hxxp://ghosthub[.]cc

Resubmissions

07/08/2026, 11:51

260807-n1m6qadk616

07/08/2026, 11:45

260807-nw7dssvanc8

Analysis

user interaction
yes
max time kernel
208s
max time network
192s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ghosthub.cc
Sample260807-nw7dssvanc

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
54	3684	powershell.exe
54	3684	powershell.exe
108	3684	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5296	AutoIt3.exe
600	AutoIt3.exe
4520	AutoIt3.exe
3908	AutoIt3.exe
3568	AutoIt3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	href.li
30	href.li
31	href.li

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5296 set thread context of 600	5296	AutoIt3.exe	130
PID 4520 set thread context of 3908	4520	AutoIt3.exe	133

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4516	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305767726762303"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
3684	powershell.exe
3684	powershell.exe
3684	powershell.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
2716	chrome.exe
2716	chrome.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4404	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe
4404	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4404	taskmgr.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1724	2716	chrome.exe	88
PID 2716 wrote to memory of 2852	2716	chrome.exe	90
PID 2716 wrote to memory of 2852	2716	chrome.exe	90
PID 2716 wrote to memory of 4516	2716	chrome.exe	91
PID 2716 wrote to memory of 2340	2716	chrome.exe	92
PID 2716 wrote to memory of 2340	2716	chrome.exe	92
PID 2716 wrote to memory of 2764	2716	chrome.exe	93
PID 2716 wrote to memory of 4620	2716	chrome.exe	94
PID 2716 wrote to memory of 2764	2716	chrome.exe	93
PID 2716 wrote to memory of 4620	2716	chrome.exe	94
PID 2716 wrote to memory of 5476	2716	chrome.exe	96
PID 2716 wrote to memory of 5476	2716	chrome.exe	96
PID 2716 wrote to memory of 4880	2716	chrome.exe	97
PID 2716 wrote to memory of 5736	2716	chrome.exe	99
PID 2716 wrote to memory of 5736	2716	chrome.exe	99
PID 2716 wrote to memory of 3100	2716	chrome.exe	100
PID 2716 wrote to memory of 3100	2716	chrome.exe	100
PID 2716 wrote to memory of 824	2716	chrome.exe	103
PID 2716 wrote to memory of 824	2716	chrome.exe	103
PID 2716 wrote to memory of 4204	2716	chrome.exe	104
PID 2716 wrote to memory of 4204	2716	chrome.exe	104
PID 2716 wrote to memory of 3284	2716	chrome.exe	105
PID 2716 wrote to memory of 3284	2716	chrome.exe	105
PID 2716 wrote to memory of 5160	2716	chrome.exe	106
PID 2716 wrote to memory of 4080	2716	chrome.exe	107
PID 2716 wrote to memory of 5160	2716	chrome.exe	106
PID 2716 wrote to memory of 4080	2716	chrome.exe	107
PID 2716 wrote to memory of 6140	2716	chrome.exe	108
PID 2716 wrote to memory of 6140	2716	chrome.exe	108
PID 2716 wrote to memory of 2672	2716	chrome.exe	109
PID 2716 wrote to memory of 2672	2716	chrome.exe	109
PID 2716 wrote to memory of 5704	2716	chrome.exe	110
PID 2716 wrote to memory of 5704	2716	chrome.exe	110
PID 2716 wrote to memory of 5876	2716	chrome.exe	111
PID 2716 wrote to memory of 5876	2716	chrome.exe	111
PID 2716 wrote to memory of 2060	2716	chrome.exe	112
PID 2716 wrote to memory of 2060	2716	chrome.exe	112
PID 2716 wrote to memory of 4220	2716	chrome.exe	114
PID 2716 wrote to memory of 5564	2716	chrome.exe	115
PID 2716 wrote to memory of 4908	2716	chrome.exe	116
PID 2716 wrote to memory of 4152	2716	chrome.exe	120
PID 2716 wrote to memory of 4152	2716	chrome.exe	120
PID 2716 wrote to memory of 5168	2716	chrome.exe	122
PID 2716 wrote to memory of 5168	2716	chrome.exe	122
PID 2716 wrote to memory of 2988	2716	chrome.exe	123
PID 2716 wrote to memory of 2988	2716	chrome.exe	123
PID 2716 wrote to memory of 4204	2716	chrome.exe	124
PID 2716 wrote to memory of 4204	2716	chrome.exe	124
PID 2716 wrote to memory of 4616	2716	chrome.exe	125
PID 1596 wrote to memory of 5296	1596	Ghost.exe	129
PID 5296 wrote to memory of 600	5296	AutoIt3.exe	130
PID 5296 wrote to memory of 600	5296	AutoIt3.exe	130
PID 5296 wrote to memory of 600	5296	AutoIt3.exe	130
PID 568 wrote to memory of 4520	568	Ghost.exe	132
PID 4520 wrote to memory of 3908	4520	AutoIt3.exe	133
PID 4520 wrote to memory of 3908	4520	AutoIt3.exe	133
PID 4520 wrote to memory of 3908	4520	AutoIt3.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ghosthub.cc
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc8a95c728,0x7ffc8a95c734,0x7ffc8a95c740
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,3335804811846860787,15022273287131007446,262144 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,8899588015813562395,4735081479209058926,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,1204097430447915372,4908281265687466191,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,5491641370310728496,13156892557210957614,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,17508027585135424833,792708668498534792,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,12969615538931141333,9370178811961946348,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,7781184770779475363,16742655327948995132,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5420,i,16699870693874960734,10944609909970466197,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,1655064939207365402,5099755967821015262,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5744,i,3709767104232283545,882880201800647266,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6064,i,8149676996983647840,8782727617660780643,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6068,i,6436873603275682094,10983075585017082436,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6280,i,10500880357758459471,15794879782352585051,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6312,i,11955588695039687470,14539768053767059203,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5712,i,6642193329442467885,3057758611447284271,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4700,i,11592683851965486019,9332549518982887013,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6212,i,7620983318839727901,12542055249439011646,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5644,i,9905521869048420068,6737480785440560534,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5640,i,11610336025487687915,7243694823242710822,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,15174879249964810329,17615084545730954922,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,13596063358109265395,13204751353870292034,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,971604943441234951,6497465313944149247,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4728,i,11791895332416009650,12088338428636824895,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6256,i,2238532067808161323,18001703321413189052,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6020,i,7998766031448645886,1135564652837166908,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4680,i,12360214315340119493,10187714605115534769,2097152 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6856,i,14082336243156647947,17595903468357334769,524288 --field-trial-handle=1864,i,192266599219812684,13827689529253951188,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:4616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3184

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:600

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:3908

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
"C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Committees.a3x
1⤵
- Executes dropped EXE
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 cab39ec6f4eb63d064c26cff4d6b8280dafd6cdf860f324d588a5b48e9a4004b
MD5 54f91bccd4e156eea9e77ab5636c095d
SHA1 c26344a294afc1f85144197baab316e80094e0a4
SHA512 04d1f4d3c8a8a86b933b604aabb3ec320ef3a2bf2d504956730fba8a67135c6ed9ca42db4fcceaa442433ed2683209381f81a31bd00baa75b1158f4b5444c09e
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 40KB
SHA256 1631e9a80d796dda2eea7f39a81cdb3d00212975d8798510db7084a3866963da
MD5 09a27265028f4cb3b0a5f5381e853236
SHA1 83799fc9645067ccbfd71d8e281e2156abe2ea46
SHA512 f2cd0b8df1708ccff8df7f476be128aaff490c1f5538231eaf7f80ed6d6fea85d1302dc5a2a6b2cbd8888a9ba9c1058aa1c65eca563be7e9445a756b5f0f56a7
SSDEEP 768:diLnUaemXBpyLNSFQaWN0HSZGRBiAXwwRM0jqxPMNNn35STy5f9wT5qZ:0YgXBpyL4yN0HSqXpRyxE75wy5OY
TLSH
T181139C996D99CAFE733AB74D0A78B8C95C001F3AF7C10EDAD4EF2B6C040B9914945A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 28KB
SHA256 2c4fb42a00d9c5524269e98366d45f074a6a0a85a2905e8290d09aa2c9ada92d
MD5 a026b6068f8693b3b19c1d96b86eae0d
SHA1 9852386ff3881f57f26fb9e119bafbc61637f932
SHA512 ca400322ccabc0b8bbbd321b1d345f6109f7eaf88ecee0dcf4e57d65332817055e42b0819c6aeb91b63777c867b75f55e3cd4f6d9cecb775822468346cf590a9
SSDEEP 768:ARi6yGBG4WVW2STbuCRyc+KZVt1qlFrtU+R0:ART/SsaUrtZ5ktU+R0
TLSH
T14BD2CF4AB4FFC5588DEA4ADFD88D8A5C8E763306CA9637D53F80F0CB1689440519ADE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 a6a2ef1857e559b3be9592c93c83ccafc034a92d014b001d42e947135e9952fc
MD5 c25bd4357c3ee9114bd7677b0fe7c861
SHA1 59cf89316766ea6579776f9342986e83c38e561a
SHA512 2cbbf48ae3bb39d5638528dad124cf9c21ad28cc0e26d5232aefc91caf92b4176bc96cd02f4e1e1ea2260e2d3830616107ff2372fdc76acc7325d6e49f67991c
TLSH
T170F05CC1B060F074DF843BF525E51801313404D75A6B7E1F53E59CF0FD012011162E85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 366f948e01894c93ec622108fde479f42cbd5d7a1d96a1e34fae019d007d89e9
MD5 231ca609c7c3bb1f28a4138f90df6455
SHA1 e0052f1ebcfacd200a2f4a047b30b486d3b5401a
SHA512 3002ef5f3207bb751a36fb0990fe6a8605c1e5fe2ed642ebb88169409843b9833412fb0cd4a43d43213c709444e0b1dcf2808e28608d50db8263daf3e2e2d5f9
TLSH
T174F052C2A060F034DF9A3BB126E71802313441D39A6BBE1F93E9ACF0FD013000162E8A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 b399f87f36980b0a65b69a5e0f38ed49ca2d237c11477029af4ecf269b922d10
MD5 3af30fecad448872aa8c42c08d81d956
SHA1 6f128281035967b9a2ef3bd6b7422654dacdf024
SHA512 9fb6c46b2b47a8d6115383cfce708a3a7fd435025fae9b0f7660fef0e16a8e6fe74538d762706c63c14252582408430beae844664ce3b6f400949c97aaedc038
TLSH
T140D0A91020A2F071CB940B7131E92441323805872AABBE1BB3B21CB0CC927405162A8A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c35bdd3ec7cdf749c5c64ca80fd811ba8010b56ae7406278d8ddaec3c55ccda7
MD5 c0ef6406e12a7d619e86cf4a8d97b05c
SHA1 5d10165d70d68277c04e3a28197ea8473cf5c6be
SHA512 32bd58c282152a8c52307426f17305cfb709398d7153ad54095fcf7c6ba90b1ac8fb0f48d7aff0b91d81f2e9a0c0f679e0d170374b39bf5944e6f09bcfdd3bd1
SSDEEP 3:MsEllllkEthXllkl2zESgym1:/M/xT02zqB1
TLSH
T19F4402057BC05825D9401030401583510B60D45A06119B53295148229C869800C00800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 af8a7c26cd7b910e6db753897dde337b1163f7732c5ce85dadfa6c7cc492d0b8
MD5 e0250fcf998c6eaedde3d74d07bd5a72
SHA1 81a91a0367d31dfba351f6f7b0fa0b3203f6a60f
SHA512 1a8bb834d10ee74e5d9eb1108b89f03aa907527c7e166210cb725401eed537fdd57ba5df19ee9037150f4fcc27dd429e7359f3835d806968ca13a4903c05982f
SSDEEP 192:DaxXsb9KiWe6etk0GPRXHxfFt/sCbHQohY+Y7L6lxvZF54srgJQb4VLib:DaxXsb9KiWe6etk0GPRXHxNt/sCbHQoJ
TLSH
T16A228CF7C3E5DA2E891156F497106E1BCE1D0A19432C3C26C8E5EE8BE3E2472E15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 19855ffe1f4663a5b3becdc78a38a77b5ff86e33647c2697f0b59efb3d86c162
MD5 31257b1a1e3ad6cc1acf39c298859a4d
SHA1 67f1c389c7147f6d8493068a911eaa37d41e63a8
SHA512 dfcb37d2cfda5161a9ae19b2faaf1e877a8c1130d55936e4e41986691271537d2706701c9d57b30eac42be8eb228c964f96e6fd72733d9b6663da5ce828dece1
SSDEEP 384:DaxXsb9KiWe6ec4Wk0GPRXHxNt/sCVKhY+Y7L6lxvZF54srgJQb4VRJYOfYHIcK6:XJ/1WIhY
TLSH
T12D429CF3C3E5D62E891156F4AB146E1BCE1D0A19432C3C26C8E5EE4BE3E2472E15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2c250e4f8afc73865304da33a3f78e78877f30cfd1b374206f65317555b3e537
MD5 0af6d43f18a6dce60c95c37fc392580b
SHA1 519808bcfeae46f00f7034d0ba5834bfdc7de4b6
SHA512 1aa4177f4ba98ea43f869c793040b123e351af56e0cf5892373226db48c030562b20b3bdae1613737b726cae906daf2c644857874b7e3befd882e3e67d130aaa
TLSH
T14E319B67D67FB86B603858BF1E05B80A9977B431068268F4CFA6C1BCA0C15F30B13853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 466efb5104b1bcaa5547c5968e9011eba89414c069c006c56aa1763489095e22
MD5 8fddc797e7da38c0f90f85d861559e18
SHA1 aed1655d53262ada958c081a9fd0bda1edd73202
SHA512 96cef511296cae960ccc9bc149b2778add1979a52ebd645c80d7e4ed410d194d12f02fd1b0309d3523eddcb3e55ed128eb58a871606187ef6bee7e0a03e7de4d
SSDEEP 192:7RXWfd4Mv7KvAPRp2uj9NLHsb+WNnhAX8ypeit2Nvoewf8yIsnAUge:7RXWqYu6Xz3wu/e+2NvGke
TLSH
T1FC42C92EBA10793B6ECFD619F9257B53DBF9102125A52E80E6FC992C15E76CC312700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b3104b99975234e87141924e458a2ca36bb1c7da603349eb02fe7046514b3cb7
MD5 6241225356a67f7044461ccc5f9457f7
SHA1 afd03e051d1be25c09904ec7da8cc505b1892e9f
SHA512 5ce894e8a5320d2b7010a7bea06d50a4417e9694393e52d8e3a92fdea6eeab03ed2737d9ea69139c31edee5619565e478aca96146ede76e2da1176132f9dee9c
SSDEEP 192:7RXWfd4Mv7KvRPRp12C5O9NLHsb+WNtFKXhAX8ypFxW2et2Nvoewv8yIsnAUgE:7RXWqYuBXY3wtn/m2C2NvG0E
TLSH
T18D52D86EBA20297BAEDBD629F8217B57DBF9102165D02E84F6FC992C15D76CC311300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6277c69152dac746c7c0f45f25b4d5b060a258cfe8b402d1b649c0066e0f6407
MD5 8681c3b62f9a5c95bc41dc918744b375
SHA1 201ae1870fe2c81ee2de38b1eeef738b1c0bdc61
SHA512 f67cbdb0e9bcf60cd2cccb9f4b4a6591df5dd18bf8e11e18af36c3611278ebd98fd96f4c02ce2cdcb947b9c393bc90a0e99d6eacc8825ef2e12642c0883d1570
SSDEEP 192:7RXWfd4ov7KvAPRp2uv9NLHsb+WNnhAX8Lg27t2NvoewfVyIsnAUgR:7RXWq0u6X/3wu/2p2NvG5R
TLSH
T1F932C92EBA1068376EDBD619F9217B53DBF9102125E52E84E6FC992C15E76CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 81b57e3a6bf17bd1a4c0da1182d84508a8dcdc20f38ec32a6327647a3948c9b4
MD5 f156b61111319d7b5984fba20c1a7a38
SHA1 e67e41dc788fb6ff0d60fd46cd86cae76fd053a5
SHA512 b8fa76113c597865c653cf549ec813193b7e3c63591acf46e85dd5585af2f5ea417e8338c8c7f4730491cc866b255c7623f95820cae4789015936cf35aeadcd9
SSDEEP 192:7RRWfdYMv7KvRPRp1g4Wv5ryg9NLHsb+WNtFA2rSXhAX8ypFzw2gt2Nvoewv8yI4:7RRWaYuBXg3wtl/y242NvG0E
TLSH
T1F862D96AAA20297BAEDBC629F825BB57D7F9102564D02E84F7FC892C15D77CC311340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 22d3c680bd59c1752109f7d1ecf85c3a8eebf600b52605b632fad7f2256a00c3
MD5 62fca3c501f0fa1aca7961914a5e80ee
SHA1 f10afbd6359e1efbba02304c96bf0090f4ad1fb3
SHA512 43d99f7e7f01e986dce1f2355748cf2d062a30886b9452b5430646732cf3470d8ea437608d6f76dbf1d73d82721c70fa6b4a8d744b7868094cb925370ecac7d2
SSDEEP 192:7RRMfdYMv7KvRPRp1g4Wv5ryg9NLHsb+WNtFA2rSMV3jhAX8ypFzw2Bt2Nvoewex:7RRMaYuBXg3wt8/y2r2NvGPE
TLSH
T1ED62C66AAA20297BAEDAC629F825B757E7F9202554D02E80F7FC8D2C15D77DC311340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3bc26fa9c4eee459c5b3686707cf1d1a22f5d9e3db5b74791f5ad42ce35f60c1
MD5 9815970a5bbe2871980240bd72f12c1c
SHA1 8b1b87f3a90521ea1d02832359d646a75e0feff4
SHA512 fee4ee2ee5f3a8a287493c818e21a86602c1343272c28b13d279a951773a4f59b960a8c09ab04d5dc99348ad99cb6e7d89951b32cf509398e98643601fc34dd5
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYdtOSl8h4otop5mMTDRB68GGfvUgIlG1QzbOQhEfkt0K:ht0qDHUgvIdaiU2mSnlvBIlTLhEfktUw
TLSH
T1F5C11875B46DAD7359B2E956F4132A43CEFA606F99127E90C6DA0F0C02D75EC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a9af7ec69551dad82d01d35dbd54265a600089ee4c1e2efe643e87c94a95f6ce
MD5 49a4f1936a177a1ab3889bd71050f326
SHA1 4793608aadb171ce1627d4d3f962659a75bb8245
SHA512 dab6c03735943d28fc99de5c61dd331e1c98d59c9ed7faf6706993408bd180506b71d3e67151bb174817ce06fd24ad775e9bf791dcd6fb83fa19e653605656f3
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYdtOSl8h4otop5mMuDRB68GGwvUgkKfkERNC39ISyVND:ht0qDHUgvIdaiU2mhnlvekKfkEuCzR
TLSH
T1B6C1E775A42D5DB74DF6E845F1132D83CDB9606BAD25BE58E9EA0E0C01E34DC1383663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f63866bcfef5dc5b090b65f1aab436c86805a76a76ab3144177191dc763e3b9e
MD5 5a0a63204c56e804a0eac9cda4718386
SHA1 8c0a2efdaf783e497f79f86e195378ddb77ffd6a
SHA512 60195a40ea1a40222fc71bf83ddff70329ecae888a318a09200d2c75ea1903373690eaf4f5af5289c59242eacdb008108fda7d3d6f2f82235045621b51aa8889
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5mMqDRB6WGyvUU+ksbL/Mmv4a:BC0qDHUgvIdaDUDmRnCI+ksbL/N
TLSH
T167A12932A42D4DB35A76D909F8262E43DEB8602BE922BE84D9DE0E0C11F70EC1343653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 588b0dc893d43730f0d24f69fa1dda830975923e8a12f8d2988b82bc312fc5a6
MD5 8be2643bbbeb2a9999c4a83dc111ef4f
SHA1 e35972b4a7794b1fc533641b84c49ba866d07a8d
SHA512 d9b3eb7dd287a1bc48f4f9054090040b264429194a9ad05c0b385a3faf870866ac50d6dbff392a937c7478684470baecb21655145d7fbd809ef5149192d27dde
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYdtOSl8h4otop5mMcDRB68GGfvUgkKfkERNC39ISyVND:ht0qDHUgvIdaiU2mvnlvBkKfkEuCzR
TLSH
T1C3C1E775A42D5DB74DF6E845F1132D83CDB9606BAD25BE58E9EA0E0C01E34DC1383663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f0c9a55b8e125aeecf62cb17fd4edd409adf6cc702f85ae4357067181d2465f0
MD5 ce96d3f1b038642143b5b5948fb1b2e1
SHA1 b8d2741367a0dd6bd668ab840b09c7eb526e5971
SHA512 d765025adbae3ab838c5cb7116fc235e73d1eb76b0b4b718872942fe2320396a56895901e13f012f078881b96ea0fd674eec8599a55f957348b56eea2dee8641
SSDEEP 96:hC0d+hDK+UyKovbfaNQYdtOSl8h4otop5mM6DRB6OGyvUgIlG1QzbOQhEfkt0j9w:hC0qDHUgvIdaiU2mVnOsIlTLhEfktUw
TLSH
T1A6C11875B46DAD7359B2D916F4132A43CEFA606B9D127E90CADA0F0C02D71EC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d2bf87dba2f867fbac33e6ca3bb9318689576fab7aba63611fc9145f315d343e
MD5 ce084f70c655e1a22c7b04f6e0ff7ca1
SHA1 8f16fd0450b613517d0327484b2989b01308bd8c
SHA512 4b6a7548e48ab7704ce2ecd7fa04241f742c86d86139974bbed3a4b95d3417399459876cf4976a0564deed6be970c07654d8eb2ac82527537c36e7c4847e0da8
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYdtOSl8h4otok5mMDDRB68GGwvUgkJfkERNC39ISMVxE:ht0qDHUgvIdaiUDm+nlvekJfkEu8x9aB
TLSH
T129C1D7B1A42D5CA74DB6E849F0132D83CDE9606BAD21BE58E9EA1E0C01E34DC1393663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Committees.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Committees.a3x
Size 1.1MB
SHA256 6d6980639bb20c551c762bb145d8615dd7aa092f64e9ba56bb464acbc7d28f90
MD5 a94c25fcb7f258495ad9c07800e49322
SHA1 22b3731ea89c018c27a7f9a714a2ea09ba6a9547
SHA512 6fee6b9e48d61b5fc4f392d4badb9a35ac6fb72a8ac6e4418b396b88bc048a298a998fa3c38ede73521114f0b478cca19954f1c379c815ccbe00d0ef45bdadc5
SSDEEP 24576:UR4wdS47w6960Yt39WQzZ8G2DsLne7HBPrpOSqfQJa/bqySW+v:Um6w6I0E9WQlq+0hISGbbqySzv
TLSH
T1403533058BEB11B5EF55BC0BB51757AF1C640A69FC60A09B7E98432CC4EDF8E44B289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/600-629-0x0000021D80380000-0x0000021D803D2000-memory.dmp

Download

memory/600-630-0x0000021D80380000-0x0000021D803D2000-memory.dmp

Download

memory/3684-307-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/3684-318-0x0000000007F60000-0x00000000085DC000-memory.dmp

Download

memory/3684-305-0x00000000746B2000-0x00000000746B3000-memory.dmp

Download

memory/3684-306-0x0000000005340000-0x0000000005376000-memory.dmp

Download

memory/3684-309-0x0000000005A50000-0x000000000609A000-memory.dmp

Download

memory/3684-308-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/3684-310-0x00000000060A0000-0x00000000060C2000-memory.dmp

Download

memory/3684-333-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/3684-452-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/3684-323-0x00000000746B2000-0x00000000746B3000-memory.dmp

Download

memory/3684-312-0x00000000061B0000-0x0000000006216000-memory.dmp

Download

memory/3684-311-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/3684-319-0x0000000006C80000-0x0000000006C9A000-memory.dmp

Download

memory/3684-315-0x0000000006220000-0x000000000657B000-memory.dmp

Download

memory/3684-317-0x0000000006740000-0x000000000678C000-memory.dmp

Download

memory/3684-316-0x0000000006700000-0x000000000671E000-memory.dmp

Download

memory/3908-643-0x0000021663390000-0x00000216633E2000-memory.dmp

Download

memory/4404-332-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-322-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-320-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-330-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-329-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-327-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-328-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4404-331-0x0000024359680000-0x0000024359681000-memory.dmp

Download

memory/4520-639-0x00007FFCA2020000-0x00007FFCA2283000-memory.dmp

Download

memory/5296-626-0x00007FFCA2020000-0x00007FFCA2283000-memory.dmp

Download

memory/5296-628-0x000001B024E50000-0x000001B024E51000-memory.dmp

Download