quasar | 43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quasar.exe
Size 1.2MB
Sample240415-v7vmpscb94
SHA256 43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
MD5 12ebf922aa80d13f8887e4c8c5e7be83
SHA1 7f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA512 fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
SSDEEP 12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4196-0-0x000001F3CC850000-0x000001F3CC988000-memory.dmp	family_quasar

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133576763969498797"	chrome.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
4576	msedge.exe
4576	msedge.exe
4876	chrome.exe
4876	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3880	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	Quasar.exe
Token: SeDebugPrivilege	3880	taskmgr.exe
Token: SeSystemProfilePrivilege	3880	taskmgr.exe
Token: SeCreateGlobalPrivilege	3880	taskmgr.exe
Token: 33	3880	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3880	taskmgr.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
3880	taskmgr.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 3668	972	msedge.exe	108
PID 972 wrote to memory of 3668	972	msedge.exe	108
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 2248	972	msedge.exe	109
PID 972 wrote to memory of 4576	972	msedge.exe	110
PID 972 wrote to memory of 4576	972	msedge.exe	110
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111
PID 972 wrote to memory of 632	972	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\Quasar.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2c102987h1163h42b8hbc92he53c7b74ffd2
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff89dd146f8,0x7ff89dd14708,0x7ff89dd14718
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7527433134083273201,7561899366194741140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7527433134083273201,7561899366194741140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7527433134083273201,7561899366194741140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff89ed3ab58,0x7ff89ed3ab68,0x7ff89ed3ab78
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:2
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4672 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4796 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4192 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1944,i,8231670591515344812,15829485942628079871,131072 /prefetch:8
  2⤵
  PID:3588

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d7a0b998e665b37d8d15f2708d30af362aaaead3caf13d85383644c7dec01b3e
MD5 691397d8efd4a0035efc6b6a1c11518a
SHA1 1b1ea1cd165e9eb13ca4e6eb7f16724934fe5d94
SHA512 5c1a168a934c56207a9f735dcfa58c94e9157122379e04700d255e1a393edb071e2a872301878360d6d0fc9d98f4200766263b1830db341ea7c6eaf131411aa4
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 ef2a28fa934ee465e1f8ff687afc47cc770f6bfb7d82744e88b9f31c7f2821a0
MD5 5816114ad81dfeb8054679024eeb07c5
SHA1 2a19062eee37f7511a69f9cf70e927d165680a3e
SHA512 e07b7bf72a75a41070badd54c3891a550ce5ea0b0245fdc7610a5cb8d541cd406ef35233aa4f5c7cdfbe9cb9ba10df8d4eb9cd07ef012c7dafe698297651c85e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 7e0a961f324ad99be9f7cf96ca2c6fa8bff60e30143a83766c5492fe8946498f
MD5 0fcf72d691cef4260622023cfd5909be
SHA1 e44c71ae5cc81138a2cd963ef673925aa1f111df
SHA512 44eaa57b4b15018ae0425382d131685a18e17b98927525dd71dc137428962cdcb6e7f4ce93746d3978e7791221ce160daa9ac29a92ce17b5264ff29f0e3708a9
SSDEEP 96:m6V5zisXwiKIkJ0y58iZRy7Dx+6MSmueMIOgZMdv118IMEVhYtjEsXt0/cgVup:mSdisAiaJB8syh+FcQyGd5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 f2972ff6be75887361e4ddcc79d920e37b959728205d89a43a75da122718b82f
MD5 156aac65a5f1b833992ddcf88e47a57d
SHA1 0661ffc752e3be3f5a6ea92f5a7293dc27681052
SHA512 2df440741706661450523f483feef771f3c4f8fa1ba5229d9ad9563fff4e64ffb73af69f21924442359d7b1c477d9797fdd676fcac32f0381b4e2be0f610766e
SSDEEP 384:meoMLPLeDXXvR1kXqKf/pUZNCgVLH2Hf9OfrUE8gWHGhvt/:mHMLPLynvR1kXqKf/pUZNCgVLH2HfEfl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 250KB
SHA256 9a0e2a162a2b9f4788b19454922facda686b16f26af4a4dd648002eb797d7a55
MD5 ec3fbea526c8d03fbe4b288582b643fc
SHA1 8193bfe7f96d64c4acfc7eb89086d9432c7ff26d
SHA512 4146696b199ee3887a6d68d95b61aaf088da08f184f57df9d3081238637ef92c3d3672df64a559bac585bc9b7bec5a13e214f8a0b719c5131d75dac2a3a8a1a2
SSDEEP 6144:LqRtvvGWIffewbl2tSPcDFhnD0Yuu8oeMdMqCFn5jq1987IGvRboD:LSbIHuso7maU/BoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01
MD5 104aab1e178489256a1425b28119ec93
SHA1 0bcf8ad28df672c618cb832ba8de8f85bd858a6c
SHA512 b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5e4f1c8eeb24a0e1959b201b60a220dd94b260e9a6d80606a743964b9144277d
MD5 5e2f4637f645229b274511ece4af7e4a
SHA1 c0cfdd80b7f709e90092e10688a6b376546fe258
SHA512 431b0d275cf83c35b8b341b933ad83a6cffc86c38b66d1bb71300d6e1b9d72877a2e940b0e1f0f695760c9c15731de32e19a25f40e8d303ad0a3c7b9def74687
SSDEEP 96:n6XNE1J/wpvWMoiVmdeHcczWUWQyV+VDCAiEwb:n6X2n/GWMXHWrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43d7f87b044a8d3b8ce130a7e6bf5fd2041c3f606aa8e307b2c7afb77ca2d9cf
MD5 6090be5f1ae824cbaf1390a34ae5aea1
SHA1 a5c2438ab8af69b4f38b88d559c40297a5f8e4f8
SHA512 1bde68637a36e94e79317bdd90b89d721c2cf3a9337a6c35302a107a4b3cc43c060bc248e08c444f7b4424766d975062f493b8a5e280f8731fd7773b175957c4
SSDEEP 192:BoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLNe2RUwoyP:99iIxuERzA83h09RZxYlbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3880-6-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-10-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-16-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-14-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-13-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-12-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-11-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-15-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-4-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/3880-5-0x00000166C87D0000-0x00000166C87D1000-memory.dmp

Download

memory/4196-0-0x000001F3CC850000-0x000001F3CC988000-memory.dmp

Download

memory/4196-3-0x00007FF89EBE0000-0x00007FF89F6A1000-memory.dmp

Download

memory/4196-2-0x000001F3E6FD0000-0x000001F3E6FE0000-memory.dmp

Download

memory/4196-1-0x00007FF89EBE0000-0x00007FF89F6A1000-memory.dmp

Download