b8e10c34b86d4ba87f8ff6cdb971d46907c1c6e7df714bf9c7c8d53efc99a3c5

Resubmissions

22/07/2026, 05:58

260722-gphcrsbb958

21/07/2026, 07:55

260721-jsglraas5n8

21/07/2026, 07:49

260721-jn7mdabx4t7

Analysis

user interaction
yes
max time kernel
239s
max time network
244s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin.rar
Size 1.7MB
Sample260722-gphcrsbb95
SHA256 b8e10c34b86d4ba87f8ff6cdb971d46907c1c6e7df714bf9c7c8d53efc99a3c5
MD5 195fe5057dca71570b45b3063762c246
SHA1 fa2d01b99e8c1279bf6e797b0e91731b1f96c01c
SHA512 dd5cb7116fcfbe94e205aa189c82fc829c7a940c2d11630d577795caf72252b55af0ae42e776175f583e7e18573777fa8d7eae0fe88bf4568d2b2ceb9a3aa2a0
SSDEEP 49152:Q8MYFQEqmn9tBcyIHgsmVaaSMk8uYoGKo1n27lOqsw:jMYuEfzBucVa/MwIKoIsw
TLSH
T1EC85332C273F6D9EF96DF04759852683B3D52EAD775FB6042086F1660848933B33888B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xzoYWkNhPSoDpkjvIfLoTWpTLfZ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\xzoYWkNhPSoDpkjvIfLoTWpTLfZ"	detectedstockkdmapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BEmNZkVuzTKUzLFtlPoURKnH\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\BEmNZkVuzTKUzLFtlPoURKnH"	detectedstockkdmapper.exe

Executes dropped EXE 5 IoCs

pid	Process
5848	detectedstockkdmapper.exe
4700	GhostFN.exe
4796	GhostClient.exe
6044	GhostFN.exe
2956	detectedstockkdmapper.exe

Loads dropped DLL 12 IoCs

pid	Process
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
2956	detectedstockkdmapper.exe
2956	detectedstockkdmapper.exe
2956	detectedstockkdmapper.exe
2956	detectedstockkdmapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5336	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291735789557342"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5976	chrome.exe
5976	chrome.exe
5848	detectedstockkdmapper.exe
5848	detectedstockkdmapper.exe
5976	chrome.exe
5976	chrome.exe
4608	chrome.exe
4608	chrome.exe
2956	detectedstockkdmapper.exe
2956	detectedstockkdmapper.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5740	7zFM.exe
4700	GhostFN.exe
6044	GhostFN.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
5848	detectedstockkdmapper.exe
2956	detectedstockkdmapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5740	7zFM.exe
Token: 35	5740	7zFM.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeSecurityPrivilege	5740	7zFM.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5740	7zFM.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5740	7zFM.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe
5976	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4700	GhostFN.exe
6044	GhostFN.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 3608	5976	chrome.exe	90
PID 5976 wrote to memory of 5336	5976	chrome.exe	91
PID 5976 wrote to memory of 5212	5976	chrome.exe	92
PID 5976 wrote to memory of 5212	5976	chrome.exe	92
PID 5976 wrote to memory of 5612	5976	chrome.exe	94
PID 5976 wrote to memory of 5612	5976	chrome.exe	94
PID 5976 wrote to memory of 4580	5976	chrome.exe	95
PID 5976 wrote to memory of 4580	5976	chrome.exe	95
PID 5976 wrote to memory of 5160	5976	chrome.exe	96
PID 5976 wrote to memory of 5160	5976	chrome.exe	96
PID 5976 wrote to memory of 2980	5976	chrome.exe	97
PID 5976 wrote to memory of 2980	5976	chrome.exe	97
PID 5976 wrote to memory of 5712	5976	chrome.exe	98
PID 5976 wrote to memory of 5712	5976	chrome.exe	98
PID 5976 wrote to memory of 2528	5976	chrome.exe	99
PID 5976 wrote to memory of 2528	5976	chrome.exe	99
PID 5976 wrote to memory of 2232	5976	chrome.exe	100
PID 5976 wrote to memory of 2812	5976	chrome.exe	102
PID 5976 wrote to memory of 2812	5976	chrome.exe	102
PID 5976 wrote to memory of 2776	5976	chrome.exe	103
PID 5976 wrote to memory of 2776	5976	chrome.exe	103
PID 5976 wrote to memory of 4416	5976	chrome.exe	107
PID 5976 wrote to memory of 5572	5976	chrome.exe	106
PID 5976 wrote to memory of 4416	5976	chrome.exe	107
PID 5976 wrote to memory of 5572	5976	chrome.exe	106
PID 5976 wrote to memory of 4444	5976	chrome.exe	109
PID 5976 wrote to memory of 4188	5976	chrome.exe	110
PID 5976 wrote to memory of 4444	5976	chrome.exe	109
PID 5976 wrote to memory of 4188	5976	chrome.exe	110
PID 5976 wrote to memory of 1996	5976	chrome.exe	111
PID 5976 wrote to memory of 1996	5976	chrome.exe	111
PID 5976 wrote to memory of 2164	5976	chrome.exe	113
PID 5976 wrote to memory of 2164	5976	chrome.exe	113
PID 5976 wrote to memory of 4184	5976	chrome.exe	114
PID 5976 wrote to memory of 4184	5976	chrome.exe	114
PID 5976 wrote to memory of 2012	5976	chrome.exe	115
PID 5976 wrote to memory of 2012	5976	chrome.exe	115
PID 5976 wrote to memory of 2028	5976	chrome.exe	116
PID 5976 wrote to memory of 2028	5976	chrome.exe	116
PID 5976 wrote to memory of 5752	5976	chrome.exe	117
PID 5976 wrote to memory of 5752	5976	chrome.exe	117
PID 5976 wrote to memory of 2508	5976	chrome.exe	119
PID 5976 wrote to memory of 2508	5976	chrome.exe	119
PID 5976 wrote to memory of 5024	5976	chrome.exe	120
PID 5976 wrote to memory of 5024	5976	chrome.exe	120
PID 5976 wrote to memory of 4700	5976	chrome.exe	122
PID 5976 wrote to memory of 4100	5976	chrome.exe	123
PID 5976 wrote to memory of 3092	5976	chrome.exe	124
PID 5976 wrote to memory of 4608	5976	chrome.exe	135
PID 5976 wrote to memory of 920	5976	chrome.exe	136
PID 5976 wrote to memory of 920	5976	chrome.exe	136

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\bin.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb4,0x134,0x7ff8b80ac728,0x7ff8b80ac734,0x7ff8b80ac740
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,9054563631808602304,18021603562397006968,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,473692359169548341,17274438057669327856,262144 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,1556170306969087224,6480177219926293106,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,11120150739624690558,18085890050629101211,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,9626178355463120956,6180860317974963340,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,588881791623447856,7380426252050710246,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,9111581080365746547,7772541217673543647,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4972,i,11116566888854942454,662024153113148970,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,11569358540530318117,12205174468979702382,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3624,i,8751478576548931001,6924226071117879572,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3596,i,5749454637390368017,10116920700495087977,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5708,i,8884016308064229048,4867839128985629867,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3964,i,13110674914873880601,7095503875190348848,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4180,i,1071344813819248681,15271509383153498187,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5692,i,604471450985910968,16149375285226677653,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6004,i,18330262410895167873,1949192169792537880,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5816,i,12847632438476400981,9302286329468805935,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6016,i,12717312028277773198,8038399241865876838,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,17522171138974961335,15443456658290089473,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3964,i,1169979539471087791,5893265546471665671,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,11770272638766574928,4366984884099598621,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5852,i,12970908215767425630,7121440008496960284,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6008,i,4240709209803320546,12937258958757539508,2097152 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:9
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,3494067041876136815,1239732013578493292,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,13271455244167844354,4806599237749845723,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,10830790160656289936,12030774730826556073,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3636,i,9580165194075475181,17512712999962198658,262144 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,3656341877371015503,3040351366500961409,524288 --field-trial-handle=1932,i,14680862646197372595,16986793218997615181,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2628

C:\Users\Admin\Desktop\bin\detectedstockkdmapper.exe
"C:\Users\Admin\Desktop\bin\detectedstockkdmapper.exe" C:\Users\Admin\Desktop\bin\GhostDriver.sys
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
PID:5848

C:\Users\Admin\Desktop\bin\GhostFN.exe
"C:\Users\Admin\Desktop\bin\GhostFN.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4700

C:\Users\Admin\Desktop\bin\GhostClient.exe
"C:\Users\Admin\Desktop\bin\GhostClient.exe" C:\Users\Admin\Desktop\bin\GhostDriver.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Users\Admin\Desktop\bin\GhostFN.exe
"C:\Users\Admin\Desktop\bin\GhostFN.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6044

C:\Users\Admin\Desktop\bin\detectedstockkdmapper.exe
"C:\Users\Admin\Desktop\bin\detectedstockkdmapper.exe" C:\Users\Admin\Desktop\bin\GhostDriver.sys
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 4f418a9cfe25554c40304ad9b4a4152351e7cd5ca61a0cbc708487d638a2ab6d
MD5 83b854cbd852d6b495cdf880efc60231
SHA1 e070aaa4cfb3ed0941254ac57634a077129b6082
SHA512 b9b4997fe9055573881eea589ce0809f8a64bdcf7075632e0dd4c253cb96bddb88115063773bfce07b3d0451ddb816add63fc0a3bae09ab0375926fca71ba578
TLSH
T1A9112409A19FF327CB66AD321CA058943DC00B2B0A10003937A19BA8718007012DBFD6
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 75da98746a19c7b2f0432e21f9b1e3fec1ac49cab2a1933083720cb07d392118
MD5 dcb78b0c7fbb66592cb811567ff4cf68
SHA1 15c3f83fccb1cbe00e99d2840a53f01023b4e086
SHA512 6dba9e770e220245a3bcae09a7d989ce3a8e3663c05de2f9e226764cef9db180b075d273f7408b7f0fcbe9df945c5796ae1192c16023853c65419b5e2b393f0c
SSDEEP 192:DYmJStc3QJxPJQzmqbh1YIaIoCiQ9XaPPvqfPYNPO9K:DYmJStc3QJxPJQzmyh1YIaIoCiQ9XaXT
TLSH
T1A5E190F7C3D8C52D880166F8AB156F1FCE391A18822D3D66C8D8BE5B93E2871D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fc75792f8b2213bb51a6ebd854b1f03166f0960a0c1366e911982450c6b9f3f4
MD5 3a1822981743eb434768d9b11a31a4d4
SHA1 bda889aa1ab821ef0001e9e39f0afa2040790553
SHA512 9b834df1aaf9f9d7c683766ef440cc61c35209aa2c40f07e8194f097a4ddeea8f9a6da8807036f69f6a6552281d194e1f88dcef0071f46dce0f66ed3bb17a323
SSDEEP 192:9RHcBz6APbHv7cAPRp2x6P9EHsb+WNnqZ4uN2qXKDr6gkwUVyIsnAUge:9RHmz6SjJXzmwAv2qKwe
TLSH
T17742862EBD146A3B6DCFC21AFA65BB53D3F5102161942E88EBFC8A2C10E75DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dd166aa1e635bb347ecc6c568fe02b123d58e59ec18ba87ca6ff903b8aada7b1
MD5 e270a288ea228e9101e7e953d32bedcf
SHA1 e73f58621b88edd344bc2c8abdfbdb9154778da0
SHA512 9c67bcf2da129628e4fa3936c436db77395f03836f111f454a10f67bc3f90a968855ee3630811cb6790eccf46efaa88481d5c38fa5231c96b90924deeba922bf
SSDEEP 192:9RocBz6APbHv7cAPRp2x6P9EHsb+WNnqZ4uN2qVLKDr6gkwiVyIsnAUgE:9Romz6SjJXzmwAv2qsCE
TLSH
T1BA42862EBD146A3B6DCFD21AFA25BB53E3F5102161942E88E7FC8A2C10E75DC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af66d6509b410bd8d008464e1fa08870c57689f6b993ebc3182d01e27f69d623
MD5 bb843014cf012648ec3ba003e55e07ca
SHA1 94d5f9aaddfbd9e1039ebf51d11babf8976bda38
SHA512 8ac6b0005f67af1a7cd0ecbb803052dfb956dc5fa108c248f5db340d61753cc6e16b8747043121be4018b163411c71911e47f5c5c0cb42562231aeacf47faf97
SSDEEP 192:9RocBz6APbHv7cHPRpDx6P9EHsb+WNnqZ4uN2qqgKDr6gkwAVyIsnAUgE:9Romz6SjEXamwAv2qOkE
TLSH
T18A42972EBD106A3B6DCBD22AFA65BB53D3F5102165942E88E7FC8A2C10E75DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8d01299016ddfe6050a438bf2465c0a66a186578c5a6a574ae0243f2f3100d11
MD5 a87b5a1242c51537d3f43efca13a19c5
SHA1 5291b7f9d1ea72c93f9823f374297fcee0fad0a6
SHA512 a6e1b5376f8fa80a8160ba5470508006cde856559b69dbdb5905774fba9151750bd9e27069e85ca7c5e8c908b7c920c1a11ec2c5e2203f08836006102d8a5bd2
TLSH
T1B8A0026129441226D90846B2588281A572288D1457C143057094405499581654571E80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 31ab39eec1baf3e96e12f95306cc430ac2169170a6b497536a72efe4e3f261c5
MD5 380dfdb6762c8b0f6424b1bfa50616cc
SHA1 782e5833c1ad4a365140e190a4994862299db1ec
SHA512 290607094f60c34e6743a7a7e8a896c41a85093ea927540fec9a1bc48d5cb8a4935e179fbd9607d266102822ed3c1216b203cbbde5d83c8f8eb1bf850db8be84
TLSH
T15FA0022041C16A52CD285674B06125813295DA1656914313B9D11D44CE9B5C45246280
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6ce4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a6ce4.TMP
Size 48B
SHA256 644bb7a0baea27baecf1a7c5ac0cc67875985c4583117f7dfd1e74b2a29996aa
MD5 8859ba2684bd49ddf6a9efcb1b25e2d4
SHA1 be32ed2ade2a6be64b7f6202212427761608ee26
SHA512 45b1e5d7f0e2e8509bb35db90bef191056bb3a8512173867b33d38539896118863f962636edcf4cc5bc0d8f41caf2bf89ea093c6749e976c0bcb7c084fa5d83b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 dc905646d3c939b490cd77eb6867674064310bb679e43ed47b66d47456cc0397
MD5 8d7a9b2efeb2be35c00da3b06ba9ce36
SHA1 2efb4404f381ed4c2f1e8f76e06ea4a20c70e05c
SHA512 a1bebab78d8b0f6538d646be45057a53d9a3894ec48c068e1fd85f86d8940fd7d42ae350018ccfd15aba6fa7f9bc9f27c08470a02a938815d3baca1883c9ef14
SSDEEP 3072:rNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE7:rKK692ILxkFOol2WGMbrMZM7
TLSH
T194C312FF44AA994138689C45E1191F913C24B10B9FD4347C86F83AFA29A90C0F712FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 f5eb1f2c2091e5edaceb4000519a5a972f344febf783f255c1539de6a216f016
MD5 9541203701db7aa38db62147086b32b5
SHA1 89de27eb8d3322baa856b22d8a0c84cddaf40b33
SHA512 2c351f75b59e7fb3667395489588860323ceadf2917da83c690dc4cc3e5c513c44fdf741e5f3f8ba9d2f10e4c246a28e19f6d4302c55794059b926f34329579c
SSDEEP 3072:fNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE7:fKK692ILxkFOol2WGMbrMZM7
TLSH
T190C312FF44AA994539689C45E1191F913C24B14B9FD4347C86F83AFA29A90C0F712FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f9053e0e62717451e1812f5bdbe05d433334ed1447533cf086e2c321563a90bf
MD5 c5bd59d36e7c3ce2de0cb0152b36e4df
SHA1 47e5d02fe626b6ab65044a74e974c3b2c67e2e98
SHA512 e12ff3e2b60754b7a4404514fdbe7e9015743cc26b2f6ae3970774795d764faa0955b58d53448d66ded7012cb8e2aa6d79668118358e99a82bd6fbb6938dcccb
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5XlDV3B60GyvnnXXlbKmb0v4a:xC0PtbKFKu00UUSb/iDUD9rECXXlbK7
TLSH
T12FA12B72A4698D735976D54AB9622E03CF75E12BEE229F54D9DD0F0C00F70E80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 240375ff247c2ea1d1f2c2bcec434c559593a683046e1688a88275b248b51f2e
MD5 2cd4b2ce6287c7bc751363aa2de040c3
SHA1 e6364a8c3aac0a909aabaa60b4de42ba869ade54
SHA512 62d0cfef41b2460d67a51eb04c48f1f6468583c21bc77aeabd4bc4f40ca5721b9f091f0351110dc265e305ac5792ca722f768c5d07905393555a7f89139cb599
SSDEEP 3072:sJNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE7:sJKK692ILxkFOol2WGMbrMZM7
TLSH
T1B5C312EE84AA9A0134689C46F11E0FA57D2471079ED4347982FC75FA39E94C0B712BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 32d8ea914eb9a6b75ac97f5b0b4daf65f2ba5224cf7dd84773ed18a28601c8f0
MD5 9d8cbaca00ce23fb351cae577a16cfa7
SHA1 cc9f2537d8a5563f75ca7bb5576e9c20f1c6c1c5
SHA512 1b0931b7e3c039b0c0235eca687f48ab06016b5e160f13d30f41db019ab0ec19681f4973b435f6f5ba1b0bc638dcccb41790299ac8d2d647d3334b3f3e4022d5
SSDEEP 3072:zJNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE7:zJKK692ILxkFOol2WGMbrMZM7
TLSH
T1FBC312EE84AA9A0134689C46F11E0FA57D2471079ED4347982FC75FA39E94C0B712BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5976_380459284\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

GhostClient.exe

Path C:\Users\Admin\Desktop\bin\GhostClient.exe
Size 147KB
SHA256 462f63c1cb9ce81b2945be3cdc16108f4b950bf3d5a51b09b702d24cf9dd7563
MD5 4c75406ed987d30eff2a732d62bfc981
SHA1 a41ba91f09bb3e4a7bd9763ad8d79144690f581b
SHA512 6d2435941cc84a31ab90edf09576b98ce9b0b9b88e4023b253cd59added083aca3ec50554f273c9fbab474630ac302ba23880c5685e99f8d34da8bad4ef88dc4
SSDEEP 3072:BGRtTTNEMWiPIJ+S15rq2GLp6Dnp5okLCnHr2FY7jHV:BWEMWiPIJ+i5r26bP2Cy7j1
TLSH
T1B5E34B57B2E530FAE077823889611646F776783603609BEF43A443762F276D49D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GhostFN.exe

Path C:\Users\Admin\Desktop\bin\GhostFN.exe
Size 933KB
SHA256 7c7c8f24fee17d65f6e600a93b71785ff23741a179df38565fab05f3ff636ba3
MD5 72370e2db9f4f1dc301714ee47cb513a
SHA1 61a4f95e9c86db5836271cca8333c4bc36222828
SHA512 4db524f32f930ea6f0cf3f39b468cc7816be3684bde7731cf0fc4ede7c1c9f146888c3a71012f2e27a29f4463f63d0d4701bf212f543cfb06b788437a1c48905
SSDEEP 24576:HWvKWVTMkRc061Q1DSoSIO2JsLiyn4lKr:Hlsvi061Q1DS7sJs2ynV
TLSH
T11B158D89F3E901E8E0779538D9B5A21BE63678551B308ACF03D4065D6F737E04AB7B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140D.dll

Path C:\Users\Admin\Desktop\bin\VCRUNTIME140D.dll
Size 128KB
SHA256 a77277af540d411ae33d371cc6f54d7b0a1937e0c14db7666d32c22fc5dca9c0
MD5 f57fb935a9a76e151229f547c2204bba
SHA1 4021b804469816c3136b40c4ceb44c8d60ed15f5
SHA512 cd9fc3fc460eba6a1b9f984b794940d28705ecb738df8595c2341abe4347141db14a9ff637c9f902e8742f5c48bbb61da7d5e231cc5b2bad2e8746c5a3e3e6ed
SSDEEP 1536:QB6NlnzaWMj6FBknM+eHLEQE9gHAWdwfP5sd4Sohg7vMHvqZecb399R0BqZEBFP:QBYl5MOcM1HAb1wM0ecb39/0BqZEjP
TLSH
T116D3B34AFAB651F5C8B6C03489D7322BFAB07165833087DB97915A170F52BE4AE3D780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1D.dll

Path C:\Users\Admin\Desktop\bin\VCRUNTIME140_1D.dll
Size 58KB
SHA256 104e5817ece4831e9989d8937c8dfe55d581db6b5bc8e22a1b492ca872eda70e
MD5 868fd5f1ab2d50204c6b046fe172d4b8
SHA1 f2b43652ef62cba5f6f04f32f16b6b89819bc978
SHA512 402a0402b318539f26eac2fcd890700d2103f8eabd4b5289b64e2cdb5c30f4bb2b18f342c8a1ecc2cafb3f1d4258387a5300f9a86056f27b176b3fe995f9fc9d
SSDEEP 768:BoKFGMoBcNmO1Um5Y/tHvzvlurMiqWJ8XAG:+KcM3m05IHT+nyl
TLSH
T1DD43F74BEBB950D2C4BAC0349293BA2BFC7171A1437497C75355EA4A1F62BE4BA3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detectedstockkdmapper.exe

Path C:\Users\Admin\Desktop\bin\detectedstockkdmapper.exe
Size 1.1MB
SHA256 3b1df4dcbce035b561c3d6460fe8447a31115a233c0538f03835cc1411caf0f8
MD5 e00fd3955a05a6a0576ba3dbd3cad917
SHA1 4641ab5e7425995ddf0d39df368bdd17cf4ff1e0
SHA512 0c6e4aaaa242f4002d875b8202ce9cd66e1bba7173b52ef542b67ff863d4edba26115411eadcd0dda72079ec34581266dd09e422dac09aa19aa091e50965dec8
SSDEEP 6144:UluyeaeSuDPTIqmpIxhYgYLa8LIUktztEcBMoo4pWlT+1fMLGn:gjIPDPE412oWJIfl
TLSH
T15A358666A6A66594C07BC07CD542951AFD6034AA8738A2FF72C58EC12F907E8FF3C741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140d.dll

Path C:\Users\Admin\Desktop\bin\msvcp140d.dll
Size 977KB
SHA256 b53add5b7bd6bb11fecc7be159885d0b75736d02423c11edc6eeb6f4bea80f6c
MD5 37dc8cc78ecbcd12f27e665b70baefa7
SHA1 46fb9910cc10c4c0c52b547700e1950ce233be89
SHA512 078b0b408510c07eac85518f03a9e3fac8e4c8e2e36ccb8cd26962498c7f5bedbd79f7034af3ebfef9984f85d81c9032446b1b5c156b2174a769657ea0ab60a1
SSDEEP 24576:NWJjEJM48ZDBXci9fHQEKZm+jWodEEw9N2:NWJjd48rJw
TLSH
T1F725A607FB6A41E0C47AC179A192132AFEB17855873497C35296E71F2F227E4EA3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbased.dll

Path C:\Users\Admin\Desktop\bin\ucrtbased.dll
Size 1.7MB
SHA256 eee42eabc546e5aa760f8df7105fcf505abffcb9ec4bf54398436303e407a3f8
MD5 c3130cfb00549a5a92da60e7f79f5fc9
SHA1 56c2e8fb1af609525b0f732bb67b806bddab3752
SHA512 29bab5b441484bdfac9ec21cd4f0f7454af05bfd7d77f7d4662aeaeaa0d3e25439d52aa341958e7896701546b4a607d3c7a32715386c78b746dfae8529a70748
SSDEEP 24576:JUV0C8E3W4JoceLErS6P0qoc6uoPrT5PgVBHmaw+zrGOzli7Gi0m9ZRXyYk:i8/B90ozghlGJ7js
TLSH
T16185D706F6E710E5F5BAD239F5623126FC363895873CE6EB47905A5E0B30BE4993A700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-718-0x00007FF76FEC0000-0x00007FF770045000-memory.dmp

Download

memory/2956-724-0x00007FF76FEC0000-0x00007FF770045000-memory.dmp

Download

memory/5848-643-0x00007FF76FEC0000-0x00007FF770045000-memory.dmp

Download

memory/5848-560-0x00007FF76FEC0000-0x00007FF770045000-memory.dmp

Download