Overview
overview
10Static
static
10uni/Uni - ...2).exe
windows7-x64
10uni/Uni - ...2).exe
windows10-2004-x64
10uni/Uni - ...3).exe
windows7-x64
10uni/Uni - ...3).exe
windows10-2004-x64
10uni/Uni - ...4).exe
windows7-x64
10uni/Uni - ...4).exe
windows10-2004-x64
10uni/Uni - ...5).exe
windows7-x64
10uni/Uni - ...5).exe
windows10-2004-x64
10uni/Uni - ...6).exe
windows7-x64
10uni/Uni - ...6).exe
windows10-2004-x64
10uni/Uni - Copy.exe
windows7-x64
10uni/Uni - Copy.exe
windows10-2004-x64
10Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 06:22
Behavioral task
behavioral1
Sample
uni/Uni - Copy (2).exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
uni/Uni - Copy (2).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
uni/Uni - Copy (3).exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
uni/Uni - Copy (3).exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
uni/Uni - Copy (4).exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
uni/Uni - Copy (4).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
uni/Uni - Copy (5).exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
uni/Uni - Copy (5).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
uni/Uni - Copy (6).exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
uni/Uni - Copy (6).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
uni/Uni - Copy.exe
Resource
win7-20231129-en
General
-
Target
uni/Uni - Copy (5).exe
-
Size
409KB
-
MD5
b70fdac25a99501e3cae11f1b775249e
-
SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
-
SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
-
SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
-
SSDEEP
12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
Malware Config
Extracted
quasar
3.1.5
SeroXen
panel-slave.gl.at.ply.gg:57059
panel-slave.gl.at.ply.gg:27892
$Sxr-rpL8EItHN3pqIQQVy2
-
encryption_key
Lme7VBS3l58VwLM69PNM
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SeroXen
-
subdirectory
SubDir
Signatures
-
Processes:
schtasks.exepid process 60 schtasks.exe 11 ip-api.com 30 api.ipify.org 38 ip-api.com -
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral8/memory/2072-1-0x0000000000960000-0x00000000009CC000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Client.exeXJKoOH7Ng70W.exepid process 936 Client.exe 3036 XJKoOH7Ng70W.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ip-api.com 30 api.ipify.org 38 ip-api.com -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeSCHTASKS.exeschtasks.exeSCHTASKS.exepid process 60 schtasks.exe 2692 SCHTASKS.exe 2792 schtasks.exe 5920 SCHTASKS.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
chrome.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617831931829620" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 3472 vlc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 1076 chrome.exe 1076 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 3472 vlc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Uni - Copy (5).exeClient.exeAUDIODG.EXEsvchost.exechrome.exedescription pid process Token: SeDebugPrivilege 2072 Uni - Copy (5).exe Token: SeDebugPrivilege 936 Client.exe Token: 33 2924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2924 AUDIODG.EXE Token: SeBackupPrivilege 3340 svchost.exe Token: SeRestorePrivilege 3340 svchost.exe Token: SeSecurityPrivilege 3340 svchost.exe Token: SeTakeOwnershipPrivilege 3340 svchost.exe Token: 35 3340 svchost.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
Processes:
vlc.exechrome.exepid process 3472 vlc.exe 3472 vlc.exe 3472 vlc.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe -
Suspicious use of SendNotifyMessage 54 IoCs
Processes:
vlc.exechrome.exepid process 3472 vlc.exe 3472 vlc.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
Client.exeXJKoOH7Ng70W.exevlc.exepid process 936 Client.exe 3036 XJKoOH7Ng70W.exe 3472 vlc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Uni - Copy (5).exeClient.exechrome.exechrome.exedescription pid process target process PID 2072 wrote to memory of 60 2072 Uni - Copy (5).exe schtasks.exe PID 2072 wrote to memory of 60 2072 Uni - Copy (5).exe schtasks.exe PID 2072 wrote to memory of 60 2072 Uni - Copy (5).exe schtasks.exe PID 2072 wrote to memory of 936 2072 Uni - Copy (5).exe Client.exe PID 2072 wrote to memory of 936 2072 Uni - Copy (5).exe Client.exe PID 2072 wrote to memory of 936 2072 Uni - Copy (5).exe Client.exe PID 2072 wrote to memory of 2692 2072 Uni - Copy (5).exe SCHTASKS.exe PID 2072 wrote to memory of 2692 2072 Uni - Copy (5).exe SCHTASKS.exe PID 2072 wrote to memory of 2692 2072 Uni - Copy (5).exe SCHTASKS.exe PID 936 wrote to memory of 2792 936 Client.exe schtasks.exe PID 936 wrote to memory of 2792 936 Client.exe schtasks.exe PID 936 wrote to memory of 2792 936 Client.exe schtasks.exe PID 936 wrote to memory of 3036 936 Client.exe XJKoOH7Ng70W.exe PID 936 wrote to memory of 3036 936 Client.exe XJKoOH7Ng70W.exe PID 936 wrote to memory of 3036 936 Client.exe XJKoOH7Ng70W.exe PID 1392 wrote to memory of 1188 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1188 1392 chrome.exe chrome.exe PID 1076 wrote to memory of 5056 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 5056 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 3748 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 2804 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 2804 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 4064 1076 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (5).exe"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (5).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (5).exe" /rl HIGHEST /f2⤵
- Quasar RAT
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\XJKoOH7Ng70W.exe"C:\Users\Admin\AppData\Local\Temp\XJKoOH7Ng70W.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Client.exe" /tr "'C:\Users\Admin\AppData\Roaming\SubDir\Client.exe'" /sc onlogon /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Uni - Copy (5).exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (5).exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4cc 0x4041⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\NewSave.aifc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff810ebab58,0x7ff810ebab68,0x7ff810ebab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=2012,i,5315048740570660780,16862333404287456683,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 --field-trial-handle=2012,i,5315048740570660780,16862333404287456683,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810ebab58,0x7ff810ebab68,0x7ff810ebab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2008 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3644 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4696 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4308 --field-trial-handle=1664,i,1327322760827374239,17337318274107148458,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD523e6ef5a90e33c22bae14f76f2684f3a
SHA177c72b67f257c2dde499789fd62a0dc0503f3f21
SHA25662d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790
SHA51223be0240146ba8d857fc8d37d77eb722066065877d1f698f0d3e185fcdae3daf9e1b2580a1db839c1356a45b599996d5acc83fda2af36840d3a8748684df5122
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD59b6ec61355f9a489f4175155181c7fab
SHA18276aa585854d8b628cd7a91e1f9edfa15367932
SHA25698b8c83a36ebb19623c74085ada9f1ac1514333d0ba98516cb647baf1ad937a0
SHA512a2188de8e6960550b73ae3a432d9ed728240bb691f0e2482818bcbdc7706625c6876e33aff37c118bf696655a1eb33a5307d1647824d3f3d943531b0436b527c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD519af6d84c4a875924cb8853712258a9b
SHA1da10f916b548b9e4a6467ca19a9e6e6047acab13
SHA2569f8ae344c390a336fdca35cd7120d32ec0d7c9d0698292487e4549a2af85b531
SHA512048d6590c1455fb91f95f1af899ac3e0e10c9c7fa30d57a79ac988d8c21ca63b9340eb7ebe539a6d2f31abf95f7b6272e750922c4f0035976f8239aa4a49ce8e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD549cbc57e14cf6a613fc082b659ec6fbd
SHA1440ced22c5984c6bebf8967f37b650769cc066cf
SHA256987ba1e72ab2a9217df0ffa7ccecfc5b919b3a1fc3fad0cfe47e2385e10e842e
SHA5129bd10fa1d25e450ef9259f9ceacbf50894c8d84bb5dbbaa68131c93ce826b7c7b3049437c6291be2c9b4bf838566f7a0af79bcdaf5335791ec17bcf572f47bc9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5055a44d31024e89c056c97882ded6df5
SHA1d8d6f660107e73c02683171b1ccfeb90761c68c1
SHA256a68945d13cddd746bead894e6eb4598e1301c33412052e86599f6bf6b2399baa
SHA512fcc1c6d2ff31db1968151eac253cc72b801901e3cab9041eeaf38c539dd30af20b048d7634ebdd7b0ddf7e6463f037798c1dd7ef1802ec3a01c4aa8ee86b894c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5ddeeeecf76f191cb0a209381d2a54890
SHA1ca70c31cad4ccfb056eca3d88ef3a47f7f73a00b
SHA25661dc122b94e8194093c31fac32a80a1a2cb4740376a2890bc90fcfa1b976c433
SHA512df3cc55f4440b0bc1096fa20b38498bb2686ad2f0257e6887cdf999e3141218e5e37b88e4b3f0474daa7b6f2b69e21926f903a7f58e72a3fd142e3b56ede4a4f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
255KB
MD565bfaf998559cb76d5a3a404f0dee598
SHA195a131bb2c17001961530bd5d28dfd954aa4073c
SHA25656dd4777d34fb410df4a701e44f2b6f3a0de8ee210fbf77eea6f0b9f0f56ec27
SHA51297e1c6079bfaed6ada76b8c30354c291a3540f782be50cc402143b539cd7407ebe2b4df43c33fe39be017ff8eb713c78d13ee705825cc8ad1835125b3e2dbc69
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
261KB
MD50d3fe2946879aa54108e6c354f01c63f
SHA141cd2d835980e27eeaba6e827ec6248ceb281a82
SHA25671fe80012da0741eee606a7be988d0198b821e8502981f7fb71fe09126ff0c34
SHA512ef542070f267708136f921e0ff2e3eaa042912022d15b8898e7a5d920b3ab0b9b696986a08f3fb5473eba445c83b45ff156210d1314e3d8edd978d905ef3c6d7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
255KB
MD589e99c2834c6db2e00062b2766085762
SHA1ee5a8a12f1d0612a6b72e0dd711a6d03a5006fe2
SHA2567f5f34607a5b0439d860c09056b82f660179767dc3bb764771ee16e45e95f5fc
SHA512c1565e2bd2843c941cf8b2492946ca8c0bfc0a2939dbf5a6ad5f90a3a5493b600e04a3b641c9df1b14fbeaa6b623404dfd3573fbc7dcba75a5ad34874bfdc824
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsFilesize
86B
MD5f732dbed9289177d15e236d0f8f2ddd3
SHA153f822af51b014bc3d4b575865d9c3ef0e4debde
SHA2562741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
-
C:\Users\Admin\AppData\Local\Temp\XJKoOH7Ng70W.exeFilesize
277KB
MD5dac0c5b2380cbdd93b46763427c9f8df
SHA1038089e1a0ac8375be797fc3ce7ae719abc72834
SHA256d02538788fb57f568ece292f5fc20e9775c86d504de67f57e22534f84adc73c6
SHA51205cc1f6bf25a6545a06c735ae7a4a7fc25489bdb9fbc8d5797be623982662c4a93cba2d20bfe14313ef1548eaaa691e55fabdd8e3d3e45de9ab42dc62f9a7023
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
409KB
MD5b70fdac25a99501e3cae11f1b775249e
SHA13c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA25651ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA51243f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
-
\??\pipe\crashpad_1076_BYIZJMCUEIPTMLQMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/936-19-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/936-20-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/936-18-0x0000000006AF0000-0x0000000006AFA000-memory.dmpFilesize
40KB
-
memory/936-16-0x0000000006620000-0x000000000665C000-memory.dmpFilesize
240KB
-
memory/936-260-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/936-13-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/936-12-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/2072-6-0x0000000005800000-0x0000000005812000-memory.dmpFilesize
72KB
-
memory/2072-5-0x00000000053F0000-0x0000000005456000-memory.dmpFilesize
408KB
-
memory/2072-4-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/2072-0-0x000000007518E000-0x000000007518F000-memory.dmpFilesize
4KB
-
memory/2072-3-0x0000000005350000-0x00000000053E2000-memory.dmpFilesize
584KB
-
memory/2072-2-0x0000000005820000-0x0000000005DC4000-memory.dmpFilesize
5.6MB
-
memory/2072-15-0x0000000075180000-0x0000000075930000-memory.dmpFilesize
7.7MB
-
memory/2072-1-0x0000000000960000-0x00000000009CC000-memory.dmpFilesize
432KB
-
memory/3472-35-0x00007FF815E60000-0x00007FF815E77000-memory.dmpFilesize
92KB
-
memory/3472-43-0x00007FF813A80000-0x00007FF813A98000-memory.dmpFilesize
96KB
-
memory/3472-34-0x00007FF815E80000-0x00007FF815E91000-memory.dmpFilesize
68KB
-
memory/3472-33-0x00007FF816640000-0x00007FF816657000-memory.dmpFilesize
92KB
-
memory/3472-31-0x00007FF8157F0000-0x00007FF815AA6000-memory.dmpFilesize
2.7MB
-
memory/3472-32-0x00007FF81C2D0000-0x00007FF81C2E8000-memory.dmpFilesize
96KB
-
memory/3472-48-0x0000029354600000-0x0000029355E6F000-memory.dmpFilesize
24.4MB
-
memory/3472-62-0x00007FF813AA0000-0x00007FF814B50000-memory.dmpFilesize
16.7MB
-
memory/3472-44-0x00007FF813A60000-0x00007FF813A71000-memory.dmpFilesize
68KB
-
memory/3472-42-0x00007FF813AA0000-0x00007FF814B50000-memory.dmpFilesize
16.7MB
-
memory/3472-45-0x00007FF813A40000-0x00007FF813A51000-memory.dmpFilesize
68KB
-
memory/3472-46-0x00007FF813A20000-0x00007FF813A31000-memory.dmpFilesize
68KB
-
memory/3472-47-0x00007FF812D10000-0x00007FF812D21000-memory.dmpFilesize
68KB
-
memory/3472-155-0x00007FF813AA0000-0x00007FF814B50000-memory.dmpFilesize
16.7MB
-
memory/3472-36-0x00007FF814E20000-0x00007FF814E31000-memory.dmpFilesize
68KB
-
memory/3472-38-0x00007FF814DE0000-0x00007FF814DF1000-memory.dmpFilesize
68KB
-
memory/3472-40-0x00007FF814B80000-0x00007FF814BC1000-memory.dmpFilesize
260KB
-
memory/3472-41-0x00007FF814B50000-0x00007FF814B71000-memory.dmpFilesize
132KB
-
memory/3472-39-0x00007FF814BD0000-0x00007FF814DDB000-memory.dmpFilesize
2.0MB
-
memory/3472-37-0x00007FF814E00000-0x00007FF814E1D000-memory.dmpFilesize
116KB
-
memory/3472-29-0x00007FF74FC50000-0x00007FF74FD48000-memory.dmpFilesize
992KB
-
memory/3472-30-0x00007FF816BD0000-0x00007FF816C04000-memory.dmpFilesize
208KB