Overview
overview
10Static
static
10uni/Uni - ...2).exe
windows7-x64
10uni/Uni - ...2).exe
windows10-2004-x64
10uni/Uni - ...3).exe
windows7-x64
10uni/Uni - ...3).exe
windows10-2004-x64
10uni/Uni - ...4).exe
windows7-x64
10uni/Uni - ...4).exe
windows10-2004-x64
10uni/Uni - ...5).exe
windows7-x64
10uni/Uni - ...5).exe
windows10-2004-x64
10uni/Uni - ...6).exe
windows7-x64
10uni/Uni - ...6).exe
windows10-2004-x64
10uni/Uni - Copy.exe
windows7-x64
10uni/Uni - Copy.exe
windows10-2004-x64
10Analysis
-
max time kernel
300s -
max time network
287s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 06:22
Behavioral task
behavioral1
Sample
uni/Uni - Copy (2).exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
uni/Uni - Copy (2).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
uni/Uni - Copy (3).exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
uni/Uni - Copy (3).exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
uni/Uni - Copy (4).exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
uni/Uni - Copy (4).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
uni/Uni - Copy (5).exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
uni/Uni - Copy (5).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
uni/Uni - Copy (6).exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
uni/Uni - Copy (6).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
uni/Uni - Copy.exe
Resource
win7-20231129-en
General
-
Target
uni/Uni - Copy (4).exe
-
Size
409KB
-
MD5
b70fdac25a99501e3cae11f1b775249e
-
SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
-
SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
-
SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
-
SSDEEP
12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
Malware Config
Extracted
quasar
3.1.5
SeroXen
panel-slave.gl.at.ply.gg:57059
panel-slave.gl.at.ply.gg:27892
$Sxr-rpL8EItHN3pqIQQVy2
-
encryption_key
Lme7VBS3l58VwLM69PNM
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SeroXen
-
subdirectory
SubDir
Signatures
-
Processes:
schtasks.exepid process 4640 schtasks.exe 11 ip-api.com 32 api.ipify.org -
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral6/memory/4004-1-0x00000000000C0000-0x000000000012C000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Client.exeQryyugsr8iE8.exepid process 752 Client.exe 3360 Qryyugsr8iE8.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ip-api.com 32 api.ipify.org -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeSCHTASKS.exeschtasks.exeSCHTASKS.exepid process 4640 schtasks.exe 4532 SCHTASKS.exe 4396 schtasks.exe 5608 SCHTASKS.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617831691869687" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3492 chrome.exe 3492 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Uni - Copy (4).exeClient.exeAUDIODG.EXEchrome.exedescription pid process Token: SeDebugPrivilege 4004 Uni - Copy (4).exe Token: SeDebugPrivilege 752 Client.exe Token: 33 1220 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1220 AUDIODG.EXE Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe Token: SeShutdownPrivilege 3492 chrome.exe Token: SeCreatePagefilePrivilege 3492 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
chrome.exepid process 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe 3492 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Client.exeQryyugsr8iE8.exepid process 752 Client.exe 3360 Qryyugsr8iE8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Uni - Copy (4).exeClient.exechrome.exedescription pid process target process PID 4004 wrote to memory of 4640 4004 Uni - Copy (4).exe schtasks.exe PID 4004 wrote to memory of 4640 4004 Uni - Copy (4).exe schtasks.exe PID 4004 wrote to memory of 4640 4004 Uni - Copy (4).exe schtasks.exe PID 4004 wrote to memory of 752 4004 Uni - Copy (4).exe Client.exe PID 4004 wrote to memory of 752 4004 Uni - Copy (4).exe Client.exe PID 4004 wrote to memory of 752 4004 Uni - Copy (4).exe Client.exe PID 4004 wrote to memory of 4532 4004 Uni - Copy (4).exe SCHTASKS.exe PID 4004 wrote to memory of 4532 4004 Uni - Copy (4).exe SCHTASKS.exe PID 4004 wrote to memory of 4532 4004 Uni - Copy (4).exe SCHTASKS.exe PID 752 wrote to memory of 4396 752 Client.exe schtasks.exe PID 752 wrote to memory of 4396 752 Client.exe schtasks.exe PID 752 wrote to memory of 4396 752 Client.exe schtasks.exe PID 752 wrote to memory of 3360 752 Client.exe Qryyugsr8iE8.exe PID 752 wrote to memory of 3360 752 Client.exe Qryyugsr8iE8.exe PID 752 wrote to memory of 3360 752 Client.exe Qryyugsr8iE8.exe PID 3492 wrote to memory of 1072 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1072 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1436 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 2580 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 2580 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe PID 3492 wrote to memory of 1844 3492 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe" /rl HIGHEST /f2⤵
- Quasar RAT
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Qryyugsr8iE8.exe"C:\Users\Admin\AppData\Local\Temp\Qryyugsr8iE8.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Client.exe" /tr "'C:\Users\Admin\AppData\Roaming\SubDir\Client.exe'" /sc onlogon /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Uni - Copy (4).exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:81⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x378 0x49c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb3f4dab58,0x7ffb3f4dab68,0x7ffb3f4dab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2308 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4356 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4456 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4324 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD520439c833975468d54a45774a734ced8
SHA1ee23111ec66b309493e191b06a42fcf0826716cb
SHA256fdf7b477977117a62c37ac98e9dc35693332fc226ec54714a81c9938d6f73539
SHA512402a8427270101eeaa110167c99b4ea0bfb9e42b7312bd91df9c41254c42a831522cd8a9f28738b044fe6ce7aefc70f4e0ffb61d386962e7cb92234730f8a89c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD52086ceeb1b7c5b7948014682f9799036
SHA1b15b07c9d0c2d08d26caeb702c25dbd6fc3f1380
SHA2565ffb360dee227024ed84cd67fb44dff7ec4e949a9069e12b6a4abd88e2e2a5f7
SHA5127082908be5fc86f52546102f3b921e21b74361681aa8dddf9ad4dd57cd51ff6f077f98c6bdbe52565a62c7957432aa878068408fdd2714b4464e720850e3552c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5bc0bea8f3e16d422b0550711cebbd2d2
SHA10b6ed428bd45c7eadd3b138818048a0ece361e1f
SHA256140fb01baa7fe20d4162e70f434fd2469369204404c606042684547b914be6f3
SHA5129c45e5d770989f92c5cba5562f8de8f33fa6bdc48fdc675b85c2bcf95281640dacb0bf570f7b60ad9ba08c1efc44aeb4522f41799e1f9e05c5d4452817501e03
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD58e310df8bbb5c7356841da3541441478
SHA14cc163fbab3a2f7cab91f54037e38bffbc1550cb
SHA2563a004dad029632915e7328dec77e980c74c7b459f32f31e94a4067dcd8967b73
SHA51289e06a1f72b9e52786eb3c17a3dd37815d035069c35113bfcdafdd6c14d8ef6aba4535d28dcb99e76e2790975f04d958a46e8cc23bb5c6c556f522ffe14ad161
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5e32703bbed75245ea8495355415aa9c3
SHA1959b4fa3c2881b28b6c0eb17c39127d2b7caa6cf
SHA256755241df0cdcdc1a9a21bccd193b1de170b56ac8898543b62c954f4503699f41
SHA5121bd1b296317dc092050e4d5588e963d0dc2566b2a44e6b68d09b7f0a3b5c3e957f7fd3e458dda59332bc5d63d4b30a0969db4b016d21a386c66debfb3f0024a3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5e7b0320be8d5beb6952773d484435b67
SHA1874f59d315a82afb22eee7e5e6f2f9958ca7088d
SHA25641a3b7f14abd141cacea3d0c4defbf98dd64e6219a96eff95ebe5d9df45d086a
SHA512bdd2ce1ce096da8a9bb0796b159eac82458ba031aa183b9e532b610bc1b21e5083b285df6674b8effabcb03bd985df22651a0a0b6a55b910d4b95cb530dfae97
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5bc7fe7edc5699bf85647992d27e6d6f5
SHA19e5168def91ecbe1caa4fa35deadd592f49f2cf5
SHA25621fced691bb2da2802222903eb5230c68046db7d598462db4089de7cf4fc7e57
SHA512e369dc57fe7eea1e04015b6e5e157033693dd723431979ea60b9aabc8571c4c22eed9ee864769ea7214d9e9ec02f0690a3e445dcf1b5f94225ee150757081430
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
261KB
MD5c6629b998bb3ca12dfd70f32fb3a4545
SHA17f34bd76ae823f8b20e79dc033f50915f9bfcb95
SHA256ecb561a387c0ed27c2dc27f846939d130a0cc2c08dfb00a4ea7432475277831f
SHA5128928cce144a376c31d7d2aca00b4dfdd7f8a1d311d2bbde9158180545e805e89af523108d4edf84729b06a4211bf3986a9f09e3ab3f9ed78bd20ef657b9306e9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
89KB
MD5bcce3e6949e65c22aef504d0f3e774aa
SHA1a824a10775f7bce9bd94e56c90bbc0dd49a66ce7
SHA256a57e605c1f7740fff52d41a97ad9a3c374f166ef96a52cd15dac87e5a1005a73
SHA512d5e6eb8e63c9f6cffcea2b04e234713f9952d9c146fa1f8bef98524513c7b4514709c151abf4f9f8ec33916ab57cf9edf36dbebed7214e736878f03a960b4a33
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5c8ad3.TMPFilesize
89KB
MD5ec5fac4311bb56d83e54e0b09437053e
SHA1d2ce969b84620ac1c15f25a3fa442d3a6e7cf349
SHA256f492db83afaca451efce41d7c48e42772f1864150b645040225a0b6daa79d407
SHA51232d9d015e9eedc04b448d4b268a715b55b169001a703654564f5258070e0cdaa4249201167acb53d7a5bffdfc224e54aae0ce9be6eeb608b04c29eb8fbb7f771
-
C:\Users\Admin\AppData\Local\Temp\Qryyugsr8iE8.exeFilesize
277KB
MD5dac0c5b2380cbdd93b46763427c9f8df
SHA1038089e1a0ac8375be797fc3ce7ae719abc72834
SHA256d02538788fb57f568ece292f5fc20e9775c86d504de67f57e22534f84adc73c6
SHA51205cc1f6bf25a6545a06c735ae7a4a7fc25489bdb9fbc8d5797be623982662c4a93cba2d20bfe14313ef1548eaaa691e55fabdd8e3d3e45de9ab42dc62f9a7023
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
409KB
MD5b70fdac25a99501e3cae11f1b775249e
SHA13c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA25651ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA51243f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
-
\??\pipe\crashpad_3492_RDKUBQRQOARKBDCZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/752-19-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/752-20-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/752-18-0x0000000006CA0000-0x0000000006CAA000-memory.dmpFilesize
40KB
-
memory/752-16-0x00000000067E0000-0x000000000681C000-memory.dmpFilesize
240KB
-
memory/752-140-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/752-13-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/752-12-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/4004-0-0x00000000748BE000-0x00000000748BF000-memory.dmpFilesize
4KB
-
memory/4004-15-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/4004-6-0x0000000005090000-0x00000000050A2000-memory.dmpFilesize
72KB
-
memory/4004-5-0x0000000004CA0000-0x0000000004D06000-memory.dmpFilesize
408KB
-
memory/4004-4-0x00000000748B0000-0x0000000075060000-memory.dmpFilesize
7.7MB
-
memory/4004-3-0x0000000004B90000-0x0000000004C22000-memory.dmpFilesize
584KB
-
memory/4004-2-0x0000000005140000-0x00000000056E4000-memory.dmpFilesize
5.6MB
-
memory/4004-1-0x00000000000C0000-0x000000000012C000-memory.dmpFilesize
432KB