30892007b6929ea5a77f2628d71aeee05fa0c070469bf4395aa520adefcff429

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
frpc.exe
Size 402KB
Sample260826-zybwfswfnd
SHA256 30892007b6929ea5a77f2628d71aeee05fa0c070469bf4395aa520adefcff429
MD5 e5511749fc2cd6f8d735fe1a426be263
SHA1 4a0952fb77ca5e13d94e1ee6172b41496ebb371f
SHA512 342d7f9dbbd5c0ad8ad1105645e96c8ffaae7f1c65e6919f0d844bd20b927bdbcf35c0e0a8effb455fbd2bf33ba3496e38b80bfb6203ecf6c04b9e83030aea9a
SSDEEP 6144:A8uEdSVOwpWJV6PAtBgXUmf2e7f15IJjLpQx8Pp9s8xK0CTHOvby/drWfdF7kfZA:vld3wyNNt+6B9BxwTHdkzkfS
TLSH
T165941B147F998608E5901A7E414E1900C7EE91F12532B303771AEF625E8ADDEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution packer persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\Search.exe"	frpc.exe

Executes dropped EXE 2 IoCs

pid	Process
3152	Search.exe
4148	Searcher.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	api.ipify.org
13	api.ipify.org
1	api.ipify.org
3	icanhazip.com
11	icanhazip.com

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/3152-96-0x000001F86E660000-0x000001F86E6D8000-memory.dmp	costura
behavioral2/memory/3152-100-0x000001F86E5F0000-0x000001F86E60C000-memory.dmp	costura

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Search.exe	frpc.exe
File opened for modification	C:\Program Files\Search.exe	frpc.exe
File opened for modification	C:\Program Files\Search.exe	Searcher.exe
File opened for modification	C:\Program Files\Search.exe	Search.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Searcher.exe	Search.exe
File created	C:\Windows\Searcher.exe	frpc.exe
File opened for modification	C:\Windows\Searcher.exe	frpc.exe
File opened for modification	C:\Windows\Searcher.exe	Searcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1576	cmd.exe
3752	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322521764168097"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
816	schtasks.exe
5992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	frpc.exe
Token: SeDebugPrivilege	3152	Search.exe
Token: SeDebugPrivilege	4148	Searcher.exe
Token: SeIncBasePriorityPrivilege	3152	Search.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4800	1144	frpc.exe	91
PID 1144 wrote to memory of 1576	1144	frpc.exe	92
PID 1576 wrote to memory of 816	1576	cmd.exe	95
PID 1144 wrote to memory of 3752	1144	frpc.exe	96
PID 3752 wrote to memory of 5992	3752	cmd.exe	98
PID 1144 wrote to memory of 3152	1144	frpc.exe	99
PID 3280 wrote to memory of 912	3280	chrome.exe	105
PID 3280 wrote to memory of 1868	3280	chrome.exe	106
PID 3280 wrote to memory of 1868	3280	chrome.exe	106
PID 3280 wrote to memory of 1368	3280	chrome.exe	107
PID 3280 wrote to memory of 4936	3280	chrome.exe	109
PID 3280 wrote to memory of 4936	3280	chrome.exe	109
PID 3280 wrote to memory of 1188	3280	chrome.exe	110
PID 3280 wrote to memory of 1188	3280	chrome.exe	110
PID 3280 wrote to memory of 1372	3280	chrome.exe	111
PID 3280 wrote to memory of 1372	3280	chrome.exe	111
PID 3280 wrote to memory of 3068	3280	chrome.exe	112
PID 3280 wrote to memory of 3068	3280	chrome.exe	112
PID 3280 wrote to memory of 2388	3280	chrome.exe	113
PID 3280 wrote to memory of 2388	3280	chrome.exe	113
PID 3280 wrote to memory of 2532	3280	chrome.exe	114
PID 3280 wrote to memory of 4376	3280	chrome.exe	115
PID 3280 wrote to memory of 5784	3280	chrome.exe	116
PID 3280 wrote to memory of 5784	3280	chrome.exe	116
PID 3280 wrote to memory of 4376	3280	chrome.exe	115
PID 3280 wrote to memory of 5440	3280	chrome.exe	120
PID 3280 wrote to memory of 792	3280	chrome.exe	121
PID 3280 wrote to memory of 5440	3280	chrome.exe	120
PID 3280 wrote to memory of 792	3280	chrome.exe	121
PID 3280 wrote to memory of 2248	3280	chrome.exe	122
PID 3280 wrote to memory of 5640	3280	chrome.exe	123
PID 3280 wrote to memory of 2248	3280	chrome.exe	122
PID 3280 wrote to memory of 5640	3280	chrome.exe	123
PID 3280 wrote to memory of 2804	3280	chrome.exe	125
PID 3280 wrote to memory of 1120	3280	chrome.exe	124
PID 3280 wrote to memory of 2804	3280	chrome.exe	125
PID 3280 wrote to memory of 1120	3280	chrome.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\frpc.exe
"C:\Users\Admin\AppData\Local\Temp\frpc.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="THm~tn8ktmvztW" dir=in action=allow program="C:\Program Files\Search.exe" enable=yes & exit
  2⤵
  PID:4800
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Search.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Search.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:816
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\Searcher.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\Searcher.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Program Files\Search.exe
  "C:\Program Files\Search.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3152

C:\Windows\Searcher.exe
C:\Windows\Searcher.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff866d4c728,0x7ff866d4c734,0x7ff866d4c740
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,2969130466407726329,4177403407950618986,262144 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,15302574919264132651,1933636268851895190,524288 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,534176404424285632,9641615650719508747,524288 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,3451655684850416626,10315994990270048857,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,13773529142091335002,4961306606257701815,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4588,i,15300898888533583207,7861808406997090568,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,9894396050652093841,2615218407016589366,524288 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,2263549984492539101,7614057866080994614,524288 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5476,i,4300608251667075387,8632498171708117731,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,12842678636593070628,7381383925027546203,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5660,i,7859085243025329418,9154508463152376996,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5408,i,14113171043317330445,5812612031995770751,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6088,i,2600495632602396717,8438346387410463001,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5456,i,8777642525894372028,10760927396179147989,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5620,i,7969059625054311645,8224098049870639976,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6104,i,124830170883500094,375539684617313736,2097152 --field-trial-handle=1824,i,3554726453739047156,14511520738047966739,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Search.exe

Path C:\Program Files\Search.exe
Size 402KB
SHA256 30892007b6929ea5a77f2628d71aeee05fa0c070469bf4395aa520adefcff429
MD5 e5511749fc2cd6f8d735fe1a426be263
SHA1 4a0952fb77ca5e13d94e1ee6172b41496ebb371f
SHA512 342d7f9dbbd5c0ad8ad1105645e96c8ffaae7f1c65e6919f0d844bd20b927bdbcf35c0e0a8effb455fbd2bf33ba3496e38b80bfb6203ecf6c04b9e83030aea9a
SSDEEP 6144:A8uEdSVOwpWJV6PAtBgXUmf2e7f15IJjLpQx8Pp9s8xK0CTHOvby/drWfdF7kfZA:vld3wyNNt+6B9BxwTHdkzkfS
TLSH
T165941B147F998608E5901A7E414E1900C7EE91F12532B303771AEF625E8ADDEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1e47b4c-dbb8-45de-b8a9-3a160f11e23d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e1e47b4c-dbb8-45de-b8a9-3a160f11e23d.tmp
Size 11KB
SHA256 6119b20c24f3575f4d20bfbaafd2df8f3abea562f11d05cca20692f3236141e5
MD5 9f08faf5fe0beff5b5ddea13a860c271
SHA1 29d7b2bb589ca230ecf4d5d20ad3a132a2860e25
SHA512 568ca7847c2bd2963340595efb517c0cfbf24eff837592eb164f2805e28fc8341225623f3599a61883cb51975c93504b65c539f3aa9fa2e9dc249ccdeb2e43b2
SSDEEP 192:YR7db4myv7sAPRp2X964Hsb+WNn5f0u1ji2y7mQQoQ++VyIsnAUge:YR7VNeBXUbw90uNi2y7mQu+2e
TLSH
T14132C63EBA55797B6CCBC219FD217B53D7F5102220A12E84E6FC892C25E7ACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e722d207c121049fc072450bde661dc17fed6a733d137c19153d99bf4c042961
MD5 bfc3805b6b3269afc6d794ec25b101ca
SHA1 f6a014d91067cb2d03c17de1036b1a9cdf5637dd
SHA512 1b8efc35d7b4baf7e5b87539a958b58487fe44b10e0c055a8200483e0d3753579761e605b6ade82db581a2ba32052993d296a068c6381c0acc9ba9d5243fabec
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5nDCDnEB6/dGyv95SIckhbb2Jv4a:gC0LA/TE57cDUDooUweSGhbKl
TLSH
T142A10971B8A95EB75D75C584F8827E83CF78A117A9226F84D8DC1F0C11E71EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 1877ddb593f91b95213c16ab119d51c6cdd5478b7515532a22df2e53e54fb448
MD5 5f8b8ae78774fedf1b4808743aafc95d
SHA1 a4e1b0c598f76b533f95302d41973890e4092ff6
SHA512 7fb7a41bede1f6b6a5d07976237b5d69e03ea286c133ceb934eb8800706db1cba63211880771156f6e30fad3bec233ea716c915482dc758f38b2e0344106c9b6
SSDEEP 3072:VeZunh2CsNK4/rAyi77LCLOZ8BfiGqjMxtTk6qUZL7gL:Vekhh4/Y77oVfBDtTPjZwL
TLSH
T1B5D302A195FC2CBA8A4A835E5C03395B979D408291FF6C2897C95FCC05A2EE543C3F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-5-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-86-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-93-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-0-0x000002218FD30000-0x000002218FD98000-memory.dmp

Download

memory/1144-8-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-7-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-6-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-4-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-3-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-2-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/1144-1-0x00007FF86229F000-0x00007FF8622A0000-memory.dmp

Download

memory/3152-96-0x000001F86E660000-0x000001F86E6D8000-memory.dmp

Download

memory/3152-102-0x000001F86E640000-0x000001F86E64C000-memory.dmp

Download

memory/3152-101-0x000001F86E630000-0x000001F86E646000-memory.dmp

Download

memory/3152-100-0x000001F86E5F0000-0x000001F86E60C000-memory.dmp

Download

memory/3152-99-0x000001F870CF0000-0x000001F870D3A000-memory.dmp

Download

memory/3152-98-0x000001F86F4E0000-0x000001F86F50A000-memory.dmp

Download

memory/3152-97-0x000001F86F490000-0x000001F86F4DC000-memory.dmp

Download