hxxps://mygovlearn[.]com/

General

Target

https://mygovlearn.com/
Sample

210722-z4xxtmfth2

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

pid process

6032 software_reporter_tool.exe
6084 software_reporter_tool.exe
5256 software_reporter_tool.exe
2396 software_reporter_tool.exe

pid	process
6032	software_reporter_tool.exe
6084	software_reporter_tool.exe
5256	software_reporter_tool.exe
2396	software_reporter_tool.exe

Loads dropped DLL 7 IoCs

Processes:

software_reporter_tool.exe

pid	process
5256	software_reporter_tool.exe
5256	software_reporter_tool.exe
5256	software_reporter_tool.exe
5256	software_reporter_tool.exe
5256	software_reporter_tool.exe
5256	software_reporter_tool.exe
5256	software_reporter_tool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exesoftware_reporter_tool.exechrome.exe

pid	process
2364	chrome.exe
2364	chrome.exe
3416	chrome.exe
3416	chrome.exe
4656	chrome.exe
4656	chrome.exe
4688	chrome.exe
4688	chrome.exe
5724	chrome.exe
5724	chrome.exe
5784	chrome.exe
5784	chrome.exe
5852	chrome.exe
5852	chrome.exe
6048	chrome.exe
6048	chrome.exe
6032	software_reporter_tool.exe
6032	software_reporter_tool.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

description	pid	process
Token: 33	6084	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	6084	software_reporter_tool.exe
Token: 33	6032	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	6032	software_reporter_tool.exe
Token: 33	5256	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	5256	software_reporter_tool.exe
Token: 33	2396	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2396	software_reporter_tool.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

chrome.exe

pid	process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

chrome.exe

pid process

3416 chrome.exe
3416 chrome.exe
3416 chrome.exe
3416 chrome.exe
3416 chrome.exe
3416 chrome.exe
3416 chrome.exe
3416 chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3416 wrote to memory of 536	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 536	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2756	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2364	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2364	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe
PID 3416 wrote to memory of 2440	3416	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://mygovlearn.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffbc1f04f50,0x7ffbc1f04f60,0x7ffbc1f04f70
2⤵
PID:536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
2⤵
PID:2756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1680 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2036 /prefetch:8
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
2⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
2⤵
PID:3796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
2⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:3052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:1032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:8
2⤵
PID:4360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:8
2⤵
PID:4732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
PID:4756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:4776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5768 /prefetch:8
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5676 /prefetch:8
2⤵
PID:4908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5932 /prefetch:8
2⤵
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:8
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6548 /prefetch:8
2⤵
PID:4108

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
2⤵
PID:4452

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff65fc3a890,0x7ff65fc3a8a0,0x7ff65fc3a8b0
3⤵
PID:4500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5692 /prefetch:8
2⤵
PID:4680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5668 /prefetch:8
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:8
2⤵
PID:4808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:8
2⤵
PID:4840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6028 /prefetch:8
2⤵
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5968 /prefetch:8
2⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
2⤵
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5740 /prefetch:8
2⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:8
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5760 /prefetch:8
2⤵
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7040 /prefetch:8
2⤵
PID:576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7036 /prefetch:8
2⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7180 /prefetch:8
2⤵
PID:4964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7432 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7576 /prefetch:8
2⤵
PID:2116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7564 /prefetch:8
2⤵
PID:4304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7544 /prefetch:8
2⤵
PID:1656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7956 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6868 /prefetch:8
2⤵
PID:5080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6820 /prefetch:8
2⤵
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7980 /prefetch:8
2⤵
PID:4792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8236 /prefetch:8
2⤵
PID:4980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8484 /prefetch:8
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8608 /prefetch:8
2⤵
PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8740 /prefetch:8
2⤵
PID:5144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8752 /prefetch:8
2⤵
PID:5184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8764 /prefetch:8
2⤵
PID:5208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
2⤵
PID:5396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8488 /prefetch:1
2⤵
PID:5412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:5568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1416 /prefetch:8
2⤵
PID:5912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4524 /prefetch:8
2⤵
PID:5972

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=mhK8PWTqvnSERQfBsJ5ahMt+fV/VpQSaxGhIFmbP --registry-suffix=ESET --srt-field-trial-group-name=Off
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6032

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=91.266.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff79b7a3270,0x7ff79b7a3280,0x7ff79b7a3290
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6084

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_6032_KTMYBDPRLLTRTQIV" --sandboxed-process-id=2 --init-done-notifier=708 --sandbox-mojo-pipe-token=18180789802548633353 --mojo-platform-channel-handle=684 --engine=2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5256

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_6032_KTMYBDPRLLTRTQIV" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=6664850928369782765 --mojo-platform-channel-handle=912
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3248 /prefetch:8
2⤵
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:8
2⤵
PID:5036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:8
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4628 /prefetch:8
2⤵
PID:1656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1564 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,6599555261816106611,15704746789099675587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3968 /prefetch:8
2⤵
PID:5188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
MD5
bd085947bd21d10c39be6acd00e04711

SHA1
6933cfd3c9aa19f0868d909d30f902c8ffeb10e6

SHA256
e83c9c230271761151663b8b1b5d988f9b844f1f3c6f488398348a2ee2fcf4e5

SHA512
a0d96e45b09acde726942a68b687c4a1718f782386705716a08101d087230c6afd451e00e736c13939eec392aaf6fd170c41022634506f21dc94209be5eb41ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe
MD5
5eebc550f0bb371d9ac950a990455951

SHA1
9698da00eb030596f412958ad1e79f5b6afaa2e7

SHA256
272fc6120c5a4a13d9b09a83debe65165284622a854f628d9ed5dc1d97952206

SHA512
a60f3ec2869a54c114874f7baa4ba66f01f6c020ba7a58cfc1c71473df245a091171d5962b225747e0586a1356515713845080f076ec87d4c654caeb3fd6db49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe
MD5
5eebc550f0bb371d9ac950a990455951

SHA1
9698da00eb030596f412958ad1e79f5b6afaa2e7

SHA256
272fc6120c5a4a13d9b09a83debe65165284622a854f628d9ed5dc1d97952206

SHA512
a60f3ec2869a54c114874f7baa4ba66f01f6c020ba7a58cfc1c71473df245a091171d5962b225747e0586a1356515713845080f076ec87d4c654caeb3fd6db49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe
MD5
5eebc550f0bb371d9ac950a990455951

SHA1
9698da00eb030596f412958ad1e79f5b6afaa2e7

SHA256
272fc6120c5a4a13d9b09a83debe65165284622a854f628d9ed5dc1d97952206

SHA512
a60f3ec2869a54c114874f7baa4ba66f01f6c020ba7a58cfc1c71473df245a091171d5962b225747e0586a1356515713845080f076ec87d4c654caeb3fd6db49

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
62fa88378d2ce4796bba3784cd1b09f4

SHA1
8047620bcfdd42a8bc924afe48410f5be73aacee

SHA256
e7f3613d5501d49533943257b790da87a728bc348f9e878c69cf07c0ac2d75c0

SHA512
d9ccbe5effa5e5b2b04731158c9d18696021c8b62a6da7450476542248819ecdbc6b8f14320358fbdc43bf8fddeebf4ba6f52062c990cb1a36d2aed1419466d2

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
62fa88378d2ce4796bba3784cd1b09f4

SHA1
8047620bcfdd42a8bc924afe48410f5be73aacee

SHA256
e7f3613d5501d49533943257b790da87a728bc348f9e878c69cf07c0ac2d75c0

SHA512
d9ccbe5effa5e5b2b04731158c9d18696021c8b62a6da7450476542248819ecdbc6b8f14320358fbdc43bf8fddeebf4ba6f52062c990cb1a36d2aed1419466d2

Download Submit
\??\pipe\crashpad_3416_VHDHHWPLJFXVBHIB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4452_FBSPUBBCTCHHFLRG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/496-148-0x0000000000000000-mapping.dmp

Download
memory/536-116-0x0000000000000000-mapping.dmp

Download
memory/576-292-0x0000000000000000-mapping.dmp

Download
memory/1032-158-0x0000000000000000-mapping.dmp

Download
memory/1656-322-0x0000000000000000-mapping.dmp

Download
memory/2116-312-0x0000000000000000-mapping.dmp

Download
memory/2364-122-0x0000000000000000-mapping.dmp

Download
memory/2396-437-0x0000000000000000-mapping.dmp

Download
memory/2440-127-0x0000000000000000-mapping.dmp

Download
memory/2756-121-0x0000000000000000-mapping.dmp

Download
memory/2756-123-0x00007FFBCD9D0000-0x00007FFBCD9D1000-memory.dmp

Filesize
4KB

Download
memory/3028-133-0x0000000000000000-mapping.dmp

Download
memory/3052-153-0x0000000000000000-mapping.dmp

Download
memory/3112-357-0x0000000000000000-mapping.dmp

Download
memory/3120-143-0x0000000000000000-mapping.dmp

Download
memory/3796-138-0x0000000000000000-mapping.dmp

Download
memory/4108-227-0x0000000000000000-mapping.dmp

Download
memory/4192-352-0x0000000000000000-mapping.dmp

Download
memory/4304-317-0x0000000000000000-mapping.dmp

Download
memory/4320-327-0x0000000000000000-mapping.dmp

Download
memory/4360-177-0x0000000000000000-mapping.dmp

Download
memory/4452-231-0x0000000000000000-mapping.dmp

Download
memory/4500-234-0x0000000000000000-mapping.dmp

Download
memory/4656-183-0x0000000000000000-mapping.dmp

Download
memory/4680-242-0x0000000000000000-mapping.dmp

Download
memory/4684-245-0x0000000000000000-mapping.dmp

Download
memory/4688-238-0x0000000000000000-mapping.dmp

Download
memory/4700-287-0x0000000000000000-mapping.dmp

Download
memory/4732-187-0x0000000000000000-mapping.dmp

Download
memory/4756-191-0x0000000000000000-mapping.dmp

Download
memory/4776-195-0x0000000000000000-mapping.dmp

Download
memory/4792-340-0x0000000000000000-mapping.dmp

Download
memory/4808-249-0x0000000000000000-mapping.dmp

Download
memory/4840-254-0x0000000000000000-mapping.dmp

Download
memory/4856-307-0x0000000000000000-mapping.dmp

Download
memory/4876-280-0x0000000000000000-mapping.dmp

Download
memory/4876-202-0x0000000000000000-mapping.dmp

Download
memory/4908-205-0x0000000000000000-mapping.dmp

Download
memory/4936-210-0x0000000000000000-mapping.dmp

Download
memory/4940-265-0x0000000000000000-mapping.dmp

Download
memory/4948-260-0x0000000000000000-mapping.dmp

Download
memory/4964-302-0x0000000000000000-mapping.dmp

Download
memory/4972-275-0x0000000000000000-mapping.dmp

Download
memory/4980-345-0x0000000000000000-mapping.dmp

Download
memory/5000-337-0x0000000000000000-mapping.dmp

Download
memory/5048-217-0x0000000000000000-mapping.dmp

Download
memory/5068-297-0x0000000000000000-mapping.dmp

Download
memory/5080-332-0x0000000000000000-mapping.dmp

Download
memory/5104-222-0x0000000000000000-mapping.dmp

Download
memory/5116-270-0x0000000000000000-mapping.dmp

Download
memory/5144-362-0x0000000000000000-mapping.dmp

Download
memory/5184-365-0x0000000000000000-mapping.dmp

Download
memory/5208-370-0x0000000000000000-mapping.dmp

Download
memory/5256-433-0x00007FFBCDFD0000-0x00007FFBCDFD1000-memory.dmp

Filesize
4KB

Download
memory/5256-434-0x00007FFBCCF90000-0x00007FFBCCF91000-memory.dmp

Filesize
4KB

Download
memory/5256-429-0x0000000000000000-mapping.dmp

Download
memory/5396-377-0x0000000000000000-mapping.dmp

Download
memory/5412-380-0x0000000000000000-mapping.dmp

Download
memory/5568-391-0x0000000000000000-mapping.dmp

Download
memory/5724-397-0x0000000000000000-mapping.dmp

Download
memory/5784-400-0x0000000000000000-mapping.dmp

Download
memory/5852-403-0x0000000000000000-mapping.dmp

Download
memory/5912-407-0x0000000000000000-mapping.dmp

Download
memory/5972-412-0x0000000000000000-mapping.dmp

Download
memory/6032-416-0x0000000000000000-mapping.dmp

Download
memory/6048-418-0x0000000000000000-mapping.dmp

Download
memory/6084-423-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads