0211e39ad6829b42d1b2197c1d4ba0cced67cc0d9683671ee8ce660201af0375

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ghosty.exe
Size 7.5MB
Sample260930-yqscsstfle
SHA256 0211e39ad6829b42d1b2197c1d4ba0cced67cc0d9683671ee8ce660201af0375
MD5 d846b100f3d88ed8dc2466a1b72710d8
SHA1 2823c370448ddf5d8268c43ab721968018ebace7
SHA512 cd22cd89a609eb7ad2392a1a0655dc5d18636162e773d6f770d814f9472830f3d1a6640214e8307acf4f69983770446e5bb90fd75cd28e3444ed307c372a9515
SSDEEP 98304:2yJXkE0wgWoCvZDNn3XEMeGzVSaJ0+h1W48smx+M92pjGgnZePS7mhn+70Fu:t5v/8JiBQPI4gr
TLSH
T1BD867D07F79181E8C09EC078835BA637EA72BC894935B29F1BE44B112F26F50AF1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_187054454\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_187054454\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1211553460\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962902692\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1211553460\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1211553460\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1211553460\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962902692\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962902692\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962902692\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_187054454\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_187054454\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1211553460\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_488668387\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962902692\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_187054454\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1211553460\_metadata\verified_contents.json	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ghosty.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ghosty.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ghosty.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ghosty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ghosty.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ghosty.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	ghosty.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	ghosty.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	ghosty.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
200	msedgewebview2.exe
200	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5464	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4732	ghosty.exe
4732	ghosty.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4732	ghosty.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5464	4732	ghosty.exe	90
PID 5464 wrote to memory of 5344	5464	msedgewebview2.exe	91
PID 5464 wrote to memory of 5348	5464	msedgewebview2.exe	92
PID 5464 wrote to memory of 5348	5464	msedgewebview2.exe	92
PID 5464 wrote to memory of 5348	5464	msedgewebview2.exe	92
PID 5464 wrote to memory of 5348	5464	msedgewebview2.exe	92
PID 5464 wrote to memory of 2636	5464	msedgewebview2.exe	93
PID 5464 wrote to memory of 2176	5464	msedgewebview2.exe	94
PID 5464 wrote to memory of 2176	5464	msedgewebview2.exe	94
PID 5464 wrote to memory of 2176	5464	msedgewebview2.exe	94
PID 5464 wrote to memory of 2808	5464	msedgewebview2.exe	95
PID 5464 wrote to memory of 2808	5464	msedgewebview2.exe	95
PID 5464 wrote to memory of 2808	5464	msedgewebview2.exe	95
PID 5464 wrote to memory of 2808	5464	msedgewebview2.exe	95
PID 5464 wrote to memory of 2808	5464	msedgewebview2.exe	95
PID 5464 wrote to memory of 6024	5464	msedgewebview2.exe	99
PID 5464 wrote to memory of 6024	5464	msedgewebview2.exe	99
PID 5464 wrote to memory of 6024	5464	msedgewebview2.exe	99
PID 5464 wrote to memory of 3464	5464	msedgewebview2.exe	100
PID 5464 wrote to memory of 3464	5464	msedgewebview2.exe	100
PID 5464 wrote to memory of 3464	5464	msedgewebview2.exe	100
PID 5464 wrote to memory of 5036	5464	msedgewebview2.exe	101
PID 5464 wrote to memory of 5036	5464	msedgewebview2.exe	101
PID 5464 wrote to memory of 5036	5464	msedgewebview2.exe	101
PID 5464 wrote to memory of 200	5464	msedgewebview2.exe	102
PID 5464 wrote to memory of 5204	5464	msedgewebview2.exe	103
PID 5464 wrote to memory of 5204	5464	msedgewebview2.exe	103
PID 5464 wrote to memory of 5204	5464	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\ghosty.exe
"C:\Users\Admin\AppData\Local\Temp\ghosty.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4732.6048.17141295874333398268 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView /prefetch:4 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd495b5fd8,0x7ffd495b5fe4,0x7ffd495b5ff0
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4580 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=1748,i,5537272945794986800,17797416605974370685,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e399ed9cd758dd10e5b23b62355efeefae59cb00
    3⤵
    PID:5204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 664a4c018a8c269afdb138b3f85ff3a36956aac51e4e93941fb2261d901419a3
MD5 171b3f123afe124afeab856e7ba19cb0
SHA1 b4c313dfd7fb35fa4ab1bf4cfb3b68e6daeff29f
SHA512 16ad926376a22e176e196b271ac539ceea7143bd44133fecbe0c1f701df4ebb867b36658cd221d995f830fd28c9d5e21d0a2736fad5db8dbd0607e92ff95960d
TLSH
T117D0121273414578C02024330142A5580440C11B41064001583A896D1A084710902891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0a24d1d64e8374964bc51f4fa59ccbf49aa6da85e820e6f918bc1213d05c58d0
MD5 f371315ee91a76db5ad8d9a43c2ab33f
SHA1 d0f59a02bfbf3792e0a7ecb3e61f0c33d4a32a71
SHA512 5c3266c8ef38e01f8eaa95a2f3ead713830ef29ab8501f03415c07dbb121a32a65583922bd1423f2c3a6093619926a1c3380a02bf943429e322060764f41a693
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a65e1e6089b0b6fd3f151bde1ec1b59c0b1bbd503ede08d361c7fb118dd3e697
MD5 07e2a8d2511e6d3edf550a7c05e80de4
SHA1 047dffb50f70ef0175e669c6fa22592860417984
SHA512 2572cde81ba6ab384738702650872c01d35178b6febf351f9b2f6b6889a2ab27a820b77ebb21cd6c4ee53da55051193cf6ddd9e150ad6b92e515d45b0ca67d05
TLSH
T1CAA0027203595442C220177B11E219487631BDA50203CA85C09002A6BD613C44789456
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c9fd.TMP

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c9fd.TMP
Size 48B
SHA256 648a0a9a51b48686783ad984dce9125ef0d539292bbebca9d86ad20f7c9c6952
MD5 b6faf517a76a295d6613b2de695c1632
SHA1 5461fc2ec9b06eee8e7285956bbeafffed62d54c
SHA512 3ab6794107492a318c9be22645501ef6a9be00ab6d4ae600cf059f6997d359a8c5ff0da7dd8f603d770681010b79abdd386424569d857fd24b24a30686f95df4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\Network Persistent State
Size 578B
SHA256 74697494a41062a8bae9cf96ccd3b7c86d2089e4222d7cb75f10ac07a626db37
MD5 f8d75aec8c245dd87f18cd331aaf4d22
SHA1 cfd3bca4dcbe1a80e73ff959725ce381b674ed07
SHA512 76b2bd52fc76095702b7075f7b5f07d7e6cd80db86e3ffdc579dc596a643993f38b8cdd13ffd6d549f1a953901d7d0b51cf37a081f6d4331925bab6ca6fca360
TLSH
T14BF0E1A2C2D085AE8A4127F417387963CA2D040A922C2E16DDDEFBF957D1034C32050B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 b3ef9a2c714c9cea65b0adb686bb1b7cd1bb3dbd0f5f186f8db7561170374fdb
MD5 a9609496917b8123bc38fe870fa89a8f
SHA1 0b9d71ef8f101c28c47f3abc74c7e8cd767d3d7d
SHA512 913e151c47d1e33f17cab109873da10f0330e111c692545226c1d18690976384864b61e5b448245f6820a971fa7ba6eb8b916a19c7e0132c591f0827bd178c89
SSDEEP 96:st2/dZLBRb9YkXo5h16Z0mAs7/x+6MhmuecJw/1ejenK+gf128XM1C7K:stufKconmAsV+Fdw/QjB91G6K
TLSH
T152D1B6025E64B9FB8CC6E509BA79BB13E2F5943271D12D58E7F8462C08DA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 6d8f4c1e67506fedc8d1f9324c726b1c16140ac5eb42473428d7bc6c0ddc0b5c
MD5 62d8987ee9486cd00ba6fec8dc8564d1
SHA1 65601a6baec18049dbfec14843c8ead73a8c6e1c
SHA512 27030010502bf18ed2eb5026d407bfdb5bb8cbea74cab86abd8e3ccceb73ed5301bc1dfe28594d43f42132bfb18175779bc7179132ca7436c6481119cec92192
SSDEEP 96:st2/dZLoGRb9YkXo5h16Z0mAs7/x+6MhmuecJw/1ejenK+gfq28XM1C7K:stufUconmAsV+Fdw/QjB9qG6K
TLSH
T1A4D1B6025E64B9BB8CC6E509BA297B13E2F5943271D12E5CE7FC452C08DA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0d21.TMP

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences~RFe5a0d21.TMP
Size 5KB
SHA256 912041bc9838eb9e74dac7a79b4f1c800b98e055cfd38319789c1c6cf7b06716
MD5 4b79f4f60b7d3ebdb93256dc07a9aee4
SHA1 94effe3f5137159ac9d6e14d22c6ec55d04f7b35
SHA512 77a048a5e8d6c01ceeb6a2cc9f77dbba61346117703644e928b6bc65ec0883a4d9cbf436b94972d7012b2d6e44ffcef651c3919319819146abde778959cc0779
SSDEEP 96:r2/dZLBRb9YkDdo616Z0mAs7/x+6MhmuecJw/1ejenK+gf9y28XM1C7K:rufKQo6mAsV+Fdw/QjB9sG6K
TLSH
T148C1B5025E64B9BB8CC6E109BA397A17D3F9943275D52D5CE7F88A2C08DA5CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
Size 2KB
SHA256 fa3199fe6d96ed04dea709a5e5590f7a66f4665c25af8c5b45cc7d3affeda32b
MD5 7e291be72e16dc0873c01a715ad85011
SHA1 6b88cdc341e1e732cd3d81ca140cf4d02557d5e5
SHA512 5a3b8b10904363f217526ba9473735bd03475d2e302f77b66fb56b2f95ea90222de45b6c499e822362ca498edf9e8bf9d10934e9a2f123afbaf48b99301e7112
TLSH
T1615194337864ABB7C9E2C614799A3F539F799096EA522F1496CD0B1C01E755C2301C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
Size 3KB
SHA256 6fd9540662ebd2d15fa1e90302cd4fb9741e4763459aa399010537479861f955
MD5 92c6122f568592856d65cb023a7f4f26
SHA1 4ffd6e14a00dd4f08cc5be58c58ab562bc51dbe0
SHA512 40b04ed3de7b36439244cf4616667bbddf96135d87093e43e2f899409b574f16d66f57c1258b8568e99fbd924db6d160b565eb68d985d28502932018f30db2cb
TLSH
T1F871B53369B4B9B78DF2CA04B9863F43A7A59067E5917F99D5EC0F0C02E72981341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
Size 3KB
SHA256 181e2eea706714ac5670b0316203598f6a258fc6b9a166fd3624a2747c90c29d
MD5 9082c655056d19ad8d83f14e57c13133
SHA1 153fc05b2548f597c312a80426bf7081c94128b7
SHA512 62f01485b24be34596ed18416490caf61eef99a3602e6445d4104421562aa8acc14bf9d43f423ea636ac85e439f0fa4e1390d1327090536378300173b163d673
TLSH
T12961B73769B4BA7BCDE2DA0479C63B07A7A99067E5813F68D6DC0F1C01E72981351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
Size 15KB
SHA256 eaa6f75546ed6d77c29d076d6745bb19326961b4b90ea0b3e815ce7cb52583cc
MD5 d60315255c57213f5bc62d4d3faca147
SHA1 4686515f84b221e296b96df76306bca07ae11bec
SHA512 8c702950ac4a48a6c125c74fbc7dd85ed6a1961dccff0aa4e815a88bd4d8837fe9d75195dbeb6bdab04d99711ba1349890ba49582ef53e4530307492a9bf814f
SSDEEP 384:H+aQikB+z/xvxjg/qhEwNBSAvYVA0Yf9zi:W/UxvxjgC++eA3fFi
TLSH
T16A72AE2B54B93E63E9F7E6147999078BDBF894A390C27AB849BD5F0907C32940342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5977d6.TMP

Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State~RFe5977d6.TMP
Size 1KB
SHA256 03183ef286b3da999aa1814d949d231ff3975462af8204c0b7439637ee38cdc3
MD5 74d1b92bd6d8efca1d7c9142adc8c7c2
SHA1 a07d45236312839bb6de1061514ecdd7346a137e
SHA512 efd69c232aece7b36cb10d11ad5bf8cd0af9f984e2dfb1cbae97ded17829cfdf03c850a91ed38b90d2b118f2eced697f1c9d7c788e86485467fd3484309c41f6
TLSH
T130219573D4E46BB2DC81D25532677B976F34909BC2518E0061CE8B2C02E314DA329C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2808-90-0x00007FFD6A5D0000-0x00007FFD6A5D1000-memory.dmp

Download

memory/2808-304-0x0000017F18DE0000-0x0000017F18EF6000-memory.dmp

Download

memory/5348-251-0x000001F76F360000-0x000001F76F367000-memory.dmp

Download

memory/5348-287-0x000001F770ED0000-0x000001F770ED8000-memory.dmp

Download

memory/5348-190-0x000001F7705C0000-0x000001F7705CA000-memory.dmp

Download

memory/5348-189-0x000001F7705E0000-0x000001F7705E5000-memory.dmp

Download

memory/5348-187-0x000001F7705D0000-0x000001F7705D2000-memory.dmp

Download

memory/5348-186-0x000001F7705C0000-0x000001F7705C1000-memory.dmp

Download

memory/5348-245-0x000001F76F350000-0x000001F76F356000-memory.dmp

Download

memory/5348-266-0x000001F770E50000-0x000001F770E5A000-memory.dmp

Download

memory/5348-262-0x000001F770E50000-0x000001F770E52000-memory.dmp

Download

memory/5348-267-0x000001F770E60000-0x000001F770E61000-memory.dmp

Download

memory/5348-259-0x000001F770E40000-0x000001F770E45000-memory.dmp

Download

memory/5348-257-0x000001F770E10000-0x000001F770E18000-memory.dmp

Download

memory/5348-256-0x000001F770E30000-0x000001F770E34000-memory.dmp

Download

memory/5348-265-0x000001F770E60000-0x000001F770E65000-memory.dmp

Download

memory/5348-263-0x000001F770E40000-0x000001F770E44000-memory.dmp

Download

memory/5348-260-0x000001F770E30000-0x000001F770E3A000-memory.dmp

Download

memory/5348-254-0x000001F770E20000-0x000001F770E22000-memory.dmp

Download

memory/5348-197-0x000001F770610000-0x000001F770613000-memory.dmp

Download

memory/5348-249-0x000001F770E10000-0x000001F770E14000-memory.dmp

Download

memory/5348-244-0x000001F76F360000-0x000001F76F363000-memory.dmp

Download

memory/5348-242-0x000001F76F340000-0x000001F76F345000-memory.dmp

Download

memory/5348-241-0x000001F76F350000-0x000001F76F353000-memory.dmp

Download

memory/5348-239-0x000001F76F330000-0x000001F76F334000-memory.dmp

Download

memory/5348-238-0x000001F76F340000-0x000001F76F342000-memory.dmp

Download

memory/5348-272-0x000001F770E80000-0x000001F770E8B000-memory.dmp

Download

memory/5348-279-0x000001F770EB0000-0x000001F770EB1000-memory.dmp

Download

memory/5348-278-0x000001F770E70000-0x000001F770E7A000-memory.dmp

Download

memory/5348-277-0x000001F770EB0000-0x000001F770EB5000-memory.dmp

Download

memory/5348-275-0x000001F770E80000-0x000001F770E82000-memory.dmp

Download

memory/5348-273-0x000001F770E90000-0x000001F770EA5000-memory.dmp

Download

memory/5348-286-0x000001F770EF0000-0x000001F770EF4000-memory.dmp

Download

memory/5348-195-0x000001F770600000-0x000001F770602000-memory.dmp

Download

memory/5348-282-0x000001F770EC0000-0x000001F770EC5000-memory.dmp

Download

memory/5348-284-0x000001F770EE0000-0x000001F770EE2000-memory.dmp

Download

memory/5348-281-0x000001F770ED0000-0x000001F770ED3000-memory.dmp

Download

memory/5348-198-0x000001F7705F0000-0x000001F7705F6000-memory.dmp

Download

memory/5348-303-0x000001F75F6D0000-0x000001F75F7E6000-memory.dmp

Download

memory/5348-178-0x000001F770140000-0x000001F770141000-memory.dmp

Download

memory/5348-313-0x000001F765B00000-0x000001F765B0A000-memory.dmp

Download

memory/5348-315-0x000001F765B20000-0x000001F765B24000-memory.dmp

Download

memory/5348-316-0x000001F765B10000-0x000001F765B17000-memory.dmp

Download

memory/5348-312-0x000001F765B10000-0x000001F765B15000-memory.dmp

Download

memory/5348-319-0x000001F765B20000-0x000001F765B27000-memory.dmp

Download

memory/5348-318-0x000001F765F30000-0x000001F765F34000-memory.dmp

Download

memory/5348-325-0x000001F765F40000-0x000001F765F49000-memory.dmp

Download

memory/5348-324-0x000001F765F50000-0x000001F765F55000-memory.dmp

Download

memory/5348-322-0x000001F765F30000-0x000001F765F37000-memory.dmp

Download

memory/5348-321-0x000001F765F40000-0x000001F765F44000-memory.dmp

Download

memory/5348-327-0x000001F765F60000-0x000001F765F64000-memory.dmp

Download

memory/5348-328-0x000001F765F50000-0x000001F765F57000-memory.dmp

Download

memory/5348-179-0x000001F770150000-0x000001F770152000-memory.dmp

Download

memory/5348-193-0x000001F7705E0000-0x000001F7705E4000-memory.dmp

Download

memory/5348-192-0x000001F7705F0000-0x000001F7705F2000-memory.dmp

Download

memory/5348-180-0x000001F770140000-0x000001F770144000-memory.dmp

Download

memory/5348-182-0x000001F770160000-0x000001F770162000-memory.dmp

Download

memory/5348-363-0x000001F75F6D0000-0x000001F75F7E6000-memory.dmp

Download

memory/5348-385-0x000001F75F6D0000-0x000001F75F7E6000-memory.dmp

Download

memory/5348-184-0x000001F770170000-0x000001F770172000-memory.dmp

Download

memory/5348-185-0x000001F770150000-0x000001F770154000-memory.dmp

Download

memory/5348-24-0x00007FFD6A5D0000-0x00007FFD6A5D1000-memory.dmp

Download

memory/6024-396-0x00007FFD6A250000-0x00007FFD6A251000-memory.dmp

Download

memory/6024-397-0x00007FFD6A020000-0x00007FFD6A021000-memory.dmp

Download