19c42c84291fafffd2a21bd54c9f68fd961a33e79e0e6358671def073b882a6e

Analysis

user interaction
yes
max time kernel
55s
max time network
58s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Beg (1).exe
Size 6.6MB
Sample260808-vph6ysan4y
SHA256 19c42c84291fafffd2a21bd54c9f68fd961a33e79e0e6358671def073b882a6e
MD5 38444c2f7771f984e1431fe1eabb3842
SHA1 ac225999350af1f8e07beb883d99f414a66474a7
SHA512 39363898690506ba20b77fa3640e68605f28b453d95285c076beb6dfef2db68d29435902a6ba72f35ebd693a8eb56e575a842bfea3195a69ec8dcef609c5eb08
SSDEEP 98304:GpnwUIUeWcK1pk/EapS5JzA+13G52G0JxXv5UHoC8vHilQId+J96ieKZRwEmUGjk:GpnLIb8k/5STxDGOxXRDzC5+jAbldrS
TLSH
T13166126DA5503768C017C5788533AD0AF3B6741E03F5E9EB33DABA913F2B860DA25B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4412	beg_run.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	34	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a28021c93e19459a	3

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4860	Beg (1).exe
4860	Beg (1).exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2864_420247657\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2864_1225533526\_locales\da\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3944	cmd.exe
1228	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3868	msedge.exe
5752	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3868	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306826033146536"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{F2C57BCF-FF4C-4BEB-A2B5-3E913F6ADF65}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{43AEB13F-1F04-4F55-9287-BA411A973E78}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4860	Beg (1).exe
4860	Beg (1).exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	beg_run.exe
Token: SeDebugPrivilege	3868	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4924	4860	Beg (1).exe	84
PID 4924 wrote to memory of 4800	4924	msedge.exe	85
PID 4924 wrote to memory of 3472	4924	msedge.exe	86
PID 4924 wrote to memory of 3868	4924	msedge.exe	87
PID 4924 wrote to memory of 3472	4924	msedge.exe	86
PID 4924 wrote to memory of 3472	4924	msedge.exe	86
PID 4924 wrote to memory of 3560	4924	msedge.exe	88
PID 4924 wrote to memory of 3560	4924	msedge.exe	88
PID 4924 wrote to memory of 3844	4924	msedge.exe	89
PID 4924 wrote to memory of 3844	4924	msedge.exe	89
PID 4924 wrote to memory of 4120	4924	msedge.exe	90
PID 4924 wrote to memory of 3844	4924	msedge.exe	89
PID 4924 wrote to memory of 4120	4924	msedge.exe	90
PID 4924 wrote to memory of 4120	4924	msedge.exe	90
PID 4924 wrote to memory of 5952	4924	msedge.exe	94
PID 4924 wrote to memory of 5952	4924	msedge.exe	94
PID 4924 wrote to memory of 5952	4924	msedge.exe	94
PID 4924 wrote to memory of 3572	4924	msedge.exe	95
PID 4924 wrote to memory of 3572	4924	msedge.exe	95
PID 4924 wrote to memory of 3572	4924	msedge.exe	95
PID 4924 wrote to memory of 5540	4924	msedge.exe	96
PID 4924 wrote to memory of 5540	4924	msedge.exe	96
PID 4924 wrote to memory of 5540	4924	msedge.exe	96
PID 4924 wrote to memory of 4288	4924	msedge.exe	97
PID 4924 wrote to memory of 4184	4924	msedge.exe	98
PID 4924 wrote to memory of 4288	4924	msedge.exe	97
PID 4924 wrote to memory of 4184	4924	msedge.exe	98
PID 4924 wrote to memory of 5184	4924	msedge.exe	100
PID 4924 wrote to memory of 2864	4924	msedge.exe	108
PID 2864 wrote to memory of 1808	2864	msedge.exe	109
PID 2864 wrote to memory of 5752	2864	msedge.exe	110
PID 2864 wrote to memory of 5676	2864	msedge.exe	111
PID 2864 wrote to memory of 5676	2864	msedge.exe	111
PID 2864 wrote to memory of 5676	2864	msedge.exe	111
PID 2864 wrote to memory of 4392	2864	msedge.exe	112
PID 2864 wrote to memory of 4392	2864	msedge.exe	112
PID 2864 wrote to memory of 4528	2864	msedge.exe	116
PID 4860 wrote to memory of 4412	4860	Beg (1).exe	118
PID 4412 wrote to memory of 3944	4412	beg_run.exe	120
PID 4412 wrote to memory of 1228	4412	beg_run.exe	121
PID 1228 wrote to memory of 3868	1228	cmd.exe	123
PID 2864 wrote to memory of 744	2864	msedge.exe	127
PID 2864 wrote to memory of 3908	2864	msedge.exe	128
PID 2864 wrote to memory of 3436	2864	msedge.exe	129
PID 2864 wrote to memory of 568	2864	msedge.exe	130
PID 2864 wrote to memory of 568	2864	msedge.exe	130
PID 2864 wrote to memory of 1072	2864	msedge.exe	131
PID 2864 wrote to memory of 1072	2864	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\Beg (1).exe
"C:\Users\Admin\AppData\Local\Temp\Beg (1).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff80d52c188,0x7ff80d52c194,0x7ff80d52c1a0
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,5356227066317024582,14771906179696758080,262144 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,12375465636313480752,1854340541237191138,524288 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,12751581717886957096,17004243999422094786,524288 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3296,i,679582354102067594,17768260283691245511,2097152 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,15328816050112744695,6587903036777709779,2097152 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,9296931753927330742,1493296210547444880,2097152 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5176,i,15605483326953895267,5829153417295739030,2097152 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5252,i,629875743784267395,996718315232178503,2097152 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,2188879683890491839,8777454490701946836,524288 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,17768802766655692834,18178542656935351348,524288 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,15094829498748141216,17098917776427232480,524288 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,15094829498748141216,17098917776427232480,524288 --field-trial-handle=2316,i,3878978807216677621,8758352460918151367,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff80d52c188,0x7ff80d52c194,0x7ff80d52c1a0
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,15481857208773189432,7604877212715570061,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      System Time Discovery
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5339005354782647570,3868256000734066443,262144 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,2178784162312359297,283436151006022791,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6038923974306955473,8974636298555836734,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6038923974306955473,8974636298555836734,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,11073003879939921313,15878681238794579545,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
      4⤵
      PID:744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,5978936819357234696,17618333227552229025,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,8500312917132490183,1169280607542432921,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,2431722099060651953,13402534226109818080,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,62503269234339301,6301288783268816240,524288 --field-trial-handle=2244,i,16104961672788064886,11882639300534469311,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
      4⤵
      PID:1072
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\beg_run.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\beg_run.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title EU VERSION
    3⤵
    - Executes a command shell one-liner
    PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vgm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58dbd1f3fa7b3d47d576c32c39ae80438d99713a1101686cd063ce5f746aa242
MD5 82e3990061d4ca31263bf48e106dfc67
SHA1 fba63009d281bea25d656bc40604134d8b51fff9
SHA512 aaacdc2fcb6f5a147dd8fc7ead5c7851142af1dd417f018706a55e733c16e2251c0be1d63ebf0e9d9e96e1637fbf718773e9a5a307b94e39cf654111500485ea
TLSH
T14BD023B46537F6B0C23C003944100610136D017237B31373F058840DCD70042C2CF9C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 141c473df50c4bc26be6441866c4915d99353ce9a67691aabdd898b801282d09
MD5 6cf35da7b2d6ec5c39a6ded25fa65286
SHA1 a568bf9ab59552f8aa6e2a6b116feccea7112202
SHA512 1b61531f45a6b2609f88ce2804c156c0e655e05fd8fd02fdc4f027914cd20eab4ea5b31b6df9f09bb70d880772ee6bcaaad3ad1df404b4949f032e6940d81089
TLSH
T159D023F4A306D730C21D40354C10677117F6417035779773E064940E59B4059D3DE0C5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 eaaed930da54502505a1959a7b2aec69990bc3fb58c4ca982d2c59ce9da007d8
MD5 17ce634f102f3bf4d392e74ecd1b0681
SHA1 485e8dd536b38a89b99596070d32af9650b65479
SHA512 9a96a937c076eee08e9096d1dc0ae5f4323757052df23e963b81eb56afbe4d03fa7fa7242a802a8d95cd31ea7df538eccde62cb76cd89311626c9113ff2a0c28
SSDEEP 384:3bQlszcbPUSUkUfPtKQWsguyrPs41dHYWnAvoM5jZA6zDk:UszcbPUSUkUfVKQWzuSdHaoM5jZ
TLSH
T1DD13E63E32453CC9E2DB227D742F8AB2E7B9E872E5C4430777343542B7257AA4A4D852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 efe702644fbc9cb281e5f88aa7a39811ff808a82e962a3668d24e7d523bc16e3
MD5 1585285288a87185b5377a658c38c490
SHA1 65a99699c1817d66e94d188df3149886e123741a
SHA512 3e9bd668cfe736504dc0c02d5afdd673e3853fc1a8281d23b02e873e4969f022fae241a38842c7dc3268fa417788cd5709bc2225249a53e4a91d85c8d0106b13
SSDEEP 1536:pAL/2i+L/Jmc6ZurQkCtlDZGaqCmIL/zL/HHyZf1HuIJapLc00J1pZM:2L/IL/N6QQkCtS5uL/zL/ybOG00
TLSH
T1FA445FF70951A05BCFA802F5E2033A3ED177055D7CE1F9E9E63C0C952825B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 3024f69d46d487cfbcee47e4967ca2b61d326e6d8f04d2ef34a96c14f5cbfcc0
MD5 c11e48844c396358ed7b8a3490ac2861
SHA1 88b53cabf252151d057d94ca5abc3230aafb785a
SHA512 f9c233bae57ac1f72e9cff0bc45d61374662d1362df375ec1e6a77882413ce8d60be7cb8660c3c32e7b7f88c939a7a9fa260d541cf34b00c3b67d19b73337166
SSDEEP 3072:KDfTkmBH7SuFqHljmkvVr2k0cUASifPjrpAb8L/rZfk:OfYmN3K3UABfP5wKzZ
TLSH
T1B12508EECB682C82CE6B877470E0D9077E712183B69DC0D39944C5D897D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 69d7dea2c31df3fcc3866769542e2d8ccd75c49b49ce08e83e2e8a4860e27209
MD5 5ee0830ae32a6e1527b316f077f84786
SHA1 a3cdbe19aaa4f26fe96a8fbc9bb46e2207c1bf7e
SHA512 89bb1cba6afa8d2fc9a21fbed85f7f3439906dcc4b4931abec0cae794a9acbd9102acf13c97b2a546a529ef5946f1966e2f6ad479dd933a089681851b67776fc
SSDEEP 24576:Sol4YQ5Y8m7ZwNRd7qrIk8y9x68hxFWCPikJ/qtPUTOhIf+/XLtvMSacyyhg:OYefm7ZLIk8q6OWCak12P4YvL5fac7
TLSH
T1C4867DEDCA6898C3CD639970B0F0ED477C7413C3B595C1D6889CC684026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9aed45f3eb6a7a9f82757e5e174cd7812253a6b6481b5357a7dd3553ae84ee6
MD5 df3861ef7b55befda73fed4f0d6bd2ff
SHA1 dfbe01c259e2e762bca513590db2458428e87a32
SHA512 93284980407e8a71f66da0d9cfbbbb1a1fed747d4ba4b8f1ded1e8ee6e95d74ce48aa4af48f99afdd6b3eae2b55786dabbff3d4846f5c5ad5e225aa5d145f152
TLSH
T15E716FF969C2A4E6EF61D033E1E15389B63542F945337E9004BB3BF03625FBD8125058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f11.TMP
Size 3KB
SHA256 d6efeec1387a1a30a0b4a3140fcb40ce9d83058b50bc6cebcc2bb9459b2a3546
MD5 fa978cbda006df1ab98b387fd50c697f
SHA1 c578c141d42cba9cae0d2c14063f874f4b0cf016
SHA512 638a8c64742876e9eee67261c248a6cbdb0bacb35e7cfeb8338f2412c6d49647f340507bb67cc6e6a941586b85d3a6da76502078e36f13e1ed2c5735e118129a
TLSH
T15B715FF965C260E6EF61D173E2E14349B23682F945337E9115BB3BB03624FBD8125058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 2c7037334918896c6c9b63f249a2ac1908890ec33a40e5fb173cb9f16e33e826
MD5 720e0ff6e755f28ac4963d9599a2c854
SHA1 f090481d18fd577d861a9a182d48e945c887052c
SHA512 872e21152ba3f16fb274cfc4f26f00a4089b7e1d84866b900ec82e0e4bac0d3692e8c2fffdc7474d050b1f6d8cb565a018a2e155609aec1a33106265b0d9b14a
TLSH
T1B3E0D896BAC6C11D5D5034C751287B48C2D13482DB87BD033B0088C47E46401B346A56
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 11ac6a84ecbc63273fbf3fc66c91df9c28acf866a2516899b098752d78c38cfa
MD5 c618114101db32addd0b8a2061eb117b
SHA1 88b9275a73ef7abf8a05a15b5bb3b93c0840e616
SHA512 191c82767804a6dbcd4b72ee0a5a083207272fac458bb51c9a45109dfd44d341b72081bac9d65fa18b67204fbb3a8e195d0fd78277764b8f193c71d277ac21a0
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j/qK4W5LHxqzK5fKFtIFeKcqYpFg:Tyi+7f+UZD4jJ/B7MWxHx4CKFO2TpS
TLSH
T186E2CE4D3B11F611C4ED733EA0C2C6F05EBC692C4A4D7170923869768C53A67F09E10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 2c2f951a2597989fb15f5697a208004811a42d24503d665510073aa8ab489b19
MD5 da793e95a058db3d1689c27ddbaa440a
SHA1 8b5f5b9be6787fbcb4a0e784977947c670fc230a
SHA512 dcfcf3fb5902f839bf839fe8057ca1b48bdc6c04972757d0e045dbe633d54484e5bc17bae569bdec73c064ff4cf1c731d72076a91f146677480c028d7ba9504c
TLSH
T180E0200429CCC11E6C24769FCA7E6308C3E03447E6857A036B498C4061155456257554
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 a4683934bf4e7555acbee1aaad0eac68e877a18abbfa331f4ad4db7e5a81346a
MD5 deb9ccdd1174b468c6cf146b36319e51
SHA1 4a04e186b06ca55ce0a82b26d3202e09ca1ec8b7
SHA512 e6a0ef4099c88f2ebf1bdf92643ffdce13fe6f9a5dc0389c434245e6c52794087ac507efd1085bed905d0e19d0c5268302c79c18eeb409dc2ba9dc33b71d44d7
SSDEEP 48:uzBmw6QU1Pzf5mhwelXk4AMEzLSUc+XwMhyWFHX7vJm255mhwNj:6BCxf55KsME6v+Pyw3LJn55Nj
TLSH
T19C92B40B1F343852EB461D3E30BA5870D93BE12C6FAEAC04783854655EF58C2A1755FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 e8ce3a099c75784280711af71048858e10f70bc91903246d64f9ddd9a05abd3a
MD5 9e7e87b1a6addafe9502f1e68d9670a1
SHA1 f8f7ec655624721d13b0e89bef954c81800c720f
SHA512 45c5e1056214db729af8867c23c00420b4f33154f197bf92e53048b77075382549f59228020f8906bea4ea83ccfaf44ddb2faf4dac340d4857c2302c99555514
SSDEEP 192:H5qi5IIf+G83uy3Ct7XBBKlH5oV505E5YH7DXspU3iZ:oe/83uICtTBBu7DXspU3iZ
TLSH
T14714401F0F242721CDBD417678EB18B36D6DF02F8B166A996C7104B4CFE2B52602C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 535B
SHA256 ea553b4828b04baf2faa85017ea0800e8df4c70da4e10e3e13d2842342847331
MD5 f7f0784b548d8915f5f4b583fee7c141
SHA1 1487e6b7d7fe8eb237340d23b5a4b1e66798fffc
SHA512 1d797977c033be894fdcb6ad058bf97fd90455b84990651f62ecc524e8f69f1aca67aaa742b1f3dd166538baae32b0b43fa7667f78f161d4d9644d78db27b8bd
TLSH
T137F027F790A56303E6260EB832A43AEDA713D34A4ECC93F5C767902F0FA05B08069952
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 d59799a910dcfd7664fc5f57ea851c7d8adde90627f35e4c50f22f5fc3b5d8e3
MD5 e38b9675e09654beaff86a85b4946354
SHA1 1b299e4985dc53a1eadd8bb67f8169788233de03
SHA512 290273b77fdc7808310cc85f4c61dd72a917ec8037cd3dacae2983c7e7a630bddb45ec6e417d14836d21ee864badd9c5e9fef7f3864c0ab364131626ef879e60
TLSH
T14DE0D86054CDC11F6D08325F522A7709C7F03406EB8A7E136F05D881F401404A7925D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 16dd7d8a324f520815bf33f7f113c6dd7a026371d43586042054aaca527d6d1a
MD5 51b68e83908696b8663a0259cc6ae152
SHA1 7d3099d3d44433fb8d180b2871439a08704c1354
SHA512 b4760c95b8f93ac404183f265fccfa47e545ce480c8c32b4b1d8017edb9747dc0f5e81b7b3a8fa6d161ad3a526c50ac78177017f0954842b0b4ca93d9df2d61c
SSDEEP 48:T2SLopFMatSaw/auUOt8BGlPXTRec2A9/S04owwLLqszRSCwH:iSeMatUaAKGB07KKnILqs4CA
TLSH
T12292986F4F346620C1F08BBAE9C585661EBC211D87AB7999D92424F3CCA265BF10127C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 193eeb3586dabc13e0eda7d69a2391d1c5178723e7691829dcb446575da2dead
MD5 2873d8f8d341704058ac019329d30395
SHA1 33677ac70d726447249c2a8d0a9859d903c98e7d
SHA512 5ef7ecdc5eb6c4eb6b13e046575aeb335814d83d27d49c7099bba2adef28e1ccd47f7116e637cc3d9d53a23bf7924ba5dcbe371db480ddd782a75540b0608ec6
TLSH
T1B5719CB2C7E5866DC91157F0AB187E2FCD6E0958422C3D2E89E5EF4B93E2071E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 29ea388712618b146005af16719b946777857d966e642477b56202addfe28220
MD5 ac18ae0a33aa3d99638429f23bd19d63
SHA1 3282d8b4b1638b7a58f88215b09bd70c55f8f66d
SHA512 e35cd0a60f612247282946eeebec4c5968afece36b390990995d44f79a4b2097d014130b87988b5a4f4ea2c9ffc566e1538c40e7656c3b5ab77e609859d238f6
SSDEEP 96:eIEumQv8m1ccnvS6HpEdFRamEvqfJvsinFujpW4l4g:eIEumQv8m1ccnvS6aYmEakF
TLSH
T18AF201FE07276105D98444F0E0046B8EAF16014B47BAB2EC76D44BF3F3920E2B1B9B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 177587975bea2885de15f3c551a3f0e29123a039ca51218507465ae7b03a6a8a
MD5 4b305550afb58456ed675061c5142430
SHA1 d64bed299aa5acf914c68441c2e02a4713632cfb
SHA512 9c55331682d04bbb6546b8350908d7b2f01e75945c3a5768ff96d0ad129e94f9b66f1f73563deeb2191797097399ebb8e245fa2761c597fa99da885baeeb3756
TLSH
T13FC0229281F9E8321024987D0D80BC816E78C030024084E1CAA8833CE1844F7BA0302B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 eb18bc3a2aa4db375746661cfdb8cb77c890a1322101f04d28f61b7833d0ae61
MD5 66a6403f4bd973b0fb32a86696a9fba7
SHA1 7452e8f16fe8bc9e9abe10d7ab268a899ba90ef6
SHA512 45f4f379ded9ed6a699375ae2f6c1d9cb4f93052efe1e59950af10bec8b1d8560b5f5dd099b79327d5230637e15a199e0419248ae999d87107a8c45a9ace6ea0
SSDEEP 192:sxZKReyMqZjK1Ml8wjr/fMsU9WpV4zuo43yglzodpqfl/lHW6+WNVOApM/zhHXZj:sxZKfBr/fMscWv4i1woHb6//mZ4
TLSH
T1CF72F955AA385A7BCDE7D209FA457F53D3F8542391904E44A9FC9E0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ee731488a3e8da538bacba05384012e174d49d0f257d001a23e915a60bc4d94a
MD5 5ec6c1023c65654cb0b30fd4bc542ef3
SHA1 214923bb916691588834a018ee0fe84e026960bc
SHA512 5eece7b9d73605a96ccc0bf6702f3b94e5ef0bddcb81ff55f372afe7f47fda312e429be90bac4ffff2f4eedf88b197d62ad3aea4f2338571d972d293f9478ccf
SSDEEP 192:sxZKReyMqZjK1Ml8Mjr/fMsAPzuo43yglzodpqfl/lHW6+WN3ApM/zhHXlrTlfIr:sxZKf7r/fMsOi1woHb5/PNj4
TLSH
T19672FA56AA389A77CDD7D309FA457B53D3F9452391804D48AAFCDA0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 183a152f9b1b2c1ca1dcd8e2dceb23a704611e8b05321a34a1348711731f892e
MD5 970170d6890ca77d156204ca1f82aec0
SHA1 5d2b79701329d9fcf7fb2af62f92d707761e8e2e
SHA512 e15a49ec34658450da5033fb07b6fa2fb7561661c3633747efbb1ec762d997e24ea8ac851d7660b484c46694c4c48bb89fcae4a3ed41109561d9ffe6b106d7eb
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXtyh8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7eHiLl42vJ4roJ:/Zk4PfeEnXDWvXtyhu1jaWeHiL+QJDWO
TLSH
T151F2FA3B680CCB7E4F844E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 de69bcb78ba3d4cdbcb5573e7f4a31c026ce7fc5e2d70cf315de690709888ddf
MD5 5d385d0a8144f8d72c3d5a5753d32d8c
SHA1 48cc05674474d478291c80ece61432d046ee70c7
SHA512 82b46c6c988ba15875fb67dae7d645f9a822b5071985a4ccbc3ff9c90917fc03befbe9b70493349914d8df5e120ff209d9a7065e6bf3e3e2b884d47ca2e61658
TLSH
T110E0DF1035C8D17A781D368B063BE30DC2E4B447DBC8BD43EF898880A546D05B593690
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 100B
SHA256 a7ab255ccbe08ed8bae65c677bf2d8e987cdd8db32f71f8cf5b75cad6a0fd26d
MD5 651ce1081cb789028cda903779e7fa6c
SHA1 36448446b0e87fa1303090d9ba25bb4b655df317
SHA512 02db7d9114bcdba25f6c5aeb335bb0489e86e32f918595e7fb78ef2e64bc0f66d213c9aa05cdbb5b7f1dd6fed97c9fb1662de14ebe1f039919dbdba46ecf7cd8
TLSH
T135B012407340B003D48029F51B419B003380BE84B0C4100388496B314D4C99C3D00085
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 bc75ea6aada8d7f3e5c1deb863d755480568a45bf4ff6db5a8fba3685e02c648
MD5 f4ddcfc62044c9cf4e530c880dc81e98
SHA1 da281d3490f82b86429757eedb393c2b8cef24c0
SHA512 bf53a42fb916a8af2229d563514de8298a33610e4e762272cdef448eb61ebaae4c8ad7acb3deda0503104478959dc2b89921870a469c115a2e8d7cc3180e2178
TLSH
T1A9E0D86025CDC66B794632DF523EF308C1E2B502EACA69277F0DD8C06606A447243651
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 0a7d76b4763d6de3c8b8726775119c43d74261e9ca5c72559c695fecd2ab1afc
MD5 f3fd2585401f90ed8d93004f4d723b59
SHA1 f29b31bc94ad244e6e5a82989a6b858387c4c9cb
SHA512 d312aba3dbff41a5794b712426ca44e60ab1bb662dce2094be0310fce94cdf3f1266d81a09d704515a4f5ca05123e7d6ca4b06965fa3039e58c0516dc9d7efeb
TLSH
T1D6E02070A5C5C63A6C04718F467FB71DC2F1B80697C53943AB08448065019007367994
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 c227888fe340fbe351a54f36c71fc21147a8b40ac3539340dd60376ba6a407ad
MD5 15ca1864d2da46d0ee3480ede5344285
SHA1 3d5a2023b95e440c4e126528c78e404f6e94f12d
SHA512 6cfcc85c7f09aa8c7d35ecf8c167dfc145fa8273d1c46586b7a7bd13a7c3afb967a3cf40b478d5fb8c1688801f2e0771fab035f9ff121cd45a081690597f3e68
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU107bodB+ng:EJGnYNSv9PpHV/qjevoP+g
TLSH
T105C22A13353A03423CBE290DA6A686779E4231B33019E97F7BA904A64E67E114DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 92a3bb44d1556d00e4b22693e4e87944096c3beb0ad16fa8b8ae3a438688342f
MD5 ce403e1d7cd67b4cddcafebb80f5a661
SHA1 181384e2be90ff66e70b2476a8934887d885603b
SHA512 f5933b3439ecd9b13329d59eec42c69e1829ea3d517d21397f973c40c95c5d012bd718c03d841da38943e31598aa38fea3c5bc8d082e310165660210375e979f
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU107bodg:EJGnYNSv9PpHV/qjevoO
TLSH
T1E6B22C13713A03423CBE290DA6A686779E4231B33019E56F7BA904B64E67E124DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d70a322dcae4a3b13187a06cb8956019970e62a65ee3d972176f2259717d6638
MD5 35c77b7579853420c260fabcf3aebdec
SHA1 10de1e7132500be53cb76af23cc7d678ce7502a4
SHA512 0d932f7e6258b6f558094aefdfbe13dfd825be6352b10a1740f560864b3dd7f01a1b4f53522a0edd8da57a691942344e90d4455a45e4a39a8bf9291953555437
SSDEEP 192:P+xWFFCfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx0CfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13224630A7B747001EDE6D9721CB080771E3CB16DCF22A6915DB664698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3b046db-ae22-417f-97a7-9b674dcdbf3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3b046db-ae22-417f-97a7-9b674dcdbf3f.tmp
Size 414B
SHA256 4bb7f5c63090069098a20c5238a27cfb2011f0e55cbda9d33fa690d169fc2e7c
MD5 420c44b8b6624acc7bba50c4d2df25e2
SHA1 05c7e5d8874cffb743c1725455fec8538dce6e9d
SHA512 37553d9c04bf1e9d9a87bf3bb87381c13347ca266cd667424d2cf5eb41f1d51eaada7fa45ab5ef7ae4a09dd83eed5062ffb7020bf08720c3e0ea242f7c65b1de
TLSH
T193E02BADCD21AC3704FC171C68550B46D71403172A40495F3E3DA11C8FB163B5687C5C
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 43439c8bf1b6042f167d12ca6f354e1b6b6879f8922170e8a6da63743d4606c0
MD5 ddbf1822c27d683ceb4c62b3c1c1bb77
SHA1 ce71afc2e3f43af0d0ed1c4f6748d281c2059bce
SHA512 1a69619fd5f50d867dbb52eb1d74fb013ededd0953b4565318de4b754fa90a34b368984f71b7d9fc976e2136cc0e492aaeefb71c78fcbf64e969efa1916a3d73
TLSH
T13F5167C1A3A955867FCAAE46C22B5513BCE13E7A260E5CB6731E44F44F84C250E3FD29
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 c506e88d9e8dcc92dc6dbb8e189391353fd3b52c4c2e0ee364488819001bf571
MD5 6b963275562b856cb9f2c399991e57b7
SHA1 ab70d722198ce279bf6cac256484a932dedcc46f
SHA512 3b00d219d42f0542b11a76e95df6afd754bc8edc3826a6fe78c040c3c5a85bc478a66b05135345678adc7dae8fa9f7a3fe837587618832d669870399bcae2dbd
SSDEEP 192:sBOz/Asxlr+xrsG0fqQlWQGIIIVbFMIMnuYcYC:7z4sTWsn8QGIIIVbFMIMuBD
TLSH
T128524F1927072F3BC95E2FB617664B551BD8A841017B232F3272284F8DF3A9786C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 eeb832c526295ed64a41256fd2a542b26eda99ce75bd2a71fa82bc04eb1669ab
MD5 05aacc93efbd5ab98e727900c1883081
SHA1 b34589df4d46a413d15fed3563b04039521890a0
SHA512 e2647ba34e90754863706283f1ba59a67bdaab542eb096e60a8dd71fb4fc0cba1b5620d24d14cf1bd563e69680fd18378ded25ea6572bb1d6a3dd2492d5d686f
TLSH
T16AE02655BDCAC1AFBD2821CF117BF30DC2E23907EE89290B6F05C888A402508F687991
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 34ffe9c59b47a468880e53f99baf157ac2bba9f7415113fa619bf302b71dbef4
MD5 585ff17e2e1d3f6c3e903036dbdea758
SHA1 529b5aac421611cf1e4200b2a1126a81a4f346e5
SHA512 16f3b4d1cd73c28eb5734c8adaa9cd3018b136ab6f49bd9db6e0cb9b9d943c23c76189f40f9dc6ddb82567e6933d4d1b32ebf1b924305846f219dcfb79259f5a
TLSH
T1D421D055F321C259E28E873E902A97661338E9129FFCEC0F417964352D71B041E8B6F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 8fb30d547907ec1098c3f53e3219a9ebe59a88d88dc48f1add8906b0af1204ae
MD5 665bc7cea962b1054431a2c9135c4962
SHA1 db89e99e29cc86e04479474b6ac7f786b0c8276f
SHA512 376432529509a3fe24485b2b82d660b061a09456dab574e0b1d834ae0098eb2b61aac38b0b1913048878abd5016492e277287a46b6a72d2ca2b82e06c445c1b3
TLSH
T1E2E0201078C5C1AF6C1421CB217BF34DC2E23807EF883E036F05CC8465416417E57561
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 67ac56e55bc0b1826838bb9bac79930a64268ce1ce634833ef6cee3b7a83e3e9
MD5 7c531458d5e282f09d38a34f8d6de9df
SHA1 ee1eb8e3599f1b1cf75a0f54e6773b132e3498dc
SHA512 fdbc7bfc3c4a423e835f489ff6de5b784df163ff382c7b18dc70fb1b58c18106ec840f24523d493f3cc3440a4c8f37a8238b1a3a040c8d04c22a0786fb936381
SSDEEP 3:MsEllllkEthXllkl2zEflMYVu/:/M/xT02z/YVu/
TLSH
T1AB44040CFFC1044DD55150714051C35033F1D4340713574334D10433FCC75404C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 783b19e221dbff64a6613dd02951e9e3e933874055e0f874d3553e64cdb7bf6c
MD5 77468266b1c7312b83bd4afd6308ea5f
SHA1 719e3f054b3e286091e577b27198a3368f0f6c84
SHA512 c126103ff8cb3943a37780b7abc5f2723a99af3860cdff7131b766b013e4c6aa9a152665bc5527b222f8b215f2a2331dd619ce72179a17783a73b9e8adf8b4e0
SSDEEP 3:MsEllllkEthXllkl2zEfltN/:/M/xT02z2/
TLSH
T113440204AFC20449E6005031805183603370D83005116B4376A104327CD65400C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 265878ff3a78929896160f472dcf060d3d44d6f3d5dcda933baa3303f8c4413e
MD5 0d026751ce18b94d02835d36f5c17754
SHA1 3a573f000258759f5f5229a9209ce26d5532a312
SHA512 257314937593d4fe80e13cf3830dab159f35cecd6f8562d05d5190f161349995e71439c62faa9685785a9f2b442311ec628cf306944f08885ba9747b591040ca
SSDEEP 768:mmFccps3HwglgNVHSKd7BbQ1DIhkoFYS/vg:mSs3/E3d7RQhIhkoaUg
TLSH
T183B24B36EC98CEBBECE64FD9E74A7A03DEE011A3859899D4DAD91D0D00971DD034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b68ee612e0d480ed83df2c93af0ee43be36fba78c299850e1fe964ae4eb1741b
MD5 3e4d472a937a21f868667cec3fb5ae98
SHA1 9154a19ae8584430798baf48792883cf5ca59449
SHA512 09ba60a9a84deb1adacdc6093b8a9a804e3df9e94a791547e63623bd3be433efe1847ecee90c724fdb3a7959a4490cd44d1d9a654dc8aa7ca6d45faf905000ca
SSDEEP 768:PFvxWwgpB+hVHSKd7B8S4Qr4k9xmnewBKZOUx:Zxuk3d76S4QkimnevZBx
TLSH
T14CF23979DC54CD7FA8EE7B89A74E2A1299E40273D4B88998E3D81F0D807618CF707C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c960af4ac972c2d630c0382b4363b3f49ea6ccf94bf02287c6ed07399dc78979
MD5 4de89f4a9c5c77922462301673fc96db
SHA1 38dc107cbf56b6ed59ad16576d253ecf3c4785ca
SHA512 3c92826fb1db15da3e0ae77e1e766dbf0e8b327a32b220a0257289149f7d21c3b25e5b4e16de962113d88e1b75667da666ceb32f0874c8fd67fba2090d62c4a3
SSDEEP 768:PFvxWwgpBDhVHSKd7B8S4Qr4k9xmnewBKZOUx:Zxun3d76S4QkimnevZBx
TLSH
T124F23979DC54CD7FA8EE7B89A74E2A1289E40273D4B88998E3D81F0D807618CF707C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 61783aa9f1bcf0d4ee9fc7dc19a8fcb82270dc0c590cc37fd02bccd6559f2ceb
MD5 e7bad9ed587452d83aa1c59157f5834f
SHA1 a2876411f65c4ddb97e1fadf91ce513d71692ccd
SHA512 99b36c69b337a99b65e59e6cf43a4ff1669203370c35d4d5cd1646c5d76a117bb1b30739445a9b56c2e375a2aed34a0cd6e9cc8d41614cede9cd004e65e032aa
SSDEEP 768:GFccps3mwglR8VHSKd7B8S4Q6D2hkoFYS/vg:ys3mu3d76S4Qm2hkoaUg
TLSH
T157C25B36EC98CEB7ECE64BD9E78A3A43DEE011A3C58889D4DAD81D4D00DB19D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 17056e2a8edfb19ee34f00e61f4ce58624608312752427958a2f6417adf82517
MD5 816a6458d0be37ade3cfd39132099349
SHA1 3b44a3b2efbe4776907227ecfe736ef905cfb097
SHA512 dcaaa5a4ca79b926459e37b82d2b755df3b7635bab3b2626079959461096004127891e252d9b241b1d472800e75d317e075efa0806f8b11f5af81a7ab0f3ae51
SSDEEP 384:n0iF9CcmyWC03sN58TUNTUlI4k4ZzoNm98TwBfgVH41Lvpgd7B8wFl4Q3D23xHyU:PFccp03WwgkBIhVHSKd7B8S4Q3D23L
TLSH
T13AB23B72EC58DEB7ECE65B89F78A3A43DEE011A3858C89D8DAD91D0D009719D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7a97d352a8d1431255cfa1fff1efbb2e2dd7b3e772524d877b1bf80faa60885c
MD5 385cedd9937a9396e59741e52ea17f79
SHA1 27de9e9d57dc03aa96ac5536fde73c0d73a6d6a0
SHA512 3cb560bff07a3fcac27defd1631b8aa3af4615511a061213a97854a37eb431b01bb99c77d66ab8bff05e7ab83817283099fa5c6640d398bd5c6d4d1163b041de
SSDEEP 3:MsEllllkEthXllkl2zEfla/:/M/xT02zb/
TLSH
T161440404FFC00445D500543041F1C3503770D4310511574335D504337CC75400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 a6be26c7d3d7427d50f7274f09d41f24e7bb0aa715fafa2ef2b61d35edc45923
MD5 113f9006cc056a89116e6a831c27febc
SHA1 fb40735cda440c2e9a75c64da15285bf840327f6
SHA512 0a832b3bb06eb087dc32b44da6e2c8773747d583e9aba761ccf29f6b236469e552c7b60213f6ae9d7df32a643aa1f2f43b94517984323531103eba2d87143309
SSDEEP 24:r45C5fbqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwx:Zpbqp/IHRH34kWqB1kQnjhHmr6ITmUq
TLSH
T18C42886EDA2CA9A2FEE00B3ED7D1D4127B36AA0EC2E4D9F1095B405746C444405DB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 272659ec4e15581f86478196637d8c42f83cc21fa7e6c7710b3aab804682abcb
MD5 fe8ab1110ff8586c93db9f9d30f26eef
SHA1 e4bb3edd1eb4ab229f0d9b39439b582351711d74
SHA512 d8ff364830046227527236e5808b913a0ef99d83d89cfd9c0742d80c746da1e2a5c5ff640abf52021c591e82d54eecc0f7361eb60c2c8b80239154f61b22003c
TLSH
T1B1410758BAE91158B3B77F5AAFF6686E487B7C772E0AD45D00010E4F4A72A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 2a249ef60221606ecc29e87b9b8167f46a52bb169a7a4428f11af85eb9985f1e
MD5 bbbb098dd6318b44f92343ec23cae1b2
SHA1 7b53b8790da6788d3c3191e8a7b6a349085bd05a
SHA512 33adf3aaca1fdb2e04758457193c92581d7a47ca3cb6d529ad109c7b8fe8b5be495276063d581204139f17d2377f90dfe3e47e544cc885cb1daf876e20181855
TLSH
T1AD512D6C75F91049B3B3AE559BF6786E487FBD272A07D49D00110F4F0A63A00C8A273B
MD5 SHA1 SHA512 TLSH

Submit Download

a1f3435d-a4e1-4e3f-ad70-b1fc370eab47.tmp

Path C:\Users\Admin\AppData\Local\Temp\a1f3435d-a4e1-4e3f-ad70-b1fc370eab47.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

memory/4860-4-0x00007FF719DA0000-0x00007FF71A7B2000-memory.dmp

Download

memory/4860-3-0x00007FF719DA0000-0x00007FF71A7B2000-memory.dmp

Download

memory/4860-2-0x00007FF82A920000-0x00007FF82A922000-memory.dmp

Download

memory/4860-5-0x00007FF719DA0000-0x00007FF71A7B2000-memory.dmp

Download

memory/4860-123-0x00007FF719DAB000-0x00007FF71A16E000-memory.dmp

Download

memory/4860-1-0x00007FF82A910000-0x00007FF82A912000-memory.dmp

Download

memory/4860-0-0x00007FF719DAB000-0x00007FF71A16E000-memory.dmp

Download