Overview

overview

8

Static

static

3

Beg 3.exe

windows10-ltsc_2021-x64

8

Beg 3.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    868s
  • max time network
    812s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/08/2026, 19:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Beg 3.exe
  • Size 6.6MB
  • Sample260809-xqwvjsck8x
  • SHA256 2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Probable phishing domain 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Beg 3.exe
    "C:\Users\Admin\AppData\Local\Temp\Beg 3.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5364
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
      2⤵
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff9a39cc188,0x7ff9a39cc194,0x7ff9a39cc1a0
        3⤵
          PID:1516
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,13349703911967457080,14351752947305333683,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
          3⤵
          • System Time Discovery
          PID:5072
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,3894431985701404537,2250930658115094436,262144 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
          3⤵
            PID:4088
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,6435759170611731861,15214011843025037270,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
            3⤵
              PID:5236
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,2942660578440217604,657449268445685559,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
              3⤵
                PID:3648
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,506632702295734716,10084158097471975941,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                3⤵
                  PID:1812
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,673072212727124209,2511598683223015379,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
                  3⤵
                    PID:2700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,13877596927737653642,7464348599054663291,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
                    3⤵
                      PID:840
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4336,i,14311909966554553467,3438242304119143321,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                      3⤵
                        PID:984
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4448,i,10895390630495360076,3411253982034302776,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
                        3⤵
                          PID:2864
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,4559432952814527620,24451868308503079,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
                          3⤵
                            PID:1196
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5404,i,14815922064840264818,11472880439755637670,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
                            3⤵
                              PID:2148
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,15964427944380090248,9167280921105175425,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
                              3⤵
                                PID:2408
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5764,i,11380285897225814986,9592697784157255953,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
                                3⤵
                                  PID:5608
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5964,i,11341842232639012343,1364606900149062459,2097152 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
                                  3⤵
                                    PID:5748
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,14398890845295385878,8992779901914723838,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
                                    3⤵
                                      PID:6072
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,17961557100414610810,2865645751279207348,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
                                      3⤵
                                        PID:4352
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,9339340644372243429,3934004379339464818,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:5932
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                          cookie_exporter.exe --cookie-json=1140
                                          4⤵
                                            PID:4984
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14762544762145514726,17222148313549305375,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
                                          3⤵
                                            PID:6052
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14762544762145514726,17222148313549305375,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
                                            3⤵
                                              PID:5936
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,3240539889121134178,5735420755328606764,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
                                              3⤵
                                                PID:2968
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,7369774898864922796,9936619988594716864,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
                                                3⤵
                                                  PID:5076
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,4214996362992900659,11099214235137575400,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
                                                  3⤵
                                                    PID:2244
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,9859230250329923815,5077168774688499140,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
                                                    3⤵
                                                      PID:4736
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,9932742613339663697,1248294420528221777,524288 --field-trial-handle=2036,i,7187895687345618728,11266214582422244760,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
                                                      3⤵
                                                        PID:2372
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:2516
                                                    • C:\Windows\system32\sihost.exe
                                                      sihost.exe
                                                      1⤵
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1800
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe /LOADSAVEDWINDOWS
                                                        2⤵
                                                        • Boot or Logon Autostart Execution: Active Setup
                                                        • Enumerates connected drives
                                                        • Checks SCSI registry key(s)
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4504
                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                      1⤵
                                                      • Enumerates system info in registry
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3744
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4008

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          blocklist
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                          • Size 105KB
                                                          • SHA256 70ec916fbc4bdc762d303a32b425b3e0261fdf5d4861f31961987ba096c316ad
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 5f896b32f2101e33ea31c20ee10de2ca1fe3d38397dee0f734c2de97e82aa83c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          BookmarkMergedSurfaceOrdering
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                          • Size 6B
                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                          • Size 3KB
                                                          • SHA256 5157303a1e91af448fbad6028592869a125f32cefe039498a8602874fd150c13
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          the-real-index~RFe5888a3.TMP
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5888a3.TMP
                                                          • Size 3KB
                                                          • SHA256 fae72c4c070e8f97bd0336fe43f15b14333a94fce50cb9b85449aeb4f308888c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          SiteList-Enterprise.json
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                          • Size 2B
                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Edge Profile.ico
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                          • Size 70KB
                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                          • Size 3KB
                                                          • SHA256 8bac298651c8716b2ddaa6dfcf52a13dd2bd99609701a10efd0d8fb33ce710ab
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          SCT Auditing Pending Reports
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                          • Size 2B
                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 13KB
                                                          • SHA256 fe4fb3c989ccda0346877264ad302cea57844af6649ec4728371b76d0010fb33
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 14KB
                                                          • SHA256 744b172f06cb4f2ae8a822d455cf479b0e06b3fbcf54b665f9fef86b92d488e7
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Secure Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                          • Size 37KB
                                                          • SHA256 53cee0be0293f3c26c5a9c0d354d01629410e2d471ede005ff28898796523a6f
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          sync_diagnostic.log
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                          • Size 4KB
                                                          • SHA256 df5020bbad8355dd6ccd15b096f811015470db22967ba6f87a1b647484210e0d
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 20KB
                                                          • SHA256 d295f8de1649b9eaa88c732b6360f689cd478323a0289002b24e82417fd15004
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 26KB
                                                          • SHA256 1357dc82c39e26ed4cdc0c6907b19420b999a550298d253f0e8cf92cabba38f2
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 8KB
                                                          • SHA256 8b49943bd2eb76cbf0f15bf16dd64af31681d4ea05c382b7dbb56fed8911ed69
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 8KB
                                                          • SHA256 c9e2e49e823f46e76705c3a20682c746d9460fd1e9cb8aae636248e54d7bfb5d
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          data_1
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                          • Size 264KB
                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          ffdcb11a-19e4-416e-abc7-d1e4fa92e1b4.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ffdcb11a-19e4-416e-abc7-d1e4fa92e1b4.tmp
                                                          • Size 13B
                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          b6f63d7e-e417-44b9-9838-5d682c5d715b.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Temp\b6f63d7e-e417-44b9-9838-5d682c5d715b.tmp
                                                          • Size 1B
                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          c3230a50-6077-438c-a66d-653a4d304a83.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Temp\c3230a50-6077-438c-a66d-653a4d304a83.tmp
                                                          • Size 153KB
                                                          • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          48dd815e-e4ad-4ff8-8a45-be98b42a74cf.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir396_1688629697\48dd815e-e4ad-4ff8-8a45-be98b42a74cf.tmp
                                                          • Size 10KB
                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          content_new.js
                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir396_1688629697\CRX_INSTALL\content_new.js
                                                          • Size 10KB
                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          memory/3744-683-0x000001D4FD700000-0x000001D4FD720000-memory.dmp
                                                          Download

                                                          memory/3744-617-0x000001D3E8400000-0x000001D3E8500000-memory.dmp
                                                          Download

                                                          memory/3744-618-0x000001D3E8400000-0x000001D3E8500000-memory.dmp
                                                          Download

                                                          memory/3744-642-0x000001D3F9F40000-0x000001D3FA040000-memory.dmp
                                                          Download

                                                          memory/3744-687-0x000001D3FAF20000-0x000001D3FAF40000-memory.dmp
                                                          Download

                                                          memory/3744-758-0x000001D4FEBC0000-0x000001D4FECC0000-memory.dmp
                                                          Download

                                                          memory/3744-836-0x000001CBE6600000-0x000001CBE8005000-memory.dmp
                                                          Download

                                                          memory/5364-0-0x00007FF7316DB000-0x00007FF731AA2000-memory.dmp
                                                          Download

                                                          memory/5364-4-0x00007FF7316D0000-0x00007FF7320EA000-memory.dmp
                                                          Download

                                                          memory/5364-446-0x00007FF7316DB000-0x00007FF731AA2000-memory.dmp
                                                          Download

                                                          memory/5364-1-0x00007FF9B38B0000-0x00007FF9B38B2000-memory.dmp
                                                          Download

                                                          memory/5364-3-0x00007FF7316D0000-0x00007FF7320EA000-memory.dmp
                                                          Download

                                                          memory/5364-2-0x00007FF9B38C0000-0x00007FF9B38C2000-memory.dmp
                                                          Download