quasar | 4518753aea43be0fa3d6755f531d569a209b715616c076880b7cdd026eebf3d1

Analysis

user interaction
yes
max time kernel
900s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-2.exe
Size 2.6MB
Sample260809-w812jstdqg
SHA256 4518753aea43be0fa3d6755f531d569a209b715616c076880b7cdd026eebf3d1
MD5 cc0f500f61bf89b2f8caf01a9243d9fa
SHA1 9b68c9f9977605b1bdb994ba2f6a6001d806b1a6
SHA512 f3cca742b5fd8e8c59df4d868cd4e8364fd68b1acfc8ba27575da693f235bc3506664d7eba38168df0877458a35da26c35029f995595e0847f2cc098a1ae6602
SSDEEP 49152:8Pu6NLPxi8/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uan/w:Mu6tpi8VIxpL7oZNn2Km77LrwkFW/
TLSH
T1D5C5F1107BFA8119F3BF1BB8ABB6544D1B77B903AA39D39F184840990FA33509E51763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 defense_evasion discovery execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.6.6

Botnet

Office04

c6qitux5e.localto.net:2164

Mutex

b37c4cbf-68f4-4e7c-92ba-ac265729eb51

Attributes

encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2544-0-0x0000023C04740000-0x0000023C049DE000-memory.dmp	family_quasar

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4716	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2916	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4932	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307742560247709"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2544	Client-2.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4308	chrome.exe
4308	chrome.exe
3628	chrome.exe
3628	chrome.exe
3628	chrome.exe
3628	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	Client-2.exe
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4004	2544	Client-2.exe	92
PID 2544 wrote to memory of 2700	2544	Client-2.exe	93
PID 4004 wrote to memory of 4716	4004	Conhost.exe	94
PID 4716 wrote to memory of 4932	4716	cmd.exe	96
PID 2096 wrote to memory of 4636	2096	explorer.exe	97
PID 4636 wrote to memory of 3628	4636	chrome.exe	99
PID 4636 wrote to memory of 2916	4636	chrome.exe	101
PID 4636 wrote to memory of 2108	4636	chrome.exe	102
PID 4636 wrote to memory of 2108	4636	chrome.exe	102
PID 4636 wrote to memory of 4976	4636	chrome.exe	103
PID 4636 wrote to memory of 4976	4636	chrome.exe	103
PID 4636 wrote to memory of 3348	4636	chrome.exe	104
PID 4636 wrote to memory of 2524	4636	chrome.exe	105
PID 4636 wrote to memory of 3348	4636	chrome.exe	104
PID 4636 wrote to memory of 2524	4636	chrome.exe	105
PID 4636 wrote to memory of 3120	4636	chrome.exe	106
PID 4636 wrote to memory of 3120	4636	chrome.exe	106
PID 4636 wrote to memory of 3948	4636	chrome.exe	107
PID 4636 wrote to memory of 3948	4636	chrome.exe	107
PID 4636 wrote to memory of 1656	4636	chrome.exe	108
PID 4636 wrote to memory of 1564	4636	chrome.exe	111
PID 4636 wrote to memory of 2172	4636	chrome.exe	112
PID 4636 wrote to memory of 1820	4636	chrome.exe	113
PID 4636 wrote to memory of 1616	4636	chrome.exe	114
PID 4636 wrote to memory of 4308	4636	chrome.exe	116
PID 4636 wrote to memory of 3996	4636	chrome.exe	117
PID 4636 wrote to memory of 3996	4636	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Client-2.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SYSTEM32\Conhost.exe
  Conhost --headless cmd.exe /c taskkill /IM chrome.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c taskkill /IM chrome.exe /F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4932
- C:\Windows\explorer.exe
  explorer C:\Program Files\Google\Chrome\Application\chrome.exe
  2⤵
  PID:2700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc847ac728,0x7ffc847ac734,0x7ffc847ac740
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,13175257463237722107,5623918366249812524,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,8934502669431101148,14729246750672932961,262144 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:2108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,9374302359752565294,18385806070696553894,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,17417589358718375730,15735145402288235146,2097152 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,3893743934602907514,17551704215936094142,2097152 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4256,i,11305252934278349389,15263103539943230339,2097152 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4268 /prefetch:2
    3⤵
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,11312857114089808819,18409355585477022354,2097152 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,1400079411619624486,63299427593248579,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,5664269136251977551,18147751306305674020,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,15855454118799075064,12591098339955566457,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,11469578499869415708,14604794814696887129,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:1820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4280,i,15319677475273901628,1251878680504621819,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4260 /prefetch:8
    3⤵
    - Modifies registry class
    PID:1616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5672,i,927301326153282304,3630829346130988758,262144 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4304,i,13717306480108477705,6337481073141815213,524288 --field-trial-handle=2156,i,3475264774207586891,3446178507062459106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:3996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
Size 114B
SHA256 29fde6ae5a0545f27bd5830055bc21b92f41bb3c58d81be26f866e040386a7a6
MD5 453e47c77bb00ab72ed2a6d064b3add0
SHA1 efcba2f3929c5fe5c04c5bc463039a88f0454cb3
SHA512 1b94935524aaea87afbc3df15758d515cfcc6d0e5dbd1b531859ba816b7c5768bbfe78b29c7b95eb05652604821ee5db3c8d76c295834a3f6248496b6ce65f84
TLSH
T11DB012903421F100F20766F00F4036244724A30A130740040C0845604D48A381054511
MD5 SHA1 SHA512 TLSH

Submit Download

5ea6a8dd-7bad-499c-85ae-e23064a7dd05.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\5ea6a8dd-7bad-499c-85ae-e23064a7dd05.dmp
Size 109KB
SHA256 1f06111b679230d608fed4d4b900a15a0aa2617b0ae907c0331d94184449d1dd
MD5 2fdd319b055e485d20632713dc0c81bb
SHA1 a6859d5b9f1a174c30b9fd0054dfa78ece9ba7e1
SHA512 def56d7336eec826ea55b41fce482c4e55d669daf810861a89ad7930e389db7479dfb394d9a2e034ac4673c82192252d05c5b4120ac993442ac489ffdcad7b20
SSDEEP 768:riJMS4Njm3B7Ju7XnU7BIGBchSLpWJIt4QO2L4p9Suzq:M4qJu7XUCGBgJI+l2Ll
TLSH
T1EEB3DC2293D59466F229CBB168936321FBF3E8D947526B1B0603527E7CA33645F39F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0d2c0b2a021d1410e8388539f08e907d013aeb7a9b32097edbe512ad1abfb860
MD5 cb086cf87e086876af97b6adfea10060
SHA1 c5eb65940dd2d453615f7a91aec0b8d2e47cd1e8
SHA512 a20ab862f7e24d246116e02944a5c6ce7798d69f932e99735c80b7a692bae538edfd3cda945bc35ad2f89b8bf84600e77e66bf4269d5893f8053ff07f02d55f8
TLSH
T1A4E02BB9DA20AD2F09FD071934590746E754235B2B80457F3B3D920D8FB96360986C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 515469f5c3ee761edce87facd6b3c7f59ba2b368347a1c48601514c4f2985283
MD5 4bf542b0b09f075b74e829f6fd4a1b3a
SHA1 8f098e95fbc05e87904ab692a26245b794c8c70f
SHA512 dc95e7c2a4ebb8313e6a6e07bdd437b815a8421489728c02db1360646a3b5be64bb25543d902cb92e4ddb676421cf234486e0d2553789f5d319fb6150797088d
TLSH
T174418BF793E48A7D851096F4DB21AE1FCE790A24131C3CA289D4AE1B43F2972D25178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 efb15c307ecd8027ec199976245c100f8e7b739b0975703e426892c89d42fb3f
MD5 f7e5fe3a437929a1ec70e88bb30ca3eb
SHA1 273b81884e90fb6776d42998ac513be07cc49133
SHA512 a52203c35cad3d7fbe41ec171b83b0617f589406f4ed0fa598190d90b64ccb1edda6ede862d178c38250dc3bdbb05791dbd3cdac0b25689081f692246904f2e9
TLSH
T150519AF3C7E48A7D891152F49A246E1FCD2A0A24431C3CA2C9D4BE5B53E29B2D20138F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4150afd2f7f6ed53f0c7e583c61490f164782ac62fc6f7bea4e957f3a0cc8da6
MD5 0a7fcada12ecd168cbb23b40220ee8e4
SHA1 c9e022d66c86e88c57f6e75fcc17b5fcd7e548e2
SHA512 27d031ffcaa36dc9705f60baec26c28f971fefc584398386483eb6218a397e6bfb031f4a35918b9ec2d05724126dd2b515b166c646e54109231007c016a02452
TLSH
T17951AFF7D7E4857D851096F4EB116E1FCD790924032C7C6289D4AE1B43F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 1251b702082a4b56741373e0d4fa90aa5fcfc1eb3abae4f4317f7b338dfc3502
MD5 d33d2cd8a1e106b481815eb5d66395fc
SHA1 02f992593b9c60910488c4af7fe800687092dd8b
SHA512 b7c47615b4c763132a2bc0ce86b7533e1391211bd5719288a4a99cd7f2b8c3902fcfb0ef2b6461bdedcb379611d8dc26220908cee2f715a873d9824aa198d39a
TLSH
T12BF059E79B7D7427107D15AA2E047C09657AAC3546C0ACE4DF7A422D90C15FB1F02423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b7160c7776d5f0313942033c285931bc77b2c83857ef370b01e1e99878edf9d0
MD5 4edd8b94e330da541f583651e2959cf6
SHA1 08987a2cfe4693887ce6c4fc5f6fba26d4f89d9b
SHA512 279cd3179a919445feda83c556ad7bfc5363d388b83468a6b976977d1bca8f10fced3df06ef0959d917f75f26ec618e6890664c322ec7223b4107e53e809b293
SSDEEP 192:0Rg8tEQEERNdav72ympAPRp2/95Hsb+WNnpmtEX6QexTU2hzIE4NLVyIsnAUgraJ:0Rg8ck2QUXo7w0tP7U2hzIE4He
TLSH
T12942D82EA910657BADDBD219F9127713D7F5102625D02E84EAFC9E2C09E76CC331742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dfb14b99b5e870d09e987a2e259b66900578cd65c3e08efa4d5e8a89ab307412
MD5 1ab08cabb046c620ad5166cc8b16cf1e
SHA1 28ae7b66275938b7427fe259c42eae895741ad3b
SHA512 a89465079ad3c41bf1dad71e7022c003e81263f795394b6bac204b67188fdfd551da7e156e31413f26a4b50444cd7fa937e5ab73d2de477c1c9c9c175a6b3214
SSDEEP 192:0Rg8tEQEERNdov72ympAPRp2/95Hsb+WNn4v0m6QexTU2hzIE4N4VyIsnAUgtaJ:0Rg8ck0QUXo7w00j7U2hzIE4W8
TLSH
T12A42D82EB920657B9DDBC22AF9127717D7F6102625902D84EAFC9E2C05E76CC331742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dc7be7464ff194d51741dc3bc6e631136237be17c6efea9750019be2c6c3b35e
MD5 f29841c204332c13122e13e36b7529de
SHA1 9312b447d011f29f21311204f6fed5b56a4f8aa9
SHA512 2c9e6908358d99fff0d676b29d1f2724641bc09d89d519fc1af2ad18668a273c3af6b89a7aeed472cd846192c05779574c631a4abaa0331a4c226a13b6ed0304
SSDEEP 192:0Rg89EQEERNdov72ympfPRpz/95Hsb+WNnpmteQ6QexTU2hzIE4NRVyIsnAUgraJ:0Rg8Mk0Q5X77w0tq7U2hzIE45e
TLSH
T15252E92EB91069779CDBD219F9167B13D7F5102625902E84EAFC9E2C19E76CC331702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fbe92b3f9326043105ccabe85c97b493699c6207fe59f5cf2721c1fd7c015405
MD5 45956dd7e4bacc26b27097e6dd31f4a7
SHA1 f4c8ca7a627a0c26f60d50ef2fe90691306d20f6
SHA512 20b8c581e4ed742e7cb51bad44328e18fbb540abaf26e2c472e6b437a1d4f29814591ce729de09058fabec57be89f466bdabab448b9e7add5ece904ea8b7de84
TLSH
T1EDB0120084516101C89202B035D2148871586F109A0A270143E0AD32CC365628014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ccc1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ccc1.TMP
Size 96B
SHA256 da0b00281538250d0870b8ec9264da3035b75ba6fe98f0af2aaa99fe47976053
MD5 fd252fab41118b581b804b1edd017ad1
SHA1 60d4669766292d1691fa23aac7c9e6193f37c0c2
SHA512 efe6875968022323b2b860d5bd4ec6760c06971c2be8420f265247c1ef43a24a29f426c9a3a7b7ca0a3e9893c322a1b43d8c29e58190e40a842ffdfa22c02bcc
TLSH
T16FB002A5C147A293D04303B52699BDDC7171DF35CB43135692F11AB7DC3AF718625264
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b8b55e8dcb3260e57c548f3e9a3b97c16473ead41aa0f1cdeaa832aee338e3a0
MD5 996e047e2546f8bb19d90612f509f18f
SHA1 5362d12f734dc832604dfbc906c804d271c3b3e0
SHA512 0989f04ebc56d53eed265df5d8757707bf33dabfddcc439e0f9cbec628ff6b9f53ba85245614dd39215efc05d5e418b3bdacf82d048229451f504a605cd56933
SSDEEP 6144:7hX4NwhgqKR4ILo59R57lOYo83qZ/ZLW3ExE:toNweqYhLw/7lxqZ/piQE
TLSH
T1D43413B2EB631F359CA6CFBC30112EA58FF2929DD0B8D205EA5936BF710F454990586C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7d876417b8a11ec26f818a38ba63cde2f69f1971c4a0bbabe7a19df558eb1c30
MD5 ea308e3225a328b122168cc30438f0e4
SHA1 b9d7e592d8d1c265bda243d4f776bc26ed94bfe0
SHA512 3cab4f5e5a887520c8724128864c65051265e2c90a4d7954200984f240800a78df289b1d0d26e4bd153886d08143569cdd347b87738f774a2ae7a49b0b4dd467
SSDEEP 6144:ThX4NwhgqKR4ILo59R57lOYo83qZ/ZLW3ExE:1oNweqYhLw/7lxqZ/piQE
TLSH
T1D63413B2EB631F359CA6CFBC30112EA58FF2919DD0B8D205EA5936AF710F450990586C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 47782c5ec218ee42418849706f1b5586baad36b0a7ba5116bf583ef04f7db28a
MD5 fa490acbf4ea432cffed10665ad164c5
SHA1 3f5b288552b989ea0954d0fc9e03546ac834e3d8
SHA512 23489dc094c81d3869ed2d68a96986a05b58960d7722fae2d36a11c79521ecf2ad112fa5a6140484c1f098bd09c1aea3c5a8b9766f813e38b276eaea990bb811
SSDEEP 1536:TUQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:1qfd7NtZL8cHQRZEQ6Spsk
TLSH
T11BC30237EBC21F339D92CB64B9530FD697B644A99034D301AA6D77BF6C8389164428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f7cd3147bbf3ef369dc0b5fec3ba14046eae4dabe2becb5a2c3627ee0a951eea
MD5 5b668cdc2f8c9d72e7a4c2076ed1cfa4
SHA1 e186191b7d59525a9ac9f101c59dc5e0de09d786
SHA512 7693780739407cc28878ae47f690840b25ee4f052ae940edad47b5faef49b07a3194189a4a3774e7ee7827100e443c49d2715ce0fbd9346e89fd54880a485a7e
SSDEEP 6144:wNX4NwhgqKR4ILo59R57lOYo83qZ/ZLW3ExE:wNoNweqYhLw/7lxqZ/piQE
TLSH
T1433412B2EBA31F359CA6CFB830111EE587F2519C90B8D201DB6976FF350B895A60587C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2544-10-0x0000023C1FD90000-0x0000023C1FDDC000-memory.dmp

Download

memory/2544-9-0x0000023C1FC90000-0x0000023C1FCC4000-memory.dmp

Download

memory/2544-19-0x0000023C04F60000-0x0000023C04F70000-memory.dmp

Download

memory/2544-17-0x0000023C20440000-0x0000023C2044A000-memory.dmp

Download

memory/2544-16-0x0000023C20470000-0x0000023C204AC000-memory.dmp

Download

memory/2544-15-0x0000023C20410000-0x0000023C20422000-memory.dmp

Download

memory/2544-11-0x0000023C1FDE0000-0x0000023C1FE2A000-memory.dmp

Download

memory/2544-12-0x0000023C1FE30000-0x0000023C1FE5A000-memory.dmp

Download

memory/2544-0-0x0000023C04740000-0x0000023C049DE000-memory.dmp

Download

memory/2544-18-0x0000023C204B0000-0x0000023C204B8000-memory.dmp

Download

memory/2544-8-0x0000023C1FC60000-0x0000023C1FC86000-memory.dmp

Download

memory/2544-7-0x0000023C1FC10000-0x0000023C1FC5E000-memory.dmp

Download

memory/2544-6-0x0000023C1FB70000-0x0000023C1FBBA000-memory.dmp

Download

memory/2544-5-0x0000023C1FCD0000-0x0000023C1FD82000-memory.dmp

Download

memory/2544-4-0x0000023C1FBC0000-0x0000023C1FC10000-memory.dmp

Download

memory/2544-3-0x0000023C1FB30000-0x0000023C1FB6A000-memory.dmp

Download

memory/2544-2-0x0000023C04F30000-0x0000023C04F4E000-memory.dmp

Download

memory/2544-1-0x0000023C04F60000-0x0000023C04F70000-memory.dmp

Download