Overview
overview
10Static
static
10Quasar v1....e.html
windows7-x64
3Quasar v1....e.html
windows10-2004-x64
8Quasar v1....to.dll
windows7-x64
1Quasar v1....to.dll
windows10-2004-x64
1Quasar v1....ok.dll
windows7-x64
1Quasar v1....ok.dll
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
8Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
8Quasar v1....ks.dll
windows7-x64
3Quasar v1....ks.dll
windows10-2004-x64
8Quasar v1....il.dll
windows7-x64
4Quasar v1....il.dll
windows10-2004-x64
8Quasar v1....at.dll
windows7-x64
1Quasar v1....at.dll
windows10-2004-x64
8Quasar v1....on.dll
windows7-x64
1Quasar v1....on.dll
windows10-2004-x64
8Quasar v1....ar.exe
windows7-x64
10Quasar v1....ar.exe
windows10-2004-x64
10Quasar v1....ib.dll
windows7-x64
1Quasar v1....ib.dll
windows10-2004-x64
3Quasar v1....nt.exe
windows7-x64
10Quasar v1....nt.exe
windows10-2004-x64
10Quasar v1....et.dll
windows7-x64
1Quasar v1....et.dll
windows10-2004-x64
8Analysis
-
max time kernel
119s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-02-2025 19:22
Behavioral task
behavioral1
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Quasar v1.4.1/Quasar.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Quasar v1.4.1/Quasar.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Quasar v1.4.1/client.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Quasar v1.4.1/client.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral26
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
General
-
Target
Quasar v1.4.1/Mono.Cecil.Rocks.dll
-
Size
27KB
-
MD5
6e7f0f4fff6c49e3f66127c23b7f1a53
-
SHA1
14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
-
SHA256
2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
-
SHA512
0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
-
SSDEEP
384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe Token: SeShutdownPrivilege 2240 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe 2240 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2456 2240 chrome.exe 32 PID 2240 wrote to memory of 2456 2240 chrome.exe 32 PID 2240 wrote to memory of 2456 2240 chrome.exe 32 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2620 2240 chrome.exe 34 PID 2240 wrote to memory of 2812 2240 chrome.exe 35 PID 2240 wrote to memory of 2812 2240 chrome.exe 35 PID 2240 wrote to memory of 2812 2240 chrome.exe 35 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36 PID 2240 wrote to memory of 2644 2240 chrome.exe 36
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Mono.Cecil.Rocks.dll",#11⤵PID:1652
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68b9758,0x7fef68b9768,0x7fef68b97782⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:22⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2852 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:22⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1304 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:12⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3608 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3728 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:12⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3732 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:12⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3576 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:12⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3028 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1168 --field-trial-handle=1372,i,5016659887225653282,12294094746848725553,131072 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
986B
MD5e1dec32c94142ca816c4b3e9d105a780
SHA1635aca07f2d2b118b22da8bd6f50427a3c9abf8c
SHA2565cb555a1fd8a2006d3c0bfbdde27daf6125b0b2bf5c5d56601089bd7601b23ab
SHA512e81bbad3e5cd33d0edcdbfa0f6a61e6a3f9583c445a7805ef111d9f8bc264908620e0ed60ad53ba9d6182ad99403bc4dd6292d40c905dc19c0c16539c16fc1c4
-
Filesize
526B
MD54fac81fc2167bbb7d367de2bdb228992
SHA1021adb8ef22192282a678619b2077fdf3c815bb5
SHA25609693f63c6885e4ee50b8c5d4e9dd6f3ce0b45a581dd832868728145a6c526da
SHA512964166d836ddab439e1774fc7c7275eff4bdc6a0359b94a898ddf04f4163f3f3c74ccf5858c0ec1ef19df3e337cb41f590fd837e0f92fcdb3365a421ae7c3ca3
-
Filesize
526B
MD5f4ccc1d6c47e89da32bd3e5fbeb87b7c
SHA1beacd9920fcd487296be296e1c6cd6252654852c
SHA2569bbc0a88ea54d65074f8c25de83f557a54ecf433e0e71cffe5c42369d6e03b1a
SHA5127e672d677dae078b2df5d392a960c27071ead819704a821062ed491a1aee0f31779db910e93792657fd3fa5d92949f980c913a40d98ba491f1694df6b576ca70
-
Filesize
6KB
MD51b1731a9f235c13956b97e472a7eb479
SHA1bbca68238231d59b5f380de178db1dd763c51897
SHA256afd4ad6e774de1b18431fcdf5c1385b72844440fa27240fec653c6b747204c06
SHA512290b720499dcb31b84adee87ad42883b069b599a5308c7f311344d85c5fa2e27b84f5a8baec76da67c5352e4f0e0d96f58a3e5f696e7a757f1cf084e7098d8c7
-
Filesize
6KB
MD5685587aa38bfacfab9340ad8a53c6a7e
SHA1bf105b27a93eef614a7fc8edcb1cf14007af6fcb
SHA25667705745652fb97bfbad6d54864c855e0b2da2e05f41ba43b754bb457ec1956e
SHA512b3bc53ab96e451bcde1bc50b12844b28ca2fdac5b1d75096bc4313637ff17c1d89dee748ccbf36795e6d1342b389b904481dacbb11843d813a79dcc4386b6cb2
-
Filesize
5KB
MD5fad88bfb200bfab316c941a4bb62c1be
SHA16cf9cd208f0219ce0cc295bc3e1157fbccc06f04
SHA256502e88177d8fee0620fe49c34982c73158cde700ee8b5fd9f84927a59f18926a
SHA512ad50ed1fb15afa7312afc09f7edfb296da2d3aa549f8065deb743d6fc6915222f861c6215bae200fa8bc415bb35d029f264aa2e9acd4db57a0fb02218e99dda6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2