quasar | 4c23d1ffa99a27a154e6512945637799a0bf3c8ad84365070ed4f5fd7fcbdbbf

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/03/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nebula.exe
Size 3.1MB
Sample260324-2qb8cscy2q
SHA256 4c23d1ffa99a27a154e6512945637799a0bf3c8ad84365070ed4f5fd7fcbdbbf
MD5 00c66c9274886a0ad978bf52988a7aa7
SHA1 12b09b6e8c4d93de7e22d8fc7b4c1ccbfd3605c7
SHA512 75655857bfc87d2ba47264a4808ee2301e046ad41d2d5b281db12c15385c55740832aea85d1fcd45ed8732bb6bd6db405d931f33478117fac5ef4b897c2f003e
SSDEEP 49152:Mvdt62XlaSFNWPjljiFa2RoUYIIc6PbRE2oGdnm5THHB72eh2NT:Mvf62XlaSFNWPjljiFXRoUYIIc6p
TLSH
T1B1E56B143BF85E27E1BBE277E5B0041267F0FC1AB363E70B658167BA1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

yen discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

174.160.220.252:4782

Mutex

4e58323a-f749-4f46-bc8e-f96693f0a175

Attributes

encryption_key
FDD0F506D891B655EA4B5BAB68CB814B5C76F4CF
install_name
Nebula.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Nebula
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1592-0-0x0000000000870000-0x0000000000B94000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b41d-4.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4736	Nebula.exe
1788	Nebula.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Nebula.exe	Nebula.exe
File opened for modification	C:\Windows\system32\SubDir\Nebula.exe	Nebula.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
992	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134188661860200656"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe
3568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	Nebula.exe
Token: SeDebugPrivilege	4736	Nebula.exe
Token: SeDebugPrivilege	1788	Nebula.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe
Token: SeCreatePagefilePrivilege	5632	chrome.exe
Token: SeShutdownPrivilege	5632	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4736	Nebula.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
4736	Nebula.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe
5632	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4736	Nebula.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4880	1592	Nebula.exe	79
PID 1592 wrote to memory of 4736	1592	Nebula.exe	81
PID 4736 wrote to memory of 3568	4736	Nebula.exe	82
PID 5632 wrote to memory of 2580	5632	chrome.exe	87
PID 5632 wrote to memory of 2648	5632	chrome.exe	88
PID 5632 wrote to memory of 2648	5632	chrome.exe	88
PID 5632 wrote to memory of 992	5632	chrome.exe	89
PID 5632 wrote to memory of 1080	5632	chrome.exe	90
PID 5632 wrote to memory of 1080	5632	chrome.exe	90
PID 5632 wrote to memory of 5616	5632	chrome.exe	91
PID 5632 wrote to memory of 5616	5632	chrome.exe	91
PID 5632 wrote to memory of 5884	5632	chrome.exe	92
PID 5632 wrote to memory of 5884	5632	chrome.exe	92
PID 5632 wrote to memory of 5500	5632	chrome.exe	93
PID 5632 wrote to memory of 5500	5632	chrome.exe	93
PID 5632 wrote to memory of 1668	5632	chrome.exe	96
PID 5632 wrote to memory of 1668	5632	chrome.exe	96
PID 5632 wrote to memory of 2248	5632	chrome.exe	97
PID 5632 wrote to memory of 6052	5632	chrome.exe	99
PID 5632 wrote to memory of 6052	5632	chrome.exe	99
PID 5632 wrote to memory of 2540	5632	chrome.exe	100
PID 5632 wrote to memory of 2540	5632	chrome.exe	100
PID 5632 wrote to memory of 5984	5632	chrome.exe	101
PID 5632 wrote to memory of 5984	5632	chrome.exe	101
PID 5632 wrote to memory of 5584	5632	chrome.exe	102
PID 5632 wrote to memory of 5584	5632	chrome.exe	102
PID 5632 wrote to memory of 1656	5632	chrome.exe	103
PID 5632 wrote to memory of 1656	5632	chrome.exe	103
PID 5632 wrote to memory of 4160	5632	chrome.exe	104
PID 5632 wrote to memory of 2588	5632	chrome.exe	105
PID 5632 wrote to memory of 4372	5632	chrome.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nebula.exe
"C:\Users\Admin\AppData\Local\Temp\Nebula.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Nebula" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Nebula.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4880
- C:\Windows\system32\SubDir\Nebula.exe
  "C:\Windows\system32\SubDir\Nebula.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Nebula" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Nebula.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3568

C:\Windows\system32\SubDir\Nebula.exe
C:\Windows\system32\SubDir\Nebula.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc9b13c728,0x7ffc9b13c734,0x7ffc9b13c740
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,16181985492312932427,3475227516575790271,262144 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,4846699811694332724,5248708291804276242,524288 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,9051534607281148367,7807637319492773063,524288 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2372 /prefetch:13
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,15950601515592547301,9791821176144179990,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3472,i,4984768887939184420,9332353537260304081,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,18386532036976228852,9697311286175719935,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4360 /prefetch:9
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,8159380580685192905,11882204683377229028,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,2347028883451445046,17429198679771045851,524288 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5468,i,17392403760858684449,6237439516102171539,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4844,i,12482545966060622831,16225263477000195042,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3640,i,5612275413993688383,11575020431498373101,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3572,i,16219143495802433746,17356548134014731168,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4716,i,10102428306690556490,15949514189886617901,2097152 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,2899165935278665936,4424202716668815833,524288 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3448 /prefetch:14
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,15699724805018593377,9968307777766734199,524288 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,1790680514092677883,1315451746844071185,524288 --field-trial-handle=1992,i,18146173401405890511,10435928419133038324,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3700 /prefetch:14
  2⤵
  PID:4372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b1fbd876b163e9b355cca6abbb3f45cae639559dd9ccb5ff3a8d392834a62fbd
MD5 975b30aa91574751f83d5d1dd853ed1c
SHA1 59cbf16aed0ffa2c80dc78fbd66e2abbe6f48ed0
SHA512 5770f9d9fceb1d770dd8f37567aa0ed6a4ed04bdab6a4718df8c18bd716d12fe660d080e9ec0cee1bd5b915c1a226cd1787f75a804ba0bcc0fefd8e6a8b99553
TLSH
T192E0E5AEC834EC3718FE475960904B45EA5013162A90994F7A3D89088FB06274186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 18KB
SHA256 58ea0c077fc4476b0e5c2706093bb670069893f798ad45f76e7594f8e6418cdb
MD5 462eaf645c81c46395db51fcacf3d67c
SHA1 4c3f63123ecc4e6543683f770a715e9b924a984e
SHA512 84cf4b0434a1f77501914ecce3edfcbe56ba14dff53ccc2255427e538bdc3e5a059412ba5b5aa7d41d7a82937f627461adf2b6e907adfa24e1eb1531286f62fc
SSDEEP 384:fnoZsT82XD7nRSQCwEA4jaDCdVtLXnPgSebuDD7u1KceA:foG8CDtS9aezdQbuDD7u1KO
TLSH
T19282E1C289D90DB07A142579886324214A84D8BC7B8F9C43DFB3CA6F8753275638397F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 66KB
SHA256 0dca26d21955e04ae2e3faa014732e7c5d5e4565e5379fe8151afbe6602c452d
MD5 f9c69e13bc6bf4dfca85fae2e2fb4b75
SHA1 a330cdcad967233e41a4a67ec18a273cdef3b56a
SHA512 16ef120f16fa7f330a35bb072244c95a7088408c9414bea4b2107dafe0cc2dc1b1d23ddc4aeec504c5fe6691f19ce07877f8c7041855ff7cbc17a194b10d91fe
SSDEEP 1536:U86vnOYOEoZoTg+JpIwMnXQypmAHIJ79eqOgPkg:uvnOYOEEHsIznnpmMINpJ
TLSH
T17F63F17EA5EBAA60C32E482E072EFD27E66613C951C1609B73176584E58CFDE41C1B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 19KB
SHA256 6964eb77a8b07ad38eee7fdcd73a4fe06c6ed91375ea7087ee58ed5d8aec4494
MD5 39a4cd75c56cc30ee90128b4f1b0f936
SHA1 c5b0fe80725d13ffe26c63cf38538dc074167744
SHA512 d762c12c482154dbff48a30a3dcd95090d2917d3beb03b48f0183ccc64e84f049fd2018547ccfd528d9666d4f3490ed368115f857b8d1bc65dfe291f28c00e27
SSDEEP 384:Gk6ClKOrFxgxRo5yGostz9zwKAJ8M3pK0m/gVb+hswyrYbPXp4OHZMypGtuoL:5TKRo5estpzBM3k0X4sP8bPZRLY
TLSH
T185927B2BF3846692CC047D3881AC9E8D55854FF569694B2E290EB0903F336EE5CFC8C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 23KB
SHA256 8e925008b892aabb05b2a65ddf81c0d6531190f6bb0c829bceda8bd33597bf07
MD5 47b3568338a75377b0eac33c5a7f3d02
SHA1 35bcc8507169eb683b90df0d3853a81435080f79
SHA512 b41483219896a188069e14ccdf31da497a76f0a04ba1dcf80a3ffb5cc8d457d3ac216442ccd0df7bbeccec035d228c640d4380766a84ffde58ca2c69ad8f667a
SSDEEP 384:gyE1uOkDdSCSPvXXw49XSqdXujaWUEFfpeH940cg4a1JPv9o8GqLmIx6YIoOSo:g/2MvVSqd+jaY5Ad40cQvQqLmI3I5So
TLSH
T1E6B26B12865D519EDD276FF031AF0F9B8BB80170E456D7239900B782BE523EA8CAC7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 23KB
SHA256 3b43ea0d96c8ce4d80bc2e26a85943499d05de71efaebc843b2b7eb6d0693985
MD5 26c5f68eb0f4d11a08ee716524ffb36b
SHA1 9603c159980496c7b889d387e1131dcde43c1b7c
SHA512 05246bf0f3b6be2379daf3480976316f1ad8393884aba1793df8b5a85e2974fe73129e2144c9e9a92294cf71fe11bc349bc5de8c245042e1ee5b843f71c97547
SSDEEP 384:5yE1uOkDdSCSPvXXw49XSqdXujaWUEFfpeH940cg4a1JPv9o8GqLmIx6YIoOSo:5/2MvVSqd+jaY5Ad40cQvQqLmI3I5So
TLSH
T12CB26B12865D519EDD276FF121AF0F9B8BB80170E456D7239900B782BE523E98CAC7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 152KB
SHA256 9fc85f3a4544ab0d570c7f8f9bbb88db8d92c359b2707580ea8b07c75673eae2
MD5 6c4eee562650e53cee32496bdfbe534b
SHA1 1aae708e3b94ee981b452a918d28ed037fbb5e18
SHA512 ebcb5a2e2a908228f77ecd03b45491778cad73ddc39fa3a6334b129aaf9fa36c16c0307aeaad74d77f616b5b34aac52d91e9f4816945253dc9a826ddd71f4d12
SSDEEP 3072:OvM6gZMLmY8uGpjVnlooQ+GQs8jic0f/KkMdE:OU65LoP5QSsuic0f/cdE
TLSH
T18CE31200D620498D9978FD5B2A1FA1FFA7A939C95ED210BAD3C30CB93257143BBC2556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 16KB
SHA256 abcc6ea2a48809cddd125cd93c43f7352cc910b527cc2ee0b50fe4864b039ecc
MD5 21ad0bdc35c8aec1364003fdb4fee011
SHA1 3c749d565fe443138fa1aee4bd9fe4cc81fdc7ec
SHA512 58146adf64f5625402bf0ccc22f1917cc21fcbfd0b5a74cacfc01be69c9df157f054e0393510829fc6b1d1506987d0a2d40c22d097d347ff16ca6a9245fe01c7
SSDEEP 384:sURpYelo1WfNQpGNNzCl2AU7uqbftXUQ2e5AY5AKFIewbOPX:sUR+eWmNuGQ2ACh7tb2KJl9X
TLSH
T16A72D0DB05305612010051457DAF92CE39D7C73FD9B33B84E9521A2CE9EA92C25CFEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66619e74ba2163ae_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\66619e74ba2163ae_0
Size 301B
SHA256 71435ec5881cebb063e80188d672eaca47c38fff6bc1698cfa2c39d80de9707f
MD5 15b45232b9259a63bf20ee7b3e6241d0
SHA1 b28cb7c2e450eb11cd001a480e185853528af5c2
SHA512 868ec96ebc8c4a34e33e1311840418bf5695f72219b4359d66684741650ae7f72210cfbed6a16b504884902b04d670e04f78303b3defeea7535644edb3014339
TLSH
T11FE0EBE748A33800DE2E42F357AA3808C30AC08808CC00FA5201A58F44D16B3A644101
MD5 SHA1 SHA512 TLSH

Submit Download

66619e74ba2163ae_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\66619e74ba2163ae_0
Size 301B
SHA256 f3e3d2f94d7a614cc1eba1a7dbd9e37f074fe6e22ec30ad83f6fda0ed5353f73
MD5 ef2473bdb4183735e9d8e1bf6f21fffe
SHA1 80ca214e30e8a3d552bfe9330f59b1e3a6af504e
SHA512 579c7525a6ec65facbbdf891296306ba9a57b9d76e50e2f86c91aca1e14f35aa7d67687d2980a44ea3c6785d724a36a765267c478508f9682865048c5f8be69b
TLSH
T14AE0EBEB84A33A00DE2F42F39BAA3808C246C08408CC01FB5201D4DF48D22B3A244001
MD5 SHA1 SHA512 TLSH

Submit Download

811091ae34d7e9b5_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\811091ae34d7e9b5_0
Size 780B
SHA256 be36078c34fbf33c23c65336f993759215bb36f73b6b29f1636677c17fcf091c
MD5 474899394f7f86f80ac015a689c7c5e1
SHA1 7d2d039125f486a3d1e3df5f09dc34f12d3f650b
SHA512 d719bc36f4cb826a345413ebff62bc2a8dba8a57345f9de402c0108fabd9f57b7ac0504efd8f8284e14bb2a3d840acfb50c8585ba9541ff153cdd98a2a9b6201
TLSH
T156016059EEA40EDCD72F4CF0FEF7A00A90B140302E18B05290146CAF3A0736081A2162
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 07c750a0108b9c23f4abeb83f44c572ae7d6a7d450ea38f0cfb9ae7955db3b2b
MD5 150bf5521e84a6e6cc09c7a29769b71f
SHA1 048d551ebb07488496e2640fc5c5bce5009d4e5a
SHA512 7784d3750a3b78e6e00aec2a72cbf085e0bd4573aaa17f1b2823ddd6e97179afd775678acbdb996d973cf761b3110276c8accaaf06102bb536f00a1922f4d7cb
TLSH
T12FC08C1160D0A208FBE093B03A83BC0432602A0683CA321649E471EC98AAFE062C7298
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e171e8b0897d281aa7fe91dcece9fb988cb1514bb91d55d443686b6a5cea1c03
MD5 fc0f90ce598a5fdd883149f54246cab6
SHA1 1d3c5580af03ff818ea2aead41207450a40b6d5b
SHA512 a6bea26f8d35fb551c0708aabc971a60a16e63a98d61c34730beda38067fadbd0f5818aabca39907a43aa3be8491267028f836bf690c426ba75cfb413c945520
SSDEEP 192:YRiRued7J9DZ/mn/f3xetua4hv7pFhAPRp2beR9YHsb+WNnQ3UeF23+J2ajai5LG:YRcueHwtb8XfOw8P2m2Caae
TLSH
T14B52D52DB918B93B6CC7C369FA227757E7F5102124852EC8E6FC891C15EBACE6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b650a77d4cadc86f1bd43d76f9e48b9166eb1df9fec29f9730b89cdeeb1b6e69
MD5 df5155cae173bcf55cdb970c4767fb72
SHA1 ee0bc947b3259c205151b4a8640edcec49cf3206
SHA512 c0cf4dabf8bb71aa429bcdde24136937ce8f90ab478774251dfbbb43fc0c321a78953016d79fdc71338025665124917311305a4ac0e3eac51095495698df1742
SSDEEP 192:YRiRued7J9DZ/mn/f3xetua4vv7pFhAPRp2beS9YHsb+WNnQ3ULweY+J2ajai5LG:YRcueHwLb8X4Ow83eV2Caae
TLSH
T13252D62DB914B93B6CD7C319FA227757E7F5102124852EC8E6FC8A1C15EBACE6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 688068b4a7a530995ec55ad0dfa062254cf82b67f8c8d6e02e03f84e0c2bb5ab
MD5 f35cefe2f722efd9a252a88cf878c5a1
SHA1 91be1d5c9e16fdd080a0f95b483081e57518959c
SHA512 23312387d56fbe6505c737ec410a6a93bf97a091b295a5ef4e491196db2b36bbf7cbfa6d2bb39364370d29f595cf49c7685020fead69a4212693e92842e85529
SSDEEP 192:YRiRued7J9DZ/mn/f3xetua4tv7pFhAPRp2beg9YHsb+WNnQ3UeF2EJ2ajai5UpW:YRcueHwZb8XuOw8P2o2Ca58
TLSH
T1E852C52DB918B93B6CC7C36AFA627757E7F5102124852EC8EAFC891C14E7ACD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f46ee4eaab8b4794a6f7b8f18eb019a9b464e2546d5007521c7d9168056dd44c
MD5 d0751b7bcc1070093baa3d23bf7ece37
SHA1 ee0f3512c5b6b711b8ae5a90efb22d2987bcec73
SHA512 d22f34f23ff301fd515b1b27513a7d9e5ceb734ffc61562541e98e105f5af01e059407e0c4f9c2616d62d9b8ce815b99232f418aca9e113b87c49cc998a32a20
TLSH
T146B0121484416911C05302B416822C8875545F19C709130163E0A971DC365A18118150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b30a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b30a.TMP
Size 96B
SHA256 8b01ac12a9130a0deb59eb8276f04b8f618d5688d8a8d3a4315137f82fa44dd1
MD5 93bceb1e82550c3006db70682e2f82a9
SHA1 4c5b5a77ae26ec637b602c0a74d29d12e2183def
SHA512 86b16c3390ddbfe94a0f1da6632b154e3eeb33d82ab9e0470fbe51208f758030ad0c20e98e35576d431e512a06d2e32d62f1575da5375ea7379a1bebedabc9e6
TLSH
T13AB02220C002A202C00303B0388AACEC3020EFA0C20F2232E3E02AA2EC2223080300A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 189KB
SHA256 4d5ba3709fb3a334a4ef4ddd81a98621f3685fc5ca7c31e4ba96dbae4f383ee9
MD5 e0258be49d34ebca6eb4a1d682c64aec
SHA1 d9b371f4c26995b9d131e0231f7cc43a4f3a43bf
SHA512 ee4aad4f918d0538d261fd6a379688e91449ffdb2e3fe96d088faea142b66b5101e4910d39b7f6aef49c55638f1cf718c9af686fc1226a67f6cb19b93bf273ca
SSDEEP 3072:6swHVKMGrL/QP1QAFpn5htebHzuz1++J3qUQm08KMWF0bFTcVHr6zS:KHALPQdQ6p5GHCx++JjcMW2VcVL9
TLSH
T1791412D7D82F3B762287DA5A911A8C6D8EE298CD180DB0AC308B5F4D2C7A3D2175FD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 83e7689a8ec5b199134b79eaabf0468c8eb0c60e630327ac593b0f7bd303577a
MD5 585d1d7c639a6debaebe42c4004bcbab
SHA1 7849b423679a84925b483846d23077ad909b3379
SHA512 273d66fc7d9b10e325b6a1280843f3dd5a23189c95d85f071be070b8b9de8a7d7b14824dbc13ad72245db92c820c26f451b5751f0c834a6ead5dd6d2c178160c
SSDEEP 1536:SIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:B++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1919302B9991EB879635EC69690079CAC4CE39CDD151014BC30C75F1E18BA3A2A30B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 189KB
SHA256 3733854f1731df0af4de3dafbd18fcfb4839ac46e53d2273c80b1033725578e4
MD5 5f2cab3703f1ef40b87cccc5123fb327
SHA1 7cfb8bd2abefb6b346dd96b2f36db56581636281
SHA512 f48fdf0e183f03486601acbf3ed4e31319ba548b9b6f333e9493a9e342f92278c0197d6ad892b955fbae72f7747e687e0feee1dbaed605fa95f44a73fa7a93bf
SSDEEP 3072:TswHVKMGrL/QP1QAFpn5htebHzuz1++J3qUQm08KMWF0bFTcVHr6zS:RHALPQdQ6p5GHCx++JjcMW2VcVL9
TLSH
T1AE1412D7D82F3B762287DA5A911A8C6D8EE298CD180DB0AC308B5F4D2C7A3D2175FD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nebula.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Nebula.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

Nebula.exe

Path C:\Windows\System32\SubDir\Nebula.exe
Size 3.1MB
SHA256 4c23d1ffa99a27a154e6512945637799a0bf3c8ad84365070ed4f5fd7fcbdbbf
MD5 00c66c9274886a0ad978bf52988a7aa7
SHA1 12b09b6e8c4d93de7e22d8fc7b4c1ccbfd3605c7
SHA512 75655857bfc87d2ba47264a4808ee2301e046ad41d2d5b281db12c15385c55740832aea85d1fcd45ed8732bb6bd6db405d931f33478117fac5ef4b897c2f003e
SSDEEP 49152:Mvdt62XlaSFNWPjljiFa2RoUYIIc6PbRE2oGdnm5THHB72eh2NT:Mvf62XlaSFNWPjljiFXRoUYIIc6p
TLSH
T1B1E56B143BF85E27E1BBE277E5B0041267F0FC1AB363E70B658167BA1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-1-0x000000001B880000-0x000000001B890000-memory.dmp

Download

memory/1592-0-0x0000000000870000-0x0000000000B94000-memory.dmp

Download

memory/1592-9-0x0000000002E30000-0x0000000002E42000-memory.dmp

Download

memory/1592-8-0x0000000002C70000-0x0000000002C7C000-memory.dmp

Download

memory/1788-14-0x00000000027A0000-0x00000000027AC000-memory.dmp

Download

memory/1788-15-0x000000001B240000-0x000000001B252000-memory.dmp

Download

memory/4736-17-0x000000001C1B0000-0x000000001C1C2000-memory.dmp

Download

memory/4736-10-0x00000000033F0000-0x0000000003400000-memory.dmp

Download

memory/4736-12-0x000000001CAB0000-0x000000001CB00000-memory.dmp

Download

memory/4736-13-0x000000001CBC0000-0x000000001CC72000-memory.dmp

Download

memory/4736-16-0x0000000003410000-0x000000000341C000-memory.dmp

Download

memory/4736-18-0x00000000033F0000-0x0000000003400000-memory.dmp

Download

memory/4736-67-0x000000001D500000-0x000000001DA28000-memory.dmp

Download