8e65d7fa956e2840e2ce15cef81c6574798947b859df79c3edde69c12f576eb9

Analysis

user interaction
yes
max time kernel
102s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ghosty.exe
Size 2.8MB
Sample260421-e4kekahw5m
SHA256 8e65d7fa956e2840e2ce15cef81c6574798947b859df79c3edde69c12f576eb9
MD5 ff170d5864fc5da0d87cce0182533bd9
SHA1 25d4267b6a139c52ebb548cd04ab05528742c913
SHA512 d400c23d33d857437b1a191d479387eb5236a8b49fcb75ceb3cb7aef19e8a2739793581709f02ee066dfa2cafd9b3e37210a2e36d167381b917987169e2e79f2
SSDEEP 49152:wkrulyMwJtIore0MGDXC+uMCAKKVSC+uMhxn1Ha:GGtRrcc7KKPch2
TLSH
T162D5E145E2A701E8C5A68138872B931BEB323045073357CF6BE52A567F67EE21B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
98	5852	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
30	raw.githubusercontent.com
31	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5852	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212194227388641"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe
Token: SeShutdownPrivilege	5488	chrome.exe
Token: SeCreatePagefilePrivilege	5488	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe
5488	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	Ghosty.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 5440	5488	chrome.exe	81
PID 5488 wrote to memory of 5832	5488	chrome.exe	82
PID 5488 wrote to memory of 5832	5488	chrome.exe	82
PID 5488 wrote to memory of 5852	5488	chrome.exe	83
PID 5488 wrote to memory of 5708	5488	chrome.exe	84
PID 5488 wrote to memory of 5708	5488	chrome.exe	84
PID 5488 wrote to memory of 5628	5488	chrome.exe	85
PID 5488 wrote to memory of 5624	5488	chrome.exe	86
PID 5488 wrote to memory of 5628	5488	chrome.exe	85
PID 5488 wrote to memory of 5624	5488	chrome.exe	86
PID 5488 wrote to memory of 5948	5488	chrome.exe	88
PID 5488 wrote to memory of 5948	5488	chrome.exe	88
PID 5488 wrote to memory of 6060	5488	chrome.exe	90
PID 5488 wrote to memory of 6060	5488	chrome.exe	90
PID 5488 wrote to memory of 3772	5488	chrome.exe	91
PID 5488 wrote to memory of 1828	5488	chrome.exe	93
PID 5488 wrote to memory of 1828	5488	chrome.exe	93
PID 5488 wrote to memory of 2648	5488	chrome.exe	97
PID 5488 wrote to memory of 2648	5488	chrome.exe	97
PID 5488 wrote to memory of 3392	5488	chrome.exe	98
PID 5488 wrote to memory of 6124	5488	chrome.exe	99
PID 5488 wrote to memory of 4804	5488	chrome.exe	100
PID 5488 wrote to memory of 4128	5488	chrome.exe	101
PID 5488 wrote to memory of 4128	5488	chrome.exe	101
PID 5488 wrote to memory of 1784	5488	chrome.exe	102
PID 5488 wrote to memory of 1784	5488	chrome.exe	102
PID 5488 wrote to memory of 3236	5488	chrome.exe	103
PID 5488 wrote to memory of 3236	5488	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\Ghosty.exe
"C:\Users\Admin\AppData\Local\Temp\Ghosty.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd76ec728,0x7ffcd76ec734,0x7ffcd76ec740
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,4446407309383988899,14881803976258790087,262144 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,3031778374017477568,1002534225690049879,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,2594672190608666087,7720542235384807259,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,10650766194418260780,7943300471733091363,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,2234735427729893865,18007386108148661779,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,8400448705405869858,13599278368709060249,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4260 /prefetch:9
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,10154270372803759902,13352761797215440317,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,2155691959884906291,1629457867892939663,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5860,i,13707993620713553395,3819651817564109774,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3508,i,9014442287995040823,5143850084877256298,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,5698518605416353763,2865048513176828978,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3636 /prefetch:14
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,13666675167887247784,7319504463070574486,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,11819291646486756708,6935370220536305591,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4268,i,183511446276582111,16759588379926887779,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,6762676102665332801,6065528560498937155,524288 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3092 /prefetch:12
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6092,i,11315375793823751713,9052618815269844404,2097152 --field-trial-handle=1924,i,6630194826401164750,8299335818594794740,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e6f7178dd7eaadce20a05ee06bd36c354f9bf45c38bdcedb0e3b2b2c7790f36f
MD5 9e61b7c95066bd86708e0cdf4bd2d341
SHA1 69b286effda838919a0b57052b7ac8acf103628d
SHA512 75c85f21e6700739a2751d5349f46ad9685c1f280492528b1b7e1ab2138f94a69d97c8f43f1203469c9351c87db301e8fd55aca061225ce364bf8fd6c4a0bd94
TLSH
T197E02BAACC21E82709FD1B1A60504785F70013572741854B3B3D820D4FB027701D582C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 1024KB
SHA256 b90d9a0c06f67932e08e93b55e70206cd8bd0a076c48bbd5dace62d49d54508e
MD5 7f8ea6c9638951baa7f98d69dded848a
SHA1 363da03e2fd8a59830352e0258e640e85559a551
SHA512 cb82e455c42a3b18fb5d267169ac9384633188c10151af362675ef16031ffb051513c2daebc8a0ec043d35d312cf63d6082ecb0e664d886156d6bcbe305764f9
SSDEEP 24576:QvBUMoIRdR4ZKdy7Qn1hlK4+9eLl/8HbiZQT+KdKdW3fZXtjJRO:go0oK47s3lEYR4i4JwmXt1RO
TLSH
T1BB2523828D7B62C7E37279641C37631873486760179AC487241FFF9AFC7AA26C3E8519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 69b7cd42f374bd2308e109ac8cf3d739e3bc249f04db2f63556e311b99a15268
MD5 6194b42313622be69c20c0764fb4089f
SHA1 234e7733a3e3133149cce83ee405c99e06eaf096
SHA512 eb50b3f52170b3a02e19b8df7d038ac955cd9027ef893e52f46730e72a1fec73da6bda53853ba64b0f2b7783c575934aa88683630dc89da7e18daafd3c125c07
TLSH
T11A81D37D9CCAC206FB1921307EF08D0B777ED69AC9DB5E1784DA4D3805127D8498266F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 82a701b1b38055ee413c7f1c30d561c0dbd5681dd74d6a1eb0cd518eca8524d7
MD5 fdc91ff3c69b709395152532a78535e2
SHA1 27031d3e3bbdb960f1522f72347ac68f2a35836a
SHA512 4d82afb09d8703754ebf34ab7a134e12a5332404709296d186f859270345de05b6075ce2320031f5bf22648ef3f1b95c4b1f05630ae343785ef806bdaf3d5970
SSDEEP 192:DzwNLSWmmmKVjKjZaIasuDydJ+1wwzL5mmbmmmrmMZmDmbNjjjnjnjrjvjBfjhjt:DzwNLSWmmmKVjKjZaIasuDydJ+1wwzLe
TLSH
T19E12AFF7C3E5852DCA1156F4AB156F1FCE2D0928532C3C66C4E8AE5B93E2871E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4c8fa847a4747463b416a263114d93d66171ad37a974b7c7e11910ddbb7fe77e
MD5 575500dfabcae454d7a14835a173b1e5
SHA1 b15fad1ac8ca894303dff1474f532338e21cd93f
SHA512 cb4336fbb2154c5d476dcbe35492e36074b37c9dfc432f3432b5db0ae7f11227454b6f9408ad90af1981490d448d0c1be8f2565943d174f47c2991a2f94cf186
SSDEEP 192:vRx9cBCBuBfZqkqiv7dhtPRpVCDelInT9ZHsb+WNwcH8L+rg+g32ES622mkw2P/M:vRrmCBuBrqupfXuHwwRp2622mWtXe
TLSH
T16F62B56EED14293B5CDAC669F851B71BE7F5102162801E84EBFC8F2C15E79CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b4d123bef566e7c76006c0c903e3931b0ca683edfa21c72570c2aec3ea0132a0
MD5 5cb4180cf2a6bbe2ce1d9bbbcbfd7396
SHA1 c7a55240716017e9005fa7dcbf361381e2bcefaa
SHA512 5b1859a4828c3af6ce8d22d87a724121e5eef68260ae45379515fff1f9e0bc396d06b71381a69419277452da822ef0b6b588dc39bb2602267fb09fe57c1a26d1
SSDEEP 192:vRxB5uBfZqkqFv7dhAPRp2d9ZHsb+WNn8L0yS622mkw2P/TCxVyIsnAUgtaJ:vRX5uBrq1p8XGHwg0g22mWGX8
TLSH
T1A842D42EAE14693B5CDAC629FD61B717E7F5102161802E84EBF88B2C15E79CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4ad71f9c0e4c47c97af5467534cded931c37e35a3378a2f330bd851e0a36575d
MD5 785bc07f134a284c6dbf5a4eba6bb3a3
SHA1 614d9b14dd6f174b562ebccbf7fe833a1e5f857d
SHA512 0b24345749f2fde1ae439ad628d279c0e107784eaaffcc5caf97646b2d8625eaa3d57db896ead45172067761d0c61a6128fd31bdec5db14223e92947eb3cee28
SSDEEP 192:vRx9cBz5uBfZqkqFv7dhAPRp2CDp6S9ZHsb+WNoo8L4g32CS622mkw2P/TCxVyII:vRrmz5uBrq1p8XdHwqL2Q22mWGX8
TLSH
T1C452C52EAE14293B5CDAC629FC51B71BE7F5102161841E84EBFC8B2C15E79CD321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8390583a8687617e0053ba279c2883957fd8b4923dc8a205fbe7291258053ea9
MD5 634f105965192492e6ec076b97aa39c8
SHA1 ecec57988420cb72b031b556396c93a9e76dcbe2
SHA512 606152a9edfea483455d522b97b0ad964ed9337fe90195603c15be790f39283908872191768d40656889079bc33c38a6931f747f393ef52bbaa4790e461b53ed
SSDEEP 192:vRx9cBCBuBfZqkqNv7dhAPRp2CDelInT9ZHsb+WNwcH8L4g32ES622mkw2P/ACxM:vRrmCBuBrqtp8XvHwwL2622mWPXe
TLSH
T1FD52C56EF914293B9CDAC629F951B71BE7F51021A1801E84EBFC8B2C15E79CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7ef263bb6532f1b9407e0ebea60db4dc3f5b21d08bb1d66633d51fb280d7f183
MD5 717ae35db8ba6c50fc47721f909f7dfd
SHA1 5d7b968c7f16be8c5e9b8fa6168e0718631a9662
SHA512 0f6da47afce0e3381bb2c4c4bf6402bae21e2615eda353a84a18d62046c65079c2000e1554a47ca983158fdb0e0502d0c75288fa153b6b4a0fb1d908ffafe09b
TLSH
T104B0125088019651C00302F8119308983114DF2087051307B3E479719836190401C192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590891.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590891.TMP
Size 96B
SHA256 980f08b85ae691f48e0e9b12ce2e305381873f87a20a399ec7d3cb6538babcb0
MD5 65dff566eed725e76370407e17f62aed
SHA1 d82834f912c61200c71690099516de7aba73124e
SHA512 39e16ff71b75983256c3633678d96f61fce67c81362a67fba20caee711694d16424257aad5dfd224d820914a59c7dcd006c32c37e5fee99cba553772b2c155f4
TLSH
T170B02200C003B202C00303F028C280CC32A0EF20C203320383E02BE2CC222E00028A22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 a9ae2d0a97e7ac4329a3faed052f225c8ab4b85b9e929f36f643466a23775502
MD5 7a4338029d9fb3e9e5f9badbabc3bd0f
SHA1 da3c1d8928a88fe5d85796933523877be6250190
SHA512 311bb2ad1271f56fba3d1d2c3898f6b0030d2250db70c0f3f76ad65bf9f3afb1231537edf246ebb489181236285c30260004ca9ca112cd98176192e858f11b23
SSDEEP 6144:zk8W/NgGUIuuZ1Ww7m+Lsd++JjcMW2VcVLx:zw1WcLMOMWP
TLSH
T17B1412BBDB4A6CF2635D5A52502BDC1D8CE389DD183C567860CA7F8E04EE38173578A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 659622af9be76f966ed563b8b78d7a276f6efdbc8020ea864688250f99b3545c
MD5 e5a1eb5cc5bbacfa5494a72fa2d70e79
SHA1 ab459f855503c16213876d480b63f4ec818f9d9a
SHA512 4770a81d56102b136670109ab729393cc086fa61a5faf7307e790cb3be950f798c6a8491592ceb28366313425a36869aeb18cc4536cc61a86afd0aad815f8037
SSDEEP 6144:2k8W/NgGUIuuZ1Ww7m+Lsd++JjcMW2VcVLx:2w1WcLMOMWP
TLSH
T1101412BBDB4A6CF2635D5A52502BDC1D8CE389DD183C567860CA7F8E04EE38173578A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 def07213468635a9fdc6f36831d08b67606bbb024b71fa5cc6216952b59a6299
MD5 c1fafaab92060769c1587fe883badf48
SHA1 b81e8c9240a587660e40fc802a56ec0e56827cfa
SHA512 bb378496a5ce620e46cf465cc3284382fc5e236665a54580eeff2c03b916bb5e352bb7f238310925111844a081e62769e37f69bfa7dd273cb1f1b1f766c66b74
SSDEEP 6144:yU8W/NgGUIuuZ1Ww7m+Lsd++JjcMW2VcVLx:f1WcLMOMWP
TLSH
T1311412BBDA4B5CF167A94A565017EC1D4CF38ADE482C4A7870CD3F4E14EE38176478A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 20baf1c07545cc033258f0a9c14a8e88f58d3ae988ec845c8f6184b4122e329f
MD5 d95637f7ccbeb5bf327ab26354d1390a
SHA1 acf6624f8d95243cf3de24b2a48c8d30785eb00f
SHA512 4cfec11a992997b064b7fd9ffb51eb1f831377052429c194ccee27bbc2fc779c6d22cf08efe1dd9c8f8f871ab0af7b16e3f00cef03339c4ae8a8d0dd87728d12
SSDEEP 6144:rk8W/NgGUIuuZ1Ww7m+Lsd++JjcMW2VcVLx:rw1WcLMOMWP
TLSH
T1A51412BBDB4A6CF2635D5A52502BDC1D8CE389DD183C567860CA7F8E04EE38173578A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 734f22aebf5de3ef0c7cc9b7264d70892ecf599fe3b0650ea520499e7c0fefe6
MD5 927b01bb874f8a7ca4aa529edaac7092
SHA1 8f2dd51bb8341493a206695e96757b212aa68c5f
SHA512 0253a42aff6a475f6706a3718f58a9e23d6c829b0af89647dd5eb027b3df77b37556788e69b3bb1e04edc4db8e672b2be46fdf5229b371c27acc644ca0793be0
SSDEEP 1536:X4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:u++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1169302BD991E7C79636BC696A0079CAC8CD3DCCD111451BC31C76B0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 101766.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 101766.crdownload
Size 2.8MB
SHA256 8e65d7fa956e2840e2ce15cef81c6574798947b859df79c3edde69c12f576eb9
MD5 ff170d5864fc5da0d87cce0182533bd9
SHA1 25d4267b6a139c52ebb548cd04ab05528742c913
SHA512 d400c23d33d857437b1a191d479387eb5236a8b49fcb75ceb3cb7aef19e8a2739793581709f02ee066dfa2cafd9b3e37210a2e36d167381b917987169e2e79f2
SSDEEP 49152:wkrulyMwJtIore0MGDXC+uMCAKKVSC+uMhxn1Ha:GGtRrcc7KKPch2
TLSH
T162D5E145E2A701E8C5A68138872B931BEB323045073357CF6BE52A567F67EE21B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2628-1-0x0000021271B80000-0x0000021271B8C000-memory.dmp

Download

memory/2628-0-0x0000021271B60000-0x0000021271B72000-memory.dmp

Download