remcos | 1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028

Resubmissions

09-10-2021 11:54

211009-n3dp3afccm 10

07-10-2021 14:54

211007-r9wq1acef7 10

Analysis

max time kernel
1799s
max time network
1803s
platform
windows10_x64
resource
win10-en-20210920
submitted
09-10-2021 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ShippingDocs.exe
Size

55KB
MD5

a3e458f7e2e1f940b0c62042afe607d3
SHA1

6fb0a031365530ebb273f47f034181a530e31b70
SHA256

1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028
SHA512

9d27b5a6e1086b315bb71cccca1f64e718d1815adbccde1a3483e1404ec3d5d8a6eddc90de373e362543a8db69bf5118e36fef6c8b4cc82d40a4f771b44766e8

Score

10^/10

remcos remusd31k discovery persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

remUSD31k

yedaibi.com:8760

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
zoom-FKG2PK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ShippingDocs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\zoom.exe\","	ShippingDocs.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 4 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

pid process

4752 software_reporter_tool.exe
3312 software_reporter_tool.exe
4572 software_reporter_tool.exe
4808 software_reporter_tool.exe

pid	process
4752	software_reporter_tool.exe
3312	software_reporter_tool.exe
4572	software_reporter_tool.exe
4808	software_reporter_tool.exe

Patched UPX-packed file 3 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe	patched_upx

Loads dropped DLL 7 IoCs

Processes:

software_reporter_tool.exe

pid	process
4572	software_reporter_tool.exe
4572	software_reporter_tool.exe
4572	software_reporter_tool.exe
4572	software_reporter_tool.exe
4572	software_reporter_tool.exe
4572	software_reporter_tool.exe
4572	software_reporter_tool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

ShippingDocs.exeShippingDocs.exe

description	pid	process	target process
PID 2384 set thread context of 3772	2384	ShippingDocs.exe	ShippingDocs.exe
PID 3772 set thread context of 3996	3772	ShippingDocs.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

powershell.exechrome.exechrome.exechrome.exechrome.exepowershell.exechrome.exechrome.exepowershell.exechrome.exechrome.exeShippingDocs.exechrome.exechrome.exesoftware_reporter_tool.exe

pid	process
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
1124	chrome.exe
1124	chrome.exe
852	chrome.exe
852	chrome.exe
2180	chrome.exe
2180	chrome.exe
964	chrome.exe
964	chrome.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe
2592	chrome.exe
2592	chrome.exe
2748	chrome.exe
2748	chrome.exe
4988	powershell.exe
4208	chrome.exe
4208	chrome.exe
4988	powershell.exe
4988	powershell.exe
4948	chrome.exe
4948	chrome.exe
2384	ShippingDocs.exe
2384	ShippingDocs.exe
2384	ShippingDocs.exe
2384	ShippingDocs.exe
2384	ShippingDocs.exe
2384	ShippingDocs.exe
2384	ShippingDocs.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
2720	chrome.exe
2720	chrome.exe
4752	software_reporter_tool.exe
4752	software_reporter_tool.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

chrome.exe

pid	process
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeIncreaseQuotaPrivilege	2512	powershell.exe
Token: SeSecurityPrivilege	2512	powershell.exe
Token: SeTakeOwnershipPrivilege	2512	powershell.exe
Token: SeLoadDriverPrivilege	2512	powershell.exe
Token: SeSystemProfilePrivilege	2512	powershell.exe
Token: SeSystemtimePrivilege	2512	powershell.exe
Token: SeProfSingleProcessPrivilege	2512	powershell.exe
Token: SeIncBasePriorityPrivilege	2512	powershell.exe
Token: SeCreatePagefilePrivilege	2512	powershell.exe
Token: SeBackupPrivilege	2512	powershell.exe
Token: SeRestorePrivilege	2512	powershell.exe
Token: SeShutdownPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeSystemEnvironmentPrivilege	2512	powershell.exe
Token: SeRemoteShutdownPrivilege	2512	powershell.exe
Token: SeUndockPrivilege	2512	powershell.exe
Token: SeManageVolumePrivilege	2512	powershell.exe
Token: 33	2512	powershell.exe
Token: 34	2512	powershell.exe
Token: 35	2512	powershell.exe
Token: 36	2512	powershell.exe
Token: SeIncreaseQuotaPrivilege	2512	powershell.exe
Token: SeSecurityPrivilege	2512	powershell.exe
Token: SeTakeOwnershipPrivilege	2512	powershell.exe
Token: SeLoadDriverPrivilege	2512	powershell.exe
Token: SeSystemProfilePrivilege	2512	powershell.exe
Token: SeSystemtimePrivilege	2512	powershell.exe
Token: SeProfSingleProcessPrivilege	2512	powershell.exe
Token: SeIncBasePriorityPrivilege	2512	powershell.exe
Token: SeCreatePagefilePrivilege	2512	powershell.exe
Token: SeBackupPrivilege	2512	powershell.exe
Token: SeRestorePrivilege	2512	powershell.exe
Token: SeShutdownPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeSystemEnvironmentPrivilege	2512	powershell.exe
Token: SeRemoteShutdownPrivilege	2512	powershell.exe
Token: SeUndockPrivilege	2512	powershell.exe
Token: SeManageVolumePrivilege	2512	powershell.exe
Token: 33	2512	powershell.exe
Token: 34	2512	powershell.exe
Token: 35	2512	powershell.exe
Token: 36	2512	powershell.exe
Token: SeIncreaseQuotaPrivilege	2512	powershell.exe
Token: SeSecurityPrivilege	2512	powershell.exe
Token: SeTakeOwnershipPrivilege	2512	powershell.exe
Token: SeLoadDriverPrivilege	2512	powershell.exe
Token: SeSystemProfilePrivilege	2512	powershell.exe
Token: SeSystemtimePrivilege	2512	powershell.exe
Token: SeProfSingleProcessPrivilege	2512	powershell.exe
Token: SeIncBasePriorityPrivilege	2512	powershell.exe
Token: SeCreatePagefilePrivilege	2512	powershell.exe
Token: SeBackupPrivilege	2512	powershell.exe
Token: SeRestorePrivilege	2512	powershell.exe
Token: SeShutdownPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeSystemEnvironmentPrivilege	2512	powershell.exe
Token: SeRemoteShutdownPrivilege	2512	powershell.exe
Token: SeUndockPrivilege	2512	powershell.exe
Token: SeManageVolumePrivilege	2512	powershell.exe
Token: 33	2512	powershell.exe
Token: 34	2512	powershell.exe
Token: 35	2512	powershell.exe
Token: 36	2512	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ShippingDocs.exechrome.exe

description	pid	process	target process
PID 2384 wrote to memory of 2512	2384	ShippingDocs.exe	powershell.exe
PID 2384 wrote to memory of 2512	2384	ShippingDocs.exe	powershell.exe
PID 2384 wrote to memory of 2512	2384	ShippingDocs.exe	powershell.exe
PID 852 wrote to memory of 3736	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 3736	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1016	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1124	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 1124	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe
PID 852 wrote to memory of 2344	852	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
"C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988

C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
2⤵
PID:3144

C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
2⤵
- Suspicious use of SetThreadContext
PID:3772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7fff94344f50,0x7fff94344f60,0x7fff94344f70
2⤵
PID:3736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1948 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:2
2⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:8
2⤵
PID:2344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
2⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
2⤵
PID:1360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
2⤵
PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:8
2⤵
PID:3264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:8
2⤵
PID:504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
2⤵
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:8
2⤵
PID:2424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5148 /prefetch:8
2⤵
PID:3600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
2⤵
PID:3552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
PID:3208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:8
2⤵
PID:828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:8
2⤵
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:8
2⤵
PID:3932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 /prefetch:8
2⤵
PID:3816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
2⤵
PID:2424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
2⤵
PID:3532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:4140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
2⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
2⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 /prefetch:8
2⤵
PID:2256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
2⤵
PID:1200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
2⤵
PID:3096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:5100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1728 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2104 /prefetch:8
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2152 /prefetch:8
2⤵
PID:4860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3756 /prefetch:8
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4344 /prefetch:8
2⤵
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3260 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1348 /prefetch:8
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
PID:3776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
PID:816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1504 /prefetch:8
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3724 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3012 /prefetch:8
2⤵
PID:4820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6008 /prefetch:8
2⤵
PID:4832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4368 /prefetch:8
2⤵
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
2⤵
PID:2280

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=iof/ZaWs2Uciw1pgR9FPLgNvGubXgzaUdKpheink --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4752

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=93.269.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6e9139300,0x7ff6e9139310,0x7ff6e9139320
3⤵
- Executes dropped EXE
PID:3312

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_4752_BISPQQPKMDNMWAPU" --sandboxed-process-id=2 --init-done-notifier=708 --sandbox-mojo-pipe-token=8112093405894416889 --mojo-platform-channel-handle=684 --engine=2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4572

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_4752_BISPQQPKMDNMWAPU" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=10486173171912909658 --mojo-platform-channel-handle=912
3⤵
- Executes dropped EXE
PID:4808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4980 /prefetch:8
2⤵
PID:4884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:8
2⤵
PID:504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:8
2⤵
PID:68

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:8
2⤵
PID:620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
2⤵
PID:2592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:8
2⤵
PID:4728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,14047519222483376564,9529352778043063348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5912 /prefetch:8
2⤵
PID:4720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
56b213ab01d46f2064880ec2dd95e3ea

SHA1
f0b392a3c53a0784f017499ec0f4c6d4ace721e3

SHA256
473d0f9cf295446f00f632ff7b291fe4dbca6ddf0fba50255546b8ab62fbc5e6

SHA512
0a61a809398deaab7ee5e18dcba733386a583659dd0d6e851d5cfbcf212e66f7434277cde71c6fbd19c11cdf1e78beea5787d361a15ad87cc1ce84b078278ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1712dab0a1bf4e9e3ff666b9c431550d

SHA1
34d1dec8fa95f62c72cb3f92a22c13ad9eece10f

SHA256
7184a35390c8d6549ef4ddf2909c8fc3446572229bb1788fe178332d80ebfa97

SHA512
6ae29c37c11c851ed337afee3c3ad654593063e76df88a6974933e449ac8d86bfa005b9bf2e0ee29aad4647b8f8f32ac753587077fd745424be7f9765688e7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
1c33ff599b382b705675229c91fc2f99

SHA1
c20086746c14c5d57be9a3df47bd75fa77abe7e0

SHA256
d46b6790776328125154bb8231deafcc7786911bea48fbcd2742c05fa1c4da0a

SHA512
5b975f6b0d5407d8d43975c0fd0c26ecb155f6ee9b7416e39478f84e97deea590d1eb0cf2a972adcf96eba6745fdef472f6fcf51d85cd53c2da9b4c550ee413c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
fad4355f38eca7bf226fc32e9ed6b64b

SHA1
1109d7885622777add1aedbec5cb1b0fda5d79ea

SHA256
e8e7c9a8e685437b8229d610e0001ff0885baf1f0c5652782f30aa30fef6c97e

SHA512
8d074146c48b235348cfddf0d6d56e59e6a6d3390965c357160389593f98f3972963dfc80106c0474eacaf438f243c9b391e9be33a63df656c7294e30a0e1519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
79adea0d0682981ccbf83b92f6814896

SHA1
16bbb4c49a0f246c6748545ffd4e88b39efd4499

SHA256
bcc693ab7b29cbacacfb5ba1fc5447bfd3148e157d7a15763ef45cd01d9eea78

SHA512
37bdf10c1b10b1fbc5c78004ee02944bc044bc0685eb18b1ced96dc3630af1f7d4a58da730985cd6ef9c1f0c3d48d5c39c281d3d5813a06b5bafe78868b459d3

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
e6d32d99cbf15ee43075ec0066d8f99a

SHA1
5aeca31ee8efb42b671beff6768923064a6d1588

SHA256
1704680422499d827ca907e9d638910f4b3a5f798144b254f8867c6df243683c

SHA512
037d5b8a8ce59814fdee4709a658aecef9155ce6c92c88ebf2d7cc3d4e5750e81c96f5209d3c44c660f15f42251e741adfd50fe3bdc19a32049526fcf93172c2

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_852_APZSPBLCKEQUZOJY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\edls_64.dll
MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em000_64.dll
MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\em001_64.dll
MD5
d6385decf21bcfec1ab918dc2a4bcfd9

SHA1
aa0a7cc7a68f2653253b0ace7b416b33a289b22e

SHA256
c26081f692c7446a8ef7c9dec932274343faab70427c1861afef260413d79535

SHA512
bbb82176e0d7f8f151e7c7b0812c6897bfacf43f93fd04599380d4f30e2e18e7812628019d7dba5c4b26cbe5a28dc0798c339273e59eee9ee814a66e55d08246

Download Submit
memory/2384-115-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/2384-1629-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/2512-126-0x0000000007D40000-0x0000000007D41000-memory.dmp

Filesize
4KB

Download
memory/2512-128-0x0000000007B80000-0x0000000007B81000-memory.dmp

Filesize
4KB

Download
memory/2512-139-0x0000000009180000-0x00000000091B3000-memory.dmp

Filesize
204KB

Download
memory/2512-146-0x0000000008520000-0x0000000008521000-memory.dmp

Filesize
4KB

Download
memory/2512-151-0x0000000009530000-0x0000000009531000-memory.dmp

Filesize
4KB

Download
memory/2512-152-0x000000007EBA0000-0x000000007EBA1000-memory.dmp

Filesize
4KB

Download
memory/2512-153-0x00000000096F0000-0x00000000096F1000-memory.dmp

Filesize
4KB

Download
memory/2512-208-0x0000000004923000-0x0000000004924000-memory.dmp

Filesize
4KB

Download
memory/2512-563-0x0000000004926000-0x0000000004928000-memory.dmp

Filesize
8KB

Download
memory/2512-130-0x00000000083C0000-0x00000000083C1000-memory.dmp

Filesize
4KB

Download
memory/2512-129-0x0000000008470000-0x0000000008471000-memory.dmp

Filesize
4KB

Download
memory/2512-132-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/2512-127-0x0000000004922000-0x0000000004923000-memory.dmp

Filesize
4KB

Download
memory/2512-125-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/2512-124-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/2512-123-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/2512-122-0x0000000007230000-0x0000000007231000-memory.dmp

Filesize
4KB

Download
memory/2512-121-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/2512-120-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/2512-117-0x0000000000000000-mapping.dmp

Download
memory/2512-119-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/2512-118-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3312-1643-0x0000000000000000-mapping.dmp

Download
memory/3772-1638-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3772-1633-0x000000000042FC39-mapping.dmp

Download
memory/3996-1635-0x0000000000405D3E-mapping.dmp

Download
memory/4572-1649-0x0000000000000000-mapping.dmp

Download
memory/4572-1665-0x0000013880660000-0x0000013880661000-memory.dmp

Filesize
4KB

Download
memory/4572-1666-0x0000013880660000-0x00000138806A0000-memory.dmp

Filesize
256KB

Download
memory/4752-1639-0x0000000000000000-mapping.dmp

Download
memory/4792-1046-0x00000000070C6000-0x00000000070C7000-memory.dmp

Filesize
4KB

Download
memory/4792-677-0x0000000000000000-mapping.dmp

Download
memory/4792-691-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/4792-692-0x00000000070C2000-0x00000000070C3000-memory.dmp

Filesize
4KB

Download
memory/4792-796-0x00000000070C3000-0x00000000070C4000-memory.dmp

Filesize
4KB

Download
memory/4792-798-0x00000000070C4000-0x00000000070C6000-memory.dmp

Filesize
8KB

Download
memory/4808-1660-0x0000000000000000-mapping.dmp

Download
memory/4988-1274-0x0000000006693000-0x0000000006694000-memory.dmp

Filesize
4KB

Download
memory/4988-1154-0x0000000000000000-mapping.dmp

Download
memory/4988-1163-0x0000000006690000-0x0000000006691000-memory.dmp

Filesize
4KB

Download
memory/4988-1164-0x0000000006692000-0x0000000006693000-memory.dmp

Filesize
4KB

Download
memory/4988-1514-0x0000000006696000-0x0000000006697000-memory.dmp

Filesize
4KB

Download
memory/4988-1276-0x0000000006694000-0x0000000006696000-memory.dmp

Filesize
8KB

Download