2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86

Resubmissions

09/08/2026, 20:44

260809-zja1lsdl7y7

09/08/2026, 20:08

260809-ywx58syset8

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Beg 3.exe
Size 6.6MB
Sample260809-ywx58syset
SHA256 2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86
MD5 ae5e031b872f4a18e2600d481f032227
SHA1 d31ffa1787a163711fb8f031a08fda238abd1bfa
SHA512 fa35ad73bdfb6d8169d127f5bb2114819b25f60487ab2b48f5937d6047973599f3bf7b4f451cdcfa2741da12a9b8cf35737e6af48f53e6c688988336dad760d3
SSDEEP 196608:JGkK1QaQ2MbSxCA4OCbTdTwio1ZVmDytXeL:JGT1QaQ2soCAIbTJwN1ZYDyVw
TLSH
T1B16623BDB298226CC01AC834D533BC4AF271744E47B5E5EF73D6AAD06F2B4609635B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\lmhosts.sam	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	beg_run.exe

Executes dropped EXE 1 IoCs

pid	Process
2100	beg_run.exe

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	200	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a28968926a4ea430	5
HTTP URL	43	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a2896577ce52e62c	3

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2316	Beg 3.exe
2316	Beg 3.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_1761937101\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_301403202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_916710568\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_80895898\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_1761937101\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_916710568\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_80895898\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_1761937101\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3148_1761937101\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
1204	cmd.exe
4688	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3932	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307797449175060"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{872251EB-BA0F-4BCE-B70B-74398E24669E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2316	Beg 3.exe
2316	Beg 3.exe
812	msedge.exe
812	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	beg_run.exe
Token: SeDebugPrivilege	3932	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3148	2316	Beg 3.exe	83
PID 3148 wrote to memory of 2804	3148	msedge.exe	84
PID 3148 wrote to memory of 4592	3148	msedge.exe	86
PID 3148 wrote to memory of 4388	3148	msedge.exe	87
PID 3148 wrote to memory of 4388	3148	msedge.exe	87
PID 3148 wrote to memory of 4388	3148	msedge.exe	87
PID 3148 wrote to memory of 3616	3148	msedge.exe	88
PID 3148 wrote to memory of 3616	3148	msedge.exe	88
PID 3148 wrote to memory of 2768	3148	msedge.exe	89
PID 3148 wrote to memory of 1140	3148	msedge.exe	90
PID 3148 wrote to memory of 2768	3148	msedge.exe	89
PID 3148 wrote to memory of 2768	3148	msedge.exe	89
PID 3148 wrote to memory of 1140	3148	msedge.exe	90
PID 3148 wrote to memory of 1140	3148	msedge.exe	90
PID 3148 wrote to memory of 4920	3148	msedge.exe	92
PID 3148 wrote to memory of 4920	3148	msedge.exe	92
PID 3148 wrote to memory of 4920	3148	msedge.exe	92
PID 3148 wrote to memory of 836	3148	msedge.exe	93
PID 3148 wrote to memory of 836	3148	msedge.exe	93
PID 3148 wrote to memory of 836	3148	msedge.exe	93
PID 3148 wrote to memory of 1836	3148	msedge.exe	95
PID 3148 wrote to memory of 1836	3148	msedge.exe	95
PID 3148 wrote to memory of 748	3148	msedge.exe	97
PID 3148 wrote to memory of 748	3148	msedge.exe	97
PID 3148 wrote to memory of 3504	3148	msedge.exe	99
PID 3148 wrote to memory of 3504	3148	msedge.exe	99
PID 3148 wrote to memory of 3504	3148	msedge.exe	99
PID 3148 wrote to memory of 3336	3148	msedge.exe	102
PID 3148 wrote to memory of 3336	3148	msedge.exe	102
PID 3148 wrote to memory of 3336	3148	msedge.exe	102
PID 3148 wrote to memory of 2440	3148	msedge.exe	103
PID 3148 wrote to memory of 1784	3148	msedge.exe	104
PID 3148 wrote to memory of 2440	3148	msedge.exe	103
PID 3148 wrote to memory of 1784	3148	msedge.exe	104
PID 3148 wrote to memory of 2740	3148	msedge.exe	105
PID 3148 wrote to memory of 2740	3148	msedge.exe	105
PID 3148 wrote to memory of 2740	3148	msedge.exe	105
PID 3148 wrote to memory of 1844	3148	msedge.exe	107
PID 3148 wrote to memory of 4268	3148	msedge.exe	110
PID 3148 wrote to memory of 4268	3148	msedge.exe	110
PID 3148 wrote to memory of 3300	3148	msedge.exe	111
PID 3148 wrote to memory of 3300	3148	msedge.exe	111
PID 3148 wrote to memory of 4968	3148	msedge.exe	112
PID 3148 wrote to memory of 4968	3148	msedge.exe	112
PID 3148 wrote to memory of 4708	3148	msedge.exe	113
PID 3148 wrote to memory of 4708	3148	msedge.exe	113
PID 3148 wrote to memory of 2460	3148	msedge.exe	114
PID 3148 wrote to memory of 2460	3148	msedge.exe	114
PID 2316 wrote to memory of 2100	2316	Beg 3.exe	118
PID 2100 wrote to memory of 1132	2100	beg_run.exe	120
PID 3148 wrote to memory of 836	3148	msedge.exe	122
PID 3148 wrote to memory of 2768	3148	msedge.exe	123
PID 3148 wrote to memory of 4168	3148	msedge.exe	124
PID 3148 wrote to memory of 4160	3148	msedge.exe	125
PID 3148 wrote to memory of 4160	3148	msedge.exe	125
PID 3148 wrote to memory of 3912	3148	msedge.exe	129
PID 3148 wrote to memory of 3912	3148	msedge.exe	129
PID 3148 wrote to memory of 3940	3148	msedge.exe	130
PID 3148 wrote to memory of 3940	3148	msedge.exe	130
PID 2100 wrote to memory of 1204	2100	beg_run.exe	131
PID 2100 wrote to memory of 4688	2100	beg_run.exe	132
PID 4688 wrote to memory of 3932	4688	cmd.exe	134
PID 3148 wrote to memory of 2496	3148	msedge.exe	138
PID 3148 wrote to memory of 2496	3148	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\Beg 3.exe
"C:\Users\Admin\AppData\Local\Temp\Beg 3.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x358,0x7ffa852ec188,0x7ffa852ec194,0x7ffa852ec1a0
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7144409986318980885,7980725009070377498,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,3721141300106594690,10535946750523255293,262144 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,12440906052288017618,16649602802959556724,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,5638812361634247208,12463573586987174206,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,4018876741332315428,3247735787270888618,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,4678937876570149134,2464005047359642001,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,18446682051803095383,9790362766471191588,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14423367614070246610,6596147523521002953,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,17424984273581713759,12206455518189250142,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5304,i,5766346568967347277,13704194082768208256,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3704,i,14014087108944363898,14181075573140033543,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,4434402863294287243,1318764567232156028,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14747899010065062108,16377397634425642343,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5376,i,16810500425562363143,4091494063864951351,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,7963114986961225498,13076859949026973502,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,7963114986961225498,13076859949026973502,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,15425781946329379790,15924135685124811019,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,18350215915918992241,8354362987878860518,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,5564419070955769645,15363794215913581524,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,1378959378327138272,5603570227809808705,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,17722566347577359721,1438718573797090641,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,153099938543417632,12097086011195859598,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,12601319518538899373,4678448783263066799,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,3078515915438518456,17369487585360171352,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,11091710118387105790,18042683842508785787,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,6367615535135013892,17517073108504754555,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,9065707566155840924,8482780888525992667,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,18199697486307407109,11009787275078882513,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,13742221959521923498,15548124988285177088,262144 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3616,i,8152004866618396233,9128713499828943003,2097152 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,18275314062283665931,5663727602057266521,524288 --field-trial-handle=2256,i,9527617747826096292,14867334913294152826,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:8
    3⤵
    PID:4072
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\beg_run.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\beg_run.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title cracked by begin
    3⤵
    - Executes a command shell one-liner
    PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c in
    3⤵
    - Executes a command shell one-liner
    PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vgm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a23e01a5c501c01142f7279c22ad0d0234c1f7c2d5351ee7e8b622cf733ee35
MD5 6d57b6ef26efb9e1cbd4ce2c9e94493c
SHA1 00c5f8a2d05fddf7761b2da7f22c387355c8eaaa
SHA512 50338928c63b20c9d12b52e3eb0389d277f7e90aa7e1bc7a2cadbfe94c76e1653d752bb26552da529f959285f4e5fb76e1739c1da4d940a2147f310836cb6e5f
TLSH
T1C3715D28101F40D2EF7DD9B15DDA408E3572A3726AB36EE1317816743AEA7EF8070B59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5881fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5881fc.TMP
Size 3KB
SHA256 892e907189ec81663933c6844b3ee2852a97754ed6afdf7d702295a52feccafc
MD5 d607267e85b4a0a91fe33615548f7c79
SHA1 fef7ce4dba7b89113bec51a87784214efbfba91d
SHA512 41a8882d9d4728d8e3688ad389018a4f5049fb7a1afafd5dea2ce556760c59f420dc7edc6c1736e034532f9088ddd5c8cd9f201f6f425f0f54332b5d5f908c72
TLSH
T126714E14101F40D2EF7DC9F15DDA418E3572A37269B32EE2717812743AEA7DB8470B58
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3c8bdaff7e3616c26388468b65a871344c5072712f42af6fa9c949041020da22
MD5 cea4b5f84fb9128158e772d7b9e63597
SHA1 75cf0547559de819e55460ee36056bbf5b50f5ee
SHA512 55e894ab0698db6eb12d390fd0d1ae648b0b586f3d6595c631a2dfc02973850f51c99b4b5d1348759d65a1c2852c18c317746daadb3cbf45ca5e5bfe17508aa3
TLSH
T18E717DA3C6E8C66EC91157F0A7287E2ECD1E0958422C3C1A89E5EF5F97D20B1E14158F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 07e3537f4dcdea7fb9edd846c47be05083f8b65b9ee72021324cd67ccec6db0f
MD5 7df3132eef27ad5b6ce9c8a2c94f644f
SHA1 92cb83b53a39c6202474027cb0515ed8ecf27574
SHA512 1c7b657ca6585fde4bb2bc19156e6c154c670280e9d4efb2a85c9fd76ac5eb022342d85288b16af33b15615b3299cc4f587f18573074e503433bb19939593093
SSDEEP 192:sxZJRDiF/fWsDLtUhJIdpY3nHW6+WN3sC/zHTnYUqqUIg4J:sxZJMF/fWsDLOhCCHb1/jkDc
TLSH
T17F32C9526E38A97B4CCBD219BB15BB13E6F55032A0C51E98EAFC961C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23e166e4823e2a0612ee590ec9b5f6b33965ae9a3f97901ca984442346840e73
MD5 a6a8b2c453eb024b76b5bd0f17e2f886
SHA1 734cd0b71acc078d5e32c56a04d5625f79cca236
SHA512 3be8ae832c4f941c7af74a176bde937ed696a49cba2f08d32346f069270bae84bfc2f5ccf85d22cbdb70a04c6364d9b4fc3883324c7d054ed28b3101b1a825ae
SSDEEP 192:sxZJRDjF/fWsaLtUhJIdpY3nHW6+WN3sC/zHTnYUqqUIg5WJ:sxZJ5F/fWsaLOhCCHb1/jkDg
TLSH
T1C132E7526E38697B4CCBD218BB15BB53E6F95031A0C51E98EAFC961C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 406e10e873526f436cbe04226cc017bbc901a337c3f5a168e2689e2347ecad31
MD5 ff65d6707b3859a0c95deacc97a85985
SHA1 0d0024063e3712aa2c5ef19bf98ccdf37f1f26e0
SHA512 11650f29e305e1bc624060560ed9246aad64a19e693e90037461ab1af9fa4c013531131aaf638110479690573e8e2477655ecde207ce08d99231d36b80270690
SSDEEP 192:sxZJRDjF/fWsaetUhJIdpY3nHW6+WN3sC/zHTnorqqUIg5oJ:sxZJ5F/fWsaeOhCCHb1/jbDu
TLSH
T16732D8526A38697B4CCBE219BB15BF53E6F95022A0C51E98E6FCC61C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ae4ed25269811db5a931356dc3220fbb5c33e5e63d61acecf80e90b98b5c6f32
MD5 3da55a542949191c1ff58c140543d4bc
SHA1 17d65f6fd48ed6c1c3481806d06b14a1da23b546
SHA512 c114211db80407255bb6b9838c0b65e45b0395573e4f5f312249bce5d7cc9bdc6b6309095866ddb0ef3dcddd96ff56985b755baf63840d2bed8bf84562842b91
SSDEEP 768:xhWR+yJ7pLuLfQUWv0s+g8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+w8TLlTBs/Croi:xhWR+yfEfQUWv0s+gu1jaTw8TLRO/ZtU
TLSH
T1B4E2097B784CCA7E4F800A9DDC1A7F8F6DE802CBA698C95047F9985C02C77EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 308bd715617779316c07a66bb63f55d3e3d693cf365c311a95820fc2fe78b4b6
MD5 75c4108c77216985723a87942d922417
SHA1 16695f9271f5e1a357aa4fa5e53627713bb1bdc5
SHA512 5b8b00c3381899772926a0792a1e12ffee14f529997f5803752fe37d94675f6d6dc40f90d92437df8ef570d0ccc5d61907f21e8e075032c0a2cf32559e775383
SSDEEP 96:K0SoK3qWCPEuE9ECE+E4EUEwEkgEUE3EPiEWEkKKEBiEQEkmEeE+EXE4EeE5/j2/:ODIXqVpXlFWJg1h7oiXoPHYhlC/j25Vr
TLSH
T13691B25131FE02453CBFB848919E962B8A5132A3321DE56F7BA851A20F6BF005CFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

359690e1-0ceb-43b6-bb90-44bb3b1d315f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\359690e1-0ceb-43b6-bb90-44bb3b1d315f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 839481c58c874631a4a4a3a35d53dfb028bd50fe9b23d54457244be38c4724af
MD5 9fdd0ff5831d23533a07e3798c22354e
SHA1 a693df6d90cfa2e412108e3766676e5a740ba123
SHA512 743f38bdb33d52e1891bb1ca0040a67b3558b2758eac56313d0d4b6d32d082b43f49335ea3f4a73b28f53b780166861bfe0aaab2747c1416b13cbbfbc2ee8367
SSDEEP 384:nwiFmZcIV8sNO8TUNTUlIlAq1ieCvn5DDfwt54atKN7elDYobknTKwBODNZOCcKg:LF0yjwgavnCtxINqlTknewBKZO/X
TLSH
T1E4E2D5F198E79936D9AE9783A73E2E028DBCD163B4845994B7D85D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 71f8b633e61bde732c9e9dd90bee7d1c1ee56d13400436774bfdc1c03e688e33
MD5 e7322afbd3f0ad86731ccd2d5e3e1ef6
SHA1 c88c5ad103d94d243ca6e3130c5ece0a6c343941
SHA512 50fb861b55ef6c0e78d4ebf5b0085185b36a9d44c485c428f775cb63fb835bf7ec54269b09c1f570b94af2543e56118c50f76d4c1711ca7080dc2114dd85380a
SSDEEP 384:nCZcIhsN+kj1iehvs5X54atKN7elDYoYknTKwBODNZOCcKD8:wh7qs9xINqlgknewBKZO/X
TLSH
T103927C7198386C764EEAF445B98736075EF861B7E5C42E54D6ECAB1C00EB288270F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9767df61b3f803deb347df515004e6f8e86a682147902e44d64866367ab11e5f
MD5 fd58a9e4b3b18750f3e68b269893a727
SHA1 b829a121e096391894c2206064afe6389bd2acc0
SHA512 07022d96e333aa8b1cef215132040e2103439e8301a15d5aef91da63a18d5544f364ccba738fa35652b59b696c06165021d91c121455f7c9ca5e8eaaa852bd0f
SSDEEP 192:CONP6G+bgQmiUyqhDE54aP1KN9xc8OytFU6:CONP6HgrDE54atKN7HPU6
TLSH
T10702C735A8382CBB9EF3AD45B5872B135FD5112BE6906B44DAEC1A1C41DB38C230B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4ae8aa914cc849c54d73b82294fa666a8cae4396a81976c556dd6c4d3cff46e0
MD5 0c7b4edd92fb3f57ae3b5c6c5c077a60
SHA1 8763ea9f3440c7682d6c9a40a29b0f609d10d27e
SHA512 809f11babd6485674f32fef88d9186fa79fe018ee33c5182a37709006ffb09d6a3f8f0fe3f60a29777f0c1b6f67a90871263ef78ebea29076236bbfd0ef92d9a
SSDEEP 384:nGZcIOsN+Aj1ieCvs5X54atKN7elDYoYknTKwBODNZOCcKD8:UO7vs9xINqlgknewBKZO/X
TLSH
T138927C71A8386C7649EAF445B98737075EF861B7E5C42E54D6ECAB1C00EB388270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 27729833a4fe1df0f9a7e2144a364af903d112c4042fb89a533871a02cde6616
MD5 9015abaf510654946592e9e2217baad9
SHA1 cff964e4ef1a2958abdcf428af6221d8cc0991c9
SHA512 a49ce67a5634ed4b1a30f2f38b07456fadb97b9e0f0c35df4902e3515973e41173934c4282bf0b0f79e8a6d9deea41fe2f5f8304940f6d4ae997f1049214e05d
SSDEEP 384:nwZcIOsN+Aq1ieCvs5X54atKN7elDYoYknTKwBODNZOCcKD8:OOuvs9xINqlgknewBKZO/X
TLSH
T1DA927C71A8386C7649EAF445B98737079EF861B7E5C42F54D6ECAB1C00DB388270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d4c1b696034bc8de9a69e60e5b6a55281255512b498cd1d7bae497160f2553e0
MD5 6d249def845b2fe440818e28af6d79a4
SHA1 8c3c86f5575d02d56383937b46141d41e30562ef
SHA512 2dd5b905339278cd31535641392c786ede4a3c4495774249d09be764b1a2e02ad771c3c2a3fdf9e299bd3cfeeed1af087e6fddb34348c578c80b50459f9684c4
SSDEEP 384:nwiFPZcIV8sNt8TUNTUlIlAq1ieVvn5Dffxt54atKN7elDYonknTKwBODNZOCcKg:LFHyWwgaWnntxINqlvknewBKZO/X
TLSH
T191E2D5F198E78936D8EE9783A73E2E028DBCC163B4845994B7C85D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4202c91d800d87730e8418b30167659bfa8a7d6acbf6c9b19cb662b145cf3cf3
MD5 ecb688e76b01557c78ce214ff3c9144b
SHA1 d204f64ffb1912b1a248d88f1510e7df4c9c9abf
SHA512 aaefc1bc45b7405130944bd2fad8f358b6c317b58e571e263941138cd734cd04eb1aba8f051d245c4ed10ee8398cd2a39bb7508794714aab91f36e70292e488c
SSDEEP 192:wONH6G+bwQmiUy9ch7E54aP1KN9xelHjPwoM8ShlqcqU6:wONH6Hw2C7E54atKN7elDYoIkU6
TLSH
T118120830A8386C775EE6E851B5C73B136E992277D981AF54D6EC1A1C01DF34C2B0F52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

315f1de9-9fd3-4572-9c77-c4cbc2c7fefe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\315f1de9-9fd3-4572-9c77-c4cbc2c7fefe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 515159bf6fb41a36f151c2bd4b7987d1a2ee6bd47be9618752f6fd52dca2d811
MD5 f454de59302a327e7b15e56441dc2aea
SHA1 e59143c7adc82d90af43ecec2f992fe7f8afe9d8
SHA512 e8a9ee52a1da84f9547c5f18777a875f6618291807e955275db3fe5f8d2b81eb582b06f050a4e0baf279059d08db99091c2b5f3ea911869d4f6376e012d227ee
TLSH
T14A410958AAFE1148B3B77E5A9BF6A86D483B79372E07D45E10110E4F0A22F40C9A1733
MD5 SHA1 SHA512 TLSH

Submit Download

beg_run.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\beg_run.exe
Size 375KB
SHA256 4d953a571b7535bfebe4934c85af4fbebaeba6edd3130b27a5f5f1ad5e208da2
MD5 bed6e5c0330cfea739a67578b39e5947
SHA1 86e90b181864d907553cdb99e8ad02d5c2241beb
SHA512 09328ac23039c22bff1310697ecfceb5bba5da892efbed0425a856bb51550aff0f48892807f22ec82d55720a2259bb2fd2fb733e901bb3e1cda62eed57fb3ac9
SSDEEP 6144:FHV3Am/B7IkcuvL4uKPAYf7aEAxJv76QQbUYPZAlsLSlL6XpVwF8HTL1ap+5Ac7f:F13AmBFu4jxJjyXaLcVw6X1a490Cw3bo
TLSH
T192847E2AEA5804B8E167D178DE638803F772BC8D03759BE757D49B620F175D0AE3EA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3a3c402-8745-4177-8619-74d9d42e09b6.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3a3c402-8745-4177-8619-74d9d42e09b6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3148_222166883\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-0-0x00007FF797DDB000-0x00007FF7981A2000-memory.dmp

Download

memory/2316-3-0x00007FF797DD0000-0x00007FF7987EA000-memory.dmp

Download

memory/2316-2-0x00007FFAA17A0000-0x00007FFAA17A2000-memory.dmp

Download

memory/2316-4-0x00007FF797DD0000-0x00007FF7987EA000-memory.dmp

Download

memory/2316-1-0x00007FFAA1790000-0x00007FFAA1792000-memory.dmp

Download

memory/2316-447-0x00007FF797DDB000-0x00007FF7981A2000-memory.dmp

Download