hxxps://cdn[.]discordapp[.]com/attachments/1524149327453487296/1524149432759615630/Ghost_Temp[.]exe?ex=6a4eb246&is=6a4d60c6&hm=8a113a2bff831de8b9d9580fdc2d4ae150b4ff5b0c5f22a8d87ed5d25d595c2f&

Analysis

max time kernel
300s
max time network
294s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1524149327453487296/1524149432759615630/Ghost_Temp.exe?ex=6a4eb246&is=6a4d60c6&hm=8a113a2bff831de8b9d9580fdc2d4ae150b4ff5b0c5f22a8d87ed5d25d595c2f&
Sample260708-aggmyags9v

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	1168	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1168	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279430666892805"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{C20BC2AB-F65C-4E82-9180-EF9F85130177}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
408	msedge.exe
408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4988	1380	msedge.exe	87
PID 1380 wrote to memory of 3024	1380	msedge.exe	88
PID 1380 wrote to memory of 1168	1380	msedge.exe	89
PID 1380 wrote to memory of 3024	1380	msedge.exe	88
PID 1380 wrote to memory of 3024	1380	msedge.exe	88
PID 1380 wrote to memory of 5932	1380	msedge.exe	90
PID 1380 wrote to memory of 5932	1380	msedge.exe	90
PID 1380 wrote to memory of 5932	1380	msedge.exe	90
PID 1380 wrote to memory of 1512	1380	msedge.exe	92
PID 1380 wrote to memory of 1512	1380	msedge.exe	92
PID 1380 wrote to memory of 1512	1380	msedge.exe	92
PID 1380 wrote to memory of 2520	1380	msedge.exe	93
PID 1380 wrote to memory of 2520	1380	msedge.exe	93
PID 1380 wrote to memory of 6008	1380	msedge.exe	94
PID 1380 wrote to memory of 5684	1380	msedge.exe	95
PID 1380 wrote to memory of 6008	1380	msedge.exe	94
PID 1380 wrote to memory of 6008	1380	msedge.exe	94
PID 1380 wrote to memory of 5684	1380	msedge.exe	95
PID 1380 wrote to memory of 5684	1380	msedge.exe	95
PID 1380 wrote to memory of 5064	1380	msedge.exe	96
PID 1380 wrote to memory of 3540	1380	msedge.exe	97
PID 1380 wrote to memory of 5064	1380	msedge.exe	96
PID 1380 wrote to memory of 3540	1380	msedge.exe	97
PID 1380 wrote to memory of 1304	1380	msedge.exe	99
PID 1380 wrote to memory of 4148	1380	msedge.exe	100
PID 1380 wrote to memory of 4148	1380	msedge.exe	100
PID 1380 wrote to memory of 1768	1380	msedge.exe	101
PID 1380 wrote to memory of 1768	1380	msedge.exe	101
PID 1380 wrote to memory of 1768	1380	msedge.exe	101
PID 1380 wrote to memory of 3892	1380	msedge.exe	102
PID 1380 wrote to memory of 4708	1380	msedge.exe	103
PID 1380 wrote to memory of 4708	1380	msedge.exe	103
PID 1380 wrote to memory of 1896	1380	msedge.exe	108
PID 1380 wrote to memory of 3604	1380	msedge.exe	109
PID 1380 wrote to memory of 2364	1380	msedge.exe	110
PID 1380 wrote to memory of 4400	1380	msedge.exe	111
PID 1380 wrote to memory of 4400	1380	msedge.exe	111
PID 1380 wrote to memory of 408	1380	msedge.exe	113
PID 1380 wrote to memory of 960	1380	msedge.exe	114
PID 1380 wrote to memory of 960	1380	msedge.exe	114
PID 1380 wrote to memory of 1064	1380	msedge.exe	115
PID 1380 wrote to memory of 1064	1380	msedge.exe	115
PID 1380 wrote to memory of 4296	1380	msedge.exe	116
PID 1380 wrote to memory of 4296	1380	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1524149327453487296/1524149432759615630/Ghost_Temp.exe?ex=6a4eb246&is=6a4d60c6&hm=8a113a2bff831de8b9d9580fdc2d4ae150b4ff5b0c5f22a8d87ed5d25d595c2f&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd090cc188,0x7ffd090cc194,0x7ffd090cc1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,12887403979061594783,1148886966260232356,262144 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,17396503995538905184,14821601540642435688,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,16101243103876903942,14717531203317156430,2097152 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,6513541925428941032,7492793330194855152,2097152 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,12402043713093120558,782248230136922358,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,6693318044617691067,14824467786956687083,2097152 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,4812975126405293969,6650306735503457937,2097152 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,6364116877670700278,8430008248912114067,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,11637195780447727025,1609631227325466871,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,2486349400657705174,7793154819595353909,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,2486349400657705174,7793154819595353909,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,3622898167874092310,15592941414837019023,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6216,i,3682500888100481047,14481404915265769453,2097152 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2590782952845430314,7057775980997580977,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,10667985895649632100,5358198576775855772,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,1134907859048407384,3303805785712934881,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,4701266201804159110,14718545269061451029,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,15084319662736706147,6362820952199988636,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,7244878933257344712,6353640623519518495,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6236,i,5822619688881149604,7925325121117507235,262144 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,10085866612172361472,8580305844170167471,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,5922224852195649174,6050581154277908280,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,16257330056122127587,5790867863110179527,524288 --field-trial-handle=2828,i,7007746216398544223,13077355039767659940,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ca9a6a598b1e1eb651e05d4df6c262438c87aea8c1807220ef69a5dbceb86271
MD5 632ea2dbf0a1761a25e66e7e08c8a34b
SHA1 fd0ad3a95fd8942f2b4fb67145280b11e6391975
SHA512 bedb9ed3036bbfa7e95e8732ffb5150053b414bd6a59c80da889259073cc8ddf12428280f8bd56a54576a7794cf0516ec487cc307780b3974946287e2bf8fdac
TLSH
T1465187B433E725C9C76389B3D9EB25E8B63C944D07CB5E3056D2E83D0A3672485324D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f2dd362b2023423bd7533559d8e235e8030a6dc8fcd4ddf472bbc526e664be24
MD5 fa335f259764b59ddf6a20aa2a46c70d
SHA1 f9f34a9a70fd4cb93a2b736f5153cb0471d51e9e
SHA512 01dda3d911c16f1c58be30dae0e08dfc73ff4da2892a4b44d70215ed934ba3c9e0d9ee666244dd219b97e52fc562f0407a5b574313d70901f3bb5e68813a915c
TLSH
T1F051AAF7C3E5866EC91156F4AB146E2BCE2D0915432C3C1A89E0EF1BA7E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b7c74752a2af49e45b6f81897377d7b322cf80203fed64c087e0853520a2751b
MD5 bcb07ae1663c5a9fb7ce4ebf11ee24ad
SHA1 7d68d767a0e5b2e0146849fc470b513da5b238fb
SHA512 241be3cb5430d926c181cc61492f6e706e4699a75057e5703df1df435b43a0003e97f45dcf07fdd13a0ea2f47e849c69946929cc69b213eb384e8abe879c6fcb
SSDEEP 192:sxRNRtyM/jK1Ml8wOe/fvsQHPe3mj8xtzoA8pi/g6+WNIYDMtGzhdIgIJ:sxRNhIe/fvsQvT8xgi/5IghBs
TLSH
T11352C8166A3899778CCBD21DFA557F53D6F81533A2901E14AAFCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a4808c46accb9867aeb64f352b682ee678eaa2bd718618f3dc0bf95253ec7f18
MD5 593ee934fdf39bfc1ed9dda1e4e4967e
SHA1 1dfd89721851a8972d3def8561e3c3995d7bf287
SHA512 39300924a2e6f9d3a6c3fe124ac8d24efa0c9264d74af82fd73ec5f1c1129a04a040e5d1ed9f3b75b82d9399bca0c292283dca39d5e943cf6d1eaae890460f3f
SSDEEP 192:sxRCRtyM/jK1Ml8wOe/fvsyHPe3mj8xtzoA8pi/g6+WNIYDMtGzhdIgDZJ:sxRChIe/fvsyvT8xgi/5IghBn
TLSH
T1EE52D7166A3899778CCBD21DFA557F53D6F81433A2901E04AAFCCA0C05E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f65dc5d1f7316b58034fcad301f82669fb69d996afb4d1b9ae3d0174af3a5d4d
MD5 a93cfdba5bdf926d7a80aa4deb23cb8f
SHA1 38acba48f5cfa718d354cc5c1ce6beb94785ad02
SHA512 ee43d4563e0742af90f80b69dcf407bac0beb0cea31542c5302520d18c1e03b7397fe0c1e13434da3b480e46e8d7dddef3b4d9ec9304f4f514fca39b575d21bf
SSDEEP 192:sxRCRtyM/jK1Ml8UQuOe/fvsyHde3mj8xtzoA8pw/g6+WNIYDvnmtGzhdIgD/J:sxRChqJe/fvsy9T8xgw/5ICThBl
TLSH
T10462C6166A3899779CCBD21DFA557F53D6F81463A2901E04AAFCCB0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b54a68e7d3aaf0fc32bb4f02f4017a25d5ddd882734e9730cc708c4c3546c2df
MD5 153abc30c50bef441d29a3e9b12d584a
SHA1 f698c95488819fa6782735b438298c99fbba81fa
SHA512 126b0eb2353bafe58ef8bd8fda6b4bf8096f1201b7b2236b35b31c268448bd9e9b4609c018b7774a2be5b95f81b2d721c732afda63a6a29da0537a703d44f240
SSDEEP 768:f+4+IDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOIn2iro72w:f+4+IDWgb/fPIu1jaPw2572w
TLSH
T1E7C21C2B640CC77E4F844A9DEC29AE966DD801CB9B988D5447FA890C03CB7EB511B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a3b6da553f87d9e556566f2374c3879ea35d152bf7e5a7f527f51a4f3c46b41f
MD5 a6675a2373a621a556f92ac0e875f6ae
SHA1 ba124ab9a2c81c95a90ee1eee755ffdc65454770
SHA512 411b0b97b125cade62d02792dda554d06d9753342fe967dc5564263d2e68d35eecdd3eabf0d4d5bddf1a1724ebe7dd49f663a9de18a0190190709f11af52bd56
SSDEEP 96:KRqP2qc8cKWkB5gaKK4/ggKcKiJ46jHv4dZvtNhW528gBhK4Igvhc3f+BtHQ1xHC:CqP2qc8c1kBKay/ggRKiJ46jHv4dZvtx
TLSH
T1F3917F5D303B0351387D2D8C80959D66D2D2B4A63519E42B7BB902E11F2BE029EFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7b6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7b6b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 731ab3630ce3a38576aba9f3bc849422dfae2eec582d3090026ba38dc724bf2d
MD5 fd0fac4e28d6ffc6dc34ba32ea29138a
SHA1 8df715e50c6cf4c55eebfe35b8e01437aa38c1c0
SHA512 9f098a659c12a2115f46e5c35476b2cfa9f9e304af7d9fa28d17268599a421a73bdc1f3c628485612e43b27cca0822de46093bfceea0c23de933c8bf586cd698
SSDEEP 768:5F1j+9d3wwgFWf8dMwifB0tI6aHuVboPzkZLNx9OFWMjVyF:I9d3AWf8dcVbHOawZLNqMn
TLSH
T15F039E77AC61DD2BADA78AD9B20A3646EFF01163C5C01A949ADC6F0D51D75EC030BE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 61d61c93d8ce1c6fe7d14157da79e8cbc709c9a7f489499049fb6f0c63c0de0c
MD5 5721a04472321ae701aa0ff66af9a1e5
SHA1 4c8adcfb0280b6b5eb7b4be67892c53688ca0282
SHA512 08154e4c9cb7a5a38112cfdd9baa2a56a12e75ccce0653b9a2cf948bcf96193a2672733fee380df72179380314d3dd5d9001f46f9720b6665547a2d952808b36
SSDEEP 768:Orv+4UNbdu3LWfjdMwifB0tI5aHuVboPzkZLNx9OFWMjVyD:Obsbo3LWfjdcV0HOawZLNqM1
TLSH
T10A13BF32B8349D279DB78299B14A7A43BFF42153C6C40B98DCD86B4D46DB4AD170BE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 547c6b6caedef88dea82a10c6a3d2832a2af0bef5029fa83557dce7ef3299547
MD5 660661948b737c59b61fee3af6f23580
SHA1 8c990837427370012eda1ad1c204bfcc162204b3
SHA512 e471b51e7adbb5a298536d59752ffcbbfd795ab0d488bb7a0748552702f9e6fd97e0d433eebd97b28d94a8579580b27e9101187e9e99759bd4cda0b0c4a9df37
SSDEEP 768:zj+9U3LWf8dMwifB0tIkaHuVboPzkZLNx9OFWMjVyF:W9U3LWf8dcVFHOawZLNqMn
TLSH
T11BF2BF76BC619D279DA782D9B20A3A47EFF41123C6C01B888DDC6F0D45DB5AD070BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a0b2c7f013c69eab64d67ab2a834193d333dc1eac370eca89143348b9ca0f8d
MD5 d015571ca1d68e24f5d64913144dd1e4
SHA1 39095bf957e3d1d5d8840aceb85ab441bc2e86a8
SHA512 fae64775929a38af367660807f3d7e73dd780d3e4ab06b84056cf38de450056e6a94b2e2f292661a67744cc01cb9f0285214f6174f7c732f78f6a74bb71841fb
SSDEEP 768:0rv+4UNbdC3CMrwifB0tIoaHuVboPzkZLNx9OZlUik4K:0bsbs3CHcVpHOawZLNqTUVr
TLSH
T12403BF36A8749C37DDE7D289718B3A477FF4211385840B98C9EC2B4D46AB4AD170BE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef44aed1-cbc0-4d3d-b901-fcbc6af99ee2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ef44aed1-cbc0-4d3d-b901-fcbc6af99ee2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Ghost Temp.exe.crdownload

Path C:\Users\Admin\Downloads\Ghost Temp.exe.crdownload
Size 2.3MB
SHA256 bc11649afa0295cdb87080a634f7c2e235ce1d0bc495873151e6a02c4580adaa
MD5 32e113d5f4ec5de5d99a41e393798922
SHA1 23686795d4c6547b01b08305ad4e744fa4021552
SHA512 cd8bbcf8986b3c0394803057d60d41645bfcdf91c0f878ec09500e53eb9e799e95898950d11ca6bf2eb98e735b78c83808261c92d89dee54e164f7dd57314d38
SSDEEP 49152:gzs+qdwsOH2VWRnjFfJuGBsuf9iP1VRs+Ea0ErvNnPZgmJaEPi3:3LInjFfJuGBsuf9i9VOBa5Z1aEO
TLSH
T115B5BE4BB3A501EDC267D278C616970BE7B17419132097DF23D08AA62F53AE16FFA311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download