dd593b50e812dcd8e14e7d2f1cf29c8
SHA1 cb1db6381d09bdb3b1a0fb0b1b3830df99d86f37
SHA512 52f0a63bfe2905a3ed46c37218f04111ee8ab4f4c741b247e7542996cbbb4ca28bacfd5b4a652f48cd36d21b7712eb6606f28fb0d4522af950e281e4442c0986
TLSH
T184718CF797E48B7E891196F49A15AE1FCE2D0924132C3D62C9E8AE9B53E3472D10124E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b169752c1b4a6a1129beb78bd3ea038db120164a7248438b469f0d08d5ecc71d
MD5 e8cb7c2a7bb451c53458e7691f97f8ea
SHA1 f20f37878cc248c3938bc62e5900a166844ad43b
SHA512 64cc8f89adef957fb03bb1e3e64d1d9284beb03b593a9ae653d7bede879af7e05dd446a2cb96f15f0fe4979be1ae0b35416ca1cb2c10f3feb90a22cc352c9f2c
SSDEEP 192:wRJgxhNv78hMPRpCDc9DHsb+WNn8KqsKe5q2uqkwq+VyIsnAUgraJ:wRJg3t44XZ5wlge42uqK2e
TLSH
T11442D62EA920293B6CDBD719FE657B57D3FA102265941E94EAFC892C14E75CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 38cc52556bfab9dec357216d3c112b151f644ad10ab76a05d5f581f995b3a19a
MD5 3742389ee7d460490a3542011ef04288
SHA1 d16e6393cafcbede0c26fa069891e42017292016
SHA512 e109f068def96118c9f6ff7a13068c29423ed98180716d25fc5c4d7239f735d29afc6e96cb7da55d063a7814f56d7ad0d6abc102729669558ce66d3175eea184
SSDEEP 192:wRJgxhNv78hAPRp2Dc9DHsb+WNn8KqqY2+q2uqkwm+VyIsnAUgtaJ:wRJg3t48Xl5wl82h2uqG28
TLSH
T11742D62EA920293B5CDBD71AFE657757D3FA102265D51E84EAFC892C18E75CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 4467775461c4ec9ba7017d750e95a490bc25ec16c7f2769fd90bb69ff8b0572e
MD5 1b0529de8fd4897acf5abbdfc8052616
SHA1 bb1b25fd2f90b8d292f64e4f42455849290e1062
SHA512 21cede341be167539123c30eb298e4d9fd6badbf2715c629733ca601f14e9e0930b716ed3e89cc1d70a6cd0b84d427b8e6d3b1562e11f76d156e8748422d9ad4
SSDEEP 6144:GLWoDZA/NDQUf+8wVibpwNgoXIQjSm7Rkm1tYpBeh2BAoT:GrNA/NVwVawKWhjd9oBGcAoT
TLSH
T11434232B5DBDAD3F1DA6E36DB00B290F0AB09DDF8A248AE144D84E042977FD70505E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 30d23f4cf2c87f1ccdcc8285bc018fd0d0fe4e0939cec5c885dd85ae209262a0
MD5 0999fcfa30f60aa37ba6deed6b971b93
SHA1 1852d8e2cd4df440c60229a633aff3fa2c74c7de
SHA512 d8c3a244fa1c5b323c082a99351483d73333f4cfde7d7898d0f8847a0ef210340fc32d42db07618254df5f013904e1cd1790279cec5b7dcb408678682e5b0da9
SSDEEP 6144:312WoDZA/NDQUf+8wVibpwNgoXIQjSm7Rkm1tYpBeh2BAoT:FWNA/NVwVawKWhjd9oBGcAoT
TLSH
T19134237B5C6DAD3F1DA6E71DB00B350F0DF09EDF8A248AD444D84E04697BA960905EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 71711d3e2bb86886218e68298d3a6cf95d5285dabb49765ded467c053bd781bc
MD5 c35a999f3620f1ae6a6bbacbbbf1d911
SHA1 14e3f3021eb12a354c1395c8fa0bdad7564412b6
SHA512 7158f93c581b41bb17202c9b9b66a74fdf4b353e5fbcf97aa0b440adf22f7c22162776cd30cf4407803b9f261f0a42e08053479afd91321ae920440a24a690e0
SSDEEP 6144:J1FWoDZA/NDQUf+8wVibpwNgoXIQjSm7Rkm1tYpBeh2BAoT:zZNA/NVwVawKWhjd9oBGcAoT
TLSH
T1DD34237B5C7DAD3F5DA6E71DB00B350B0EF09EDF8A248AD444D84E04797BA960905EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 61c96c5bf0a6a00213492dd591dd025033f4cf74a4c88b86d3176d32f58ef46e
MD5 0b266e7286e7d6640b256dceab8e7c6e
SHA1 47833f963b80a628b437a0411a6179193b4a4b55
SHA512 429148e283f1885a9340a20946800ff7dbd1defe255c61141820b282dcdc9a8432373eeecf5fd5cb8d64dcafed6c5f0aa9365e8b66140ad2544d86db4bc05272
SSDEEP 3072:FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Mm7Rkm1tYpBeh2BAoO
TLSH
T15EC3123B5D75E9375979A70EB48E0B1E1EF249A6C920DE42C8D86A0433FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 95ce3e4e075cda5a256344aa1bd1fd01d71e13ab9386ba74fe591f1667b0ab28
MD5 32f6f07977aa4c3c7d28e063eba9d0f4
SHA1 e170c47b8a923993aaf4571be9207f2cecede30b
SHA512 b7b6f0590dabcb550b900f1c5fb356b81becacdf80b751e3d1b5fbef7b167210cacd0301d79392e181b00627af9879b80a8234f171ca3b422bbf5ca61304c657
SSDEEP 6144:DLWoDZA/NDQUf+8wVibpwNgoXIQjSm7Rkm1tYpBeh2BAoT:DrNA/NVwVawKWhjd9oBGcAoT
TLSH
T18E34232B5DBDAD3F1DA6E32DB00B290F0AB09DDF8A248AE144D84E442977FD70505E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4jjqmdra.1yv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jjqmdra.1yv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-110-0x000001FDE8CC0000-0x000001FDE8CCE000-memory.dmp

Download

memory/1476-109-0x000001FDEABF0000-0x000001FDEAC3A000-memory.dmp

Download

memory/1476-108-0x000001FDCE6B0000-0x000001FDCE6E8000-memory.dmp

Download

memory/1476-111-0x000001FDE9590000-0x000001FDE95C8000-memory.dmp

Download

memory/1476-115-0x000001FDE9550000-0x000001FDE9558000-memory.dmp

Download

memory/1476-123-0x000001FDE97F0000-0x000001FDE97F8000-memory.dmp

Download

memory/1476-124-0x000001FDE9800000-0x000001FDE9808000-memory.dmp

Download

memory/1476-125-0x000001FDEA250000-0x000001FDEA258000-memory.dmp

Download

memory/1476-126-0x000001FDEACE0000-0x000001FDEAD06000-memory.dmp

Download

memory/4564-0-0x00000247F5F60000-0x00000247F5F70000-memory.dmp

Download

memory/4564-7-0x00000247F80E0000-0x00000247F8102000-memory.dmp

Download

memory/4564-10-0x00000247F5F60000-0x00000247F5F70000-memory.dmp

Download

memory/4564-1-0x00000247F5F60000-0x00000247F5F70000-memory.dmp

Download