2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Begin.exe
Size 6.6MB
Sample260810-vy38gshe57
SHA256 2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86
MD5 ae5e031b872f4a18e2600d481f032227
SHA1 d31ffa1787a163711fb8f031a08fda238abd1bfa
SHA512 fa35ad73bdfb6d8169d127f5bb2114819b25f60487ab2b48f5937d6047973599f3bf7b4f451cdcfa2741da12a9b8cf35737e6af48f53e6c688988336dad760d3
SSDEEP 196608:JGkK1QaQ2MbSxCA4OCbTdTwio1ZVmDytXeL:JGT1QaQ2soCAIbTJwN1ZYDyVw
TLSH
T1B16623BDB298226CC01AC834D533BC4AF271744E47B5E5EF73D6AAD06F2B4609635B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\services	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\lmhosts.sam	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	beg_run.exe

Executes dropped EXE 1 IoCs

pid	Process
4948	beg_run.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	62	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a290b31aec6c68c6	5

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3840	Begin.exe
3840	Begin.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4228_521918839\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1262774862\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1172897727\_locales\ca\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3700	cmd.exe
2588	cmd.exe
5304	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2540	msedge.exe
3436	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1084	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308563064063472"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{7E2D399C-2584-477A-A3D6-B6674B836AC6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{4984E0C7-9739-4C03-9B38-77372D24FAEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3840	Begin.exe
3840	Begin.exe
1808	msedge.exe
1808	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	beg_run.exe
Token: SeDebugPrivilege	1084	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4228	3840	Begin.exe	90
PID 4228 wrote to memory of 2684	4228	msedge.exe	91
PID 4228 wrote to memory of 5444	4228	msedge.exe	93
PID 4228 wrote to memory of 2540	4228	msedge.exe	94
PID 4228 wrote to memory of 5444	4228	msedge.exe	93
PID 4228 wrote to memory of 5444	4228	msedge.exe	93
PID 4228 wrote to memory of 5932	4228	msedge.exe	95
PID 4228 wrote to memory of 5932	4228	msedge.exe	95
PID 4228 wrote to memory of 5016	4228	msedge.exe	96
PID 4228 wrote to memory of 5016	4228	msedge.exe	96
PID 4228 wrote to memory of 5016	4228	msedge.exe	96
PID 4228 wrote to memory of 4648	4228	msedge.exe	97
PID 4228 wrote to memory of 4648	4228	msedge.exe	97
PID 4228 wrote to memory of 4648	4228	msedge.exe	97
PID 4228 wrote to memory of 2036	4228	msedge.exe	98
PID 4228 wrote to memory of 4624	4228	msedge.exe	99
PID 4228 wrote to memory of 2036	4228	msedge.exe	98
PID 4228 wrote to memory of 2036	4228	msedge.exe	98
PID 4228 wrote to memory of 4624	4228	msedge.exe	99
PID 4228 wrote to memory of 4624	4228	msedge.exe	99
PID 4228 wrote to memory of 4268	4228	msedge.exe	100
PID 4228 wrote to memory of 4268	4228	msedge.exe	100
PID 4228 wrote to memory of 2124	4228	msedge.exe	102
PID 4228 wrote to memory of 808	4228	msedge.exe	103
PID 4228 wrote to memory of 2124	4228	msedge.exe	102
PID 4228 wrote to memory of 808	4228	msedge.exe	103
PID 4228 wrote to memory of 5972	4228	msedge.exe	105
PID 4228 wrote to memory of 2196	4228	msedge.exe	108
PID 4228 wrote to memory of 2196	4228	msedge.exe	108
PID 4228 wrote to memory of 5116	4228	msedge.exe	109
PID 4228 wrote to memory of 5116	4228	msedge.exe	109
PID 4228 wrote to memory of 5228	4228	msedge.exe	110
PID 4228 wrote to memory of 5228	4228	msedge.exe	110
PID 4228 wrote to memory of 4572	4228	msedge.exe	111
PID 4228 wrote to memory of 4572	4228	msedge.exe	111
PID 3840 wrote to memory of 4948	3840	Begin.exe	112
PID 4948 wrote to memory of 3700	4948	beg_run.exe	114
PID 4228 wrote to memory of 1124	4228	msedge.exe	115
PID 4228 wrote to memory of 1124	4228	msedge.exe	115
PID 4228 wrote to memory of 1124	4228	msedge.exe	115
PID 4228 wrote to memory of 5440	4228	msedge.exe	116
PID 4228 wrote to memory of 5440	4228	msedge.exe	116
PID 4228 wrote to memory of 5440	4228	msedge.exe	116
PID 4228 wrote to memory of 4900	4228	msedge.exe	117
PID 4228 wrote to memory of 4900	4228	msedge.exe	117
PID 4228 wrote to memory of 4900	4228	msedge.exe	117
PID 4228 wrote to memory of 1400	4228	msedge.exe	119
PID 4228 wrote to memory of 3388	4228	msedge.exe	120
PID 4228 wrote to memory of 1560	4228	msedge.exe	121
PID 4948 wrote to memory of 2588	4948	beg_run.exe	122
PID 4948 wrote to memory of 5304	4948	beg_run.exe	123
PID 5304 wrote to memory of 1084	5304	cmd.exe	125
PID 4228 wrote to memory of 1808	4228	msedge.exe	129
PID 1808 wrote to memory of 2480	1808	msedge.exe	130
PID 1808 wrote to memory of 5124	1808	msedge.exe	131
PID 1808 wrote to memory of 3436	1808	msedge.exe	132
PID 1808 wrote to memory of 5124	1808	msedge.exe	131
PID 1808 wrote to memory of 5124	1808	msedge.exe	131
PID 1808 wrote to memory of 6100	1808	msedge.exe	133
PID 1808 wrote to memory of 6100	1808	msedge.exe	133
PID 1808 wrote to memory of 5804	1808	msedge.exe	136
PID 1808 wrote to memory of 6088	1808	msedge.exe	137
PID 1808 wrote to memory of 5992	1808	msedge.exe	138
PID 1808 wrote to memory of 1660	1808	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\Begin.exe
"C:\Users\Admin\AppData\Local\Temp\Begin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa93ecc188,0x7ffa93ecc194,0x7ffa93ecc1a0
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2004,i,17188699764976242520,13851890787573438583,262144 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,15251178378412414424,13115141619412418719,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,17488922717606956552,2738003351813170096,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,5153491579908217697,17009337144379473487,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,737537453950082033,5432574202314768030,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,15995987167023320943,232836639758351573,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,8299065695440343721,1231809918304550947,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2297959406991113059,6196468151463943097,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,11833490748319099578,3236455997050299219,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,8938352844555188985,9560048853700824339,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17752256435641892258,14245581263806063548,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17752256435641892258,14245581263806063548,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,16886376752176284962,302751711361897862,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,922657448286186959,13430063637909942170,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,15774080688446397807,13846356624866459443,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,436477726176248367,3389838415913587730,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3680,i,6166448597446733522,13445822870277681087,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3692,i,6881064784201619776,9089936354243099299,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3832,i,11657153006197586710,7513308237579997723,2097152 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,4023107891931760408,16452264864327000306,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
    3⤵
    PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,17306010297994457731,5078998172801107645,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=1396 /prefetch:14
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,5905279329021835871,14166245569057378286,524288 --field-trial-handle=2492,i,11295344485294411529,14761369781387437669,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x264,0x268,0x248,0x2d4,0x7ffa93ecc188,0x7ffa93ecc194,0x7ffa93ecc1a0
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12631095616567525026,16113425582150541918,262144 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,236538120483756301,8601379855532409686,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,4850868552247153598,14657056044923557401,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,4180852699511028469,2721729443209571202,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,4180852699511028469,2721729443209571202,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,16767758639497803790,7336876476379922176,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,11782687567490687185,9943425220103741452,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,2340968444805809734,7626027285092123423,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,1405702019068576585,2194603635136543907,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,427274547633609206,13703274009980827551,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:14
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,11026645983109250184,1745225834462851279,524288 --field-trial-handle=2340,i,14946153744390246859,5888757618178126687,262144 --variations-seed-version --mojo-platform-channel-handle=808 /prefetch:14
      4⤵
      PID:244
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\beg_run.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\beg_run.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title cracked by begin
    3⤵
    - Executes a command shell one-liner
    PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c in
    3⤵
    - Executes a command shell one-liner
    PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vgm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b12b6aaacc3531e2606fa5eb280ae4929c75f82670a5fc331990dcf5f4b1e81
MD5 e293a66f886f80f5eeb21878c0c77530
SHA1 3926f358e61777fe2c930dfb5287451f962a40a1
SHA512 dc4bd1283e4faac05fed23611e49d4a83971a25110ee2bb1461701323edbedf609baf8812ae633d8648747b3b817f886edfcd0604af5ed76bf6c8a9f9a75924a
TLSH
T115D0A7A4BE25B290C519503548600600692A46A2396B968660A5941D9974080A297EBF
MD5 SHA1 SHA512 TLSH

Submit Download

55fbe18e-ae33-4e6f-ac5a-e0b4a310412e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55fbe18e-ae33-4e6f-ac5a-e0b4a310412e.tmp
Size 414B
SHA256 6fdf439d980a52e6dbbe8effa2cde223ceaf9965ced559f428375ee14e4c4288
MD5 fa01d77c7142f9c51ed27a89d6902b10
SHA1 f07403c99a253f0d2772f8156d58e523a442e0ef
SHA512 1e22bfa503cae34aafad08b20f30818e83cbc6d58704572c56774a67486168b00e1ad3ed44f95bede441cf0a2cba33575a6535c69fb29e58cb02cc8a6f949f8b
TLSH
T16FE0EDA9C821FC3709FD272861944A42E760136B3B90992B3B3C962D8FB062A468591C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7adedad0f2cfbead00a03f2819be635dd0702ae077b4f62f9ca15a5bc6fc2ddd
MD5 1d74b29355c1e757260048b47afdd343
SHA1 03a0c82c92e694a2c91b7b3db07f6655a62e4607
SHA512 1eb079101e454e8caa1b979791e2e09b653ebb931f40b0cd294721f65fe9012f0f622ad40c04150bbf348fc2099c581827122c35c6f4cd57994c8ee8af1e2be5
SSDEEP 192:SaFwkSPHimovdoq93w0fxJCevzMEg5pptj7+wpa3Btm/R8jf4zouY:pFw3PHjo3w0ZJAEupLfMS/RifbuY
TLSH
T154136F7E329D2D56C3E3003C542B9F7683F2E42ADAD2491B6B7231525724F415DEEA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e531820a718aea88dda3f632bcfc78ada6a05b90042e7c5b1b6a71e8620f3602
MD5 b0cf4c03c85ee7de339b9164fb4c78f2
SHA1 3ccc602de9488b136c34b5846d06374d0cd93906
SHA512 673033f330b7ea8abfe762b10f85dcd082ab9b611c5dd60e0ea14a047eb4779e9fbd6ace603b05c1c7967cc84bde27ce7a9eb1b81e5b539afc45c7cdea689428
SSDEEP 1536:l/KL/oL/u7V+tK/TEvccRAIZUKWS/uL/EL/:lCL/oL/M+tuEUc4SWL/EL/
TLSH
T128444FF70951A01BCBA852F5E2033A3DD177851E7CD1F8E9E27C4C852829F25B2F9A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 7ca032a4ce6f340eff4b6b872107f3ef04ee004912beaed28f28b871432093ab
MD5 a5785cb5d373ca22454b4cc2427f8400
SHA1 6f70beeee3c7e9b02692395341b7f2f908af59df
SHA512 9878001f19821e46d5e8ca3ccb83b47fab00908ad14c45af18389e1187d0fd9a8838cfb1348571d10add26a76a07148c016c162ef1ab5da0746bc61a707beafe
SSDEEP 1536:hpi49G+PNaMuAN4ZQzJWHRZ0pImI1C1oDz+hq3f4CbBReQcxv0sROsqPRsNuBQkj:hpv9G+HN4JHbmya+Q0mJ9Tp9DkAtaAs
TLSH
T1FF2528EECB681C82CB2B8770B4E0D9077E712183BA4DD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 ed7af87dc19503c8e9f25bee657fc6cfb5fdf117d97ad2a5d43d2066fb9e8ee0
MD5 f6d723ca9fd78b7061b1fca959d2525a
SHA1 cdee2db06a83135653221b9042544a0f884bedf8
SHA512 8b1f7e0d4419a3f2b41d71cc90fb11e8931f16bfff2018dca60bc8b91c7285fc1bfcb34b69f8fb1f41366dd1e80d6fe1b0c96e79c938ef290ab32af7210d389c
SSDEEP 24576:oH+lZF+KSK7gKJ64hJEu5jGl0IpJxZmDMnFXv:oelfhSwNzhd5jSpsMFXv
TLSH
T195167DEDCA7858C3CE639A30B4F0E9477C7413C3F595C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da23a62229dcf7c79c8a49e43f1a3b04c74282f04985afacd53c8d1136d19dcb
MD5 f34107f8916c48a21989eede3842d264
SHA1 2e2b0464be3eaea610a49ff1e64d486b90be1ac5
SHA512 7a7d9de998e20174d2cb228ffdb84869a1b6a247acc2c175c128279ae7d3d6590103345969a3ca935a7240428b2decfdfbafd4bb51617e9114f619632306113c
TLSH
T1E9612D5E332E06F2D32955B960E158583EF9E47129432A008CD89FB03A2EE1D61DAE67
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 613fed0cb26de91959dadb46c73d8a7ab10beb3e54935b246acc4d9ec11b9e11
MD5 1201647285786a7ca8ae9a02eaaca9c6
SHA1 670ea57df58398e39f21a9259613d81ed30d807a
SHA512 b4c6dd3892c98f38a6837759eea43475f0a160a5e5f40e0cf5fcd3dc68fa9c13d1cf29e9f2528f394e92da32848b85fc2643a6e78b87880c20ee32188ca49dba
TLSH
T154612D5F332E07F3D32955B960D158983EF9E47229432A0088C89FB03A2EF1951DAE67
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d98d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d98d.TMP
Size 3KB
SHA256 364a527c931630270a293bd02fdcabda2dfdb148c97576427870d5e8960732c9
MD5 0941a8125d4c0da591daec7e90971d8a
SHA1 87f2e5bef7abf1f208ddecda4b6a94f2b2ebd399
SHA512 84356cce35655eb9a59139ba182d6d2c128cfb6ba550436b6e6553b8297905298082572f7b7d0036f06b3627ae4d7ed2773566cfd003c82772c27e3263ec7106
TLSH
T15C612E5F332E07F2D32955B960D158583EF9E47129472A0188C85FB03A2EE1951DAE67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 15d55eeea1f150b39cbb5b1f2f4dc8cb12f20ed06466b09999e2146669d3e223
MD5 b24dc12ae027956dbca31449707d9884
SHA1 c75dd903d4a06f57e8ad815e227382b929ae2d3d
SHA512 8e06f253672622728a894cf50f89720f62557200a44b12ec27828c320c44c01fff353ddf5e06f8e549fcd3644675b2305db185134da7299b2d9200a4d18efa29
TLSH
T167E0268A04CCC12DEC9668E7867C770887E03402A388BD4277489C447101B45E3CB280
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 638d9c207251173438fa7cb2f861d34d21ac88c3cd4ac10346b4224c9f824a23
MD5 3ecb0aa269eae6e14af9b34ed64f6551
SHA1 b4c7a2e640a3b3dfa33d0211b97a9494e676dfd9
SHA512 e124f0af70dfc6a70a094e4ca75ba1030daee707dd5b1a39afc1de5124befa10f06c0469b71c04cfa357729ceedb424883206e835f8122f5fa24d7886e445d7f
SSDEEP 192:uQOTJYgMH+bF+UI3iWGVoWN3qL/JxWmTVVV63:/OIIkUI3ijVoWN3qL/JlA
TLSH
T1F024331F5F742722CDBC413668EB54A35C7DF02F8B5366DA686104B4CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 421B
SHA256 7bb320e1f250b0ff567f7b615a3e42987bbe606875a949e8b4dc942f4e0eedd6
MD5 61ef6be3d3a7999444b0d0a8fb3e4801
SHA1 bf06d9cbf9f312ffc501b58c49dbf2ded28650a9
SHA512 17280a060f2fbbf64c7c9ad17b6bae9f58442b17e99b3cd63966c676445926ba04fef836643b51d79bbf7632b2b5a4f0184362212715bbbeafd9d7967645e83c
TLSH
T111E061FF2039C616AA1442F931E5755CFB21C31D4EDC91F6CB57A05F15D09B65024CB9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 3df21eaea375bc305d558d24a2450d82ecbfb2d24589aebffa237c067e35c988
MD5 f86f1bd8260d5535639a8f7f9ee576e5
SHA1 4068bf9a14ed39e32aa2549490e0690475b8aa6b
SHA512 e04c69d1cb54df9f700a6ca5b05db094eb860dc6aac5ff584c5cde9e093432140855b77bf4fcc901cc2c194a2b9cd648453305e06f7ed2e8e54beea104714bc0
TLSH
T18EE020A2C5CDC15EBE85204B521D770CC7B03406E788BF422F19E844B445144F7971C6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 43aa54779f0af2872455ca25e277881e48e1cc6c7de3c5e3116dcfdfe0b525ff
MD5 7c40e8f59dbd222a30036be3f0c8d9cc
SHA1 777dd7a149606bfcd8b1d385e43e2f615a5b9889
SHA512 9a8df9f4216054b878df4f17c965bd5d853e102cae4e3ef1f66398c5cfc314848cc4dc7cc05ae881e9fe25062457f3d99a8909256e481365c0753fcf87457c8d
TLSH
T123819DF3C2E5862D8A0156F4AB187E1ECE1A0958432C3D2B89E4AF5B93E24B1E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 413d520bd027ebe30604fd4ba3e4b8dd05e7b8b6d339b79c3a43f77fdb6d4200
MD5 afb6b3f85adfd067d56a7f422242f477
SHA1 78e9c0eaebc42c6dee0052e60bfb172a0691ad4e
SHA512 55c26ff3c8a4573c6318e59e919e13c4d899b0834718b46a4e82cf7450d6eeae6030996f0d1f8af9e4cb3d17c839e813c8182bf886115c47e982b0ee2050a983
TLSH
T19A819CF3C2E5866DC91156F0AB187E1FCE1A0958432C3D2B89E4EF5F93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 51d5d5a4fc86b915a14d4401f977fbbec88d9348c518b90a13a02faba3940ba9
MD5 2c12ac85ed005bac410775829c304bb3
SHA1 01e5a876203a9b495d96368ceed1f5466e452805
SHA512 c528da76b5758485157592829f35dc40d405ce568a28742f6b96ea0ae03f10fb3ccd14a8b7b4e9e8df2b8c1cdfe807698403e4de8fb35c401c65069c2514d25a
TLSH
T148C0222284B8E0B60025C4BE2A80A884A634D834201040B0CA96833EA1C00FB6B06339
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5cac261772d60e4e4f2cafcd1692b94f7f301442fad0842a384a53cc367e1c92
MD5 edafc29d0e4a1c794f7641253bc0d906
SHA1 553c519a7178a12d232e85884ca840669ddfa85b
SHA512 4df50b89c74e54b91c34ee4f01f2893289649ac7fe4cfca64c1ce642fb996b95f01e3dffff698c6b3ba1850955da21c1d3af32493a3d5dfa28fd11ae9dac9237
SSDEEP 384:sxRMn5+4/fBhsEUWvVRNygEpy/5T/lP/4:sIn5+4/fBiYVREo/5rlX4
TLSH
T13752D806A928997B8CCBD61DFA55BF63D3FD5023A1D41E58A7FC9A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 46879c783a6cb60628c29c52bbc36b711cad6936c729afff35d9411aeb102a04
MD5 765d8ba2a64bcbde68b37cda518f7010
SHA1 63761b5b8d9fb7a061f416069d463679ae14af15
SHA512 2f49a992954ca86a2ec149467bd0b08ed52d301c268d17afce30e9cd4ff2c61e3fdaf5c20aaaed8ed06e6aa5e0140beccf7f4737c1da66eed1265b6f2575973b
SSDEEP 192:sxRtnR5C+4/fBhsSUNMZgIZwzoA8pi/g6+WNIYEp+iKtGlIgVSPSRJ:sxRtnm+4/fBhsSUNygMpi/5IRJo4
TLSH
T19232C8166A28A93B8CCBD25DFA65BF53D2F95033A1901E58E6FC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b17711ef03c9b86f1cda78277704bf2b7458169bf4ab910082f7c7cbb3d83ff1
MD5 6299013aa008cb7af26afbc396605f62
SHA1 0af485518d240656d6c68a8177b9500a0e620252
SHA512 61b203014b966721c258fb47e78a1345aa778a692474ad18e6eaa6c60ec2f8df838b2ec84671d8068dfdc0651ce2f38042ac194d276234ddca81380835fa2dc7
SSDEEP 384:sxRMn5+4/fBhsETWvVjNygqgspy/5T/lO/4:sIn5+4/fBdYVj2o/5rlg4
TLSH
T1A052D816A928997B8CCBD61DFA55BF63D3FD5023A0D05E58A7FC9A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e58e14c994895ec4c2afcbc3a3ed0c3cd288288d16720cf74f07b0e54151cf84
MD5 ce1ee6dc3476858c42c16ac68a58c1fe
SHA1 b1e258368010615a7f80489e34cd79c4bf1e174e
SHA512 8b839e778be75fa00bd2651e271db71ff88c695d1d323d36676e8beb83c4d3e99dcc85c570d26a51c5359d1bef2b834280f4f5d05dd3128f98192dcd6d541f66
SSDEEP 192:sxRMnR5C+4/fBhsEvRNMZgIhwzoA8pfKnJ/g6+WN9ic/zLEZziKtGlIgDoSPSRJ:sxRMnm+4/fBhsEvRNygEpy/59/ZJ/4
TLSH
T17A42C816A928593B8CCBD61DFA55BF53D2F95033A1D41E58A7FC9A1C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1a7f1b68b274e28571507f1a6aeb9ad36922d8c97ddd18fd1cde18353ba1655c
MD5 d01acaa168df7e508d992cac677f1446
SHA1 f53d4a84c0dd25016ff85ede82fdb60760cffac5
SHA512 037a155882e89151d0cb19fdb2b30cd56ae1b95973629d414322ea35ca263168e592fb3849e2e86709ddd767f224da8cd3d8a460413a4a98039d282d2fd8d467
SSDEEP 192:sxRMnR5C+4/fBhsEvUNMZgIZwzoA8pi/g6+WNIYEp+iKtGlIgDSSPSRJ:sxRMnm+4/fBhsEvUNygMpi/5IRJ54
TLSH
T14B42C816AA28A93B8CCBD25DFB55BF53D2F95033A1D01E58A6FC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 de2a221b5fc6d905849a8627637115f9c8ddb181a480acffdf61e290dbf758b9
MD5 e941639fe701d12bfd1acd03d2dfbd28
SHA1 c61d6d8b28a0d41d26681e2c4c0e36729e8bfd36
SHA512 9c37a77c2643d465814ada74e268acccc9a41a88b8d46c3849cae6ec002a64b6c43925133109ceecbe90cc23a4b33b4dcdb2eb2bd333b647d37d689b7a8f4b91
SSDEEP 768:0UQiNG7pLuLfJaWgH7fqQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX72OVqhrobG6C:0UQiNmEfJaWgH7fqQu1jak72Iqaby
TLSH
T149D2EB7B640DCB7F4F804ADDEC197E9E6DA802CB9698CD9047FA941C03C6BEA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 485e23c1e21b0f71f6bea34329fcbd7be0b7998bd031600674591636af70d89f
MD5 2c0dd813051debf2ed4311b448caff55
SHA1 ac26cc97cc2220bc1f0e7b91e4c59e75b1181c55
SHA512 4e023e6aeba94440166ee3a0b052769b622e05880bab50a1a9b110f55f3b1b596599cc582315cc468d3f66689db52b0da4c71a809f26cd0e3d89e2971583d0b1
SSDEEP 768:0UQiNG7pLuLfJaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX72OVqhro2G6J:0UQiNmEfJaWgH7feQu1jak72Iqa25
TLSH
T155D2EB7B640CCB7F4F804ADDEC197E9A6DA802CB9698CD9047FA941C03C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4eb97f3fdfcb812a45d4b877052a7b7b38f59a7df6d46baf2f41914e67488c08
MD5 baf34b0001ad99e0772e2ecca595bd25
SHA1 5dd26d071fcea77d5b794911e6adae0d0372bf29
SHA512 8e1da79e0459627bb713cf5df016a9ba77d59e6b0a82051b5106da31ad8b7610311daea4efa950884ac5b13c5ba8cf49611234c46d89fef2ba214bba32eb1190
TLSH
T102E0DF9509C8C179B9972083122C9388C2F4B847DBCCB9427F809C44E54E604B297282
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f0ccc70e6a6a139969c5a39dbbd728d2fee8874bf84a5373b27c4b54f53708b6
MD5 ee854771760c38759bb433517a9f4d8b
SHA1 2c0d42981c85596ed67182b079f65538ae349160
SHA512 5be3b247aa6fa564fbd31d2d0dbb1c15328589c4fa2f8fd8183f7d483d945733bcc9284adb420c9a8d578c7d9f7dda91e23fa52f7e6a9f702f4dc5d6d4713c26
TLSH
T105B012403700B287DAC805F80F409B805320EA1570800863C84D6F304C0D9E43F00D94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ff5544689934347257b0d55ba5fed5f5ce5d97a8e04f9b2bcfcb8cefed40c3e6
MD5 c9992a9d17fccb9210934d9009200546
SHA1 07d991ba8a98c4753a314222f78571c6df9a5d80
SHA512 de23e3169ca641566e445726d6c0c2818d1cdcd3715b8b7b6fe51d64a909f2d5c2b0f258d2985bc564d0ff00977d073ceb04e6e3f5ea7f96a596ca6eb15bdb87
TLSH
T145E0D8A019CEC62ABAC67087622DF30882B27507D7CCF9517B0CA844E20A2407293241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f5413c9f28be355f9d49190e19e4a6fdf0c719d5e6c2e865a8c4a1f93bd8770a
MD5 30e9c9c83ff21ccff37b94c5189219de
SHA1 fa8c95af563b07fa3479efcbc10049eff4b4d4c2
SHA512 e61ea0a2d9ef6289997669328598445d4d17cc56ca00cf3bc8ab29953deb54b2163826dfe270cac791f15a075b150d19ef9d0f260f2056e27d99c0275217daf6
TLSH
T10FE04FF159C9C639EC8560C75278AB0886B0B907D78DBA86EB0C5445F50A344B6A7681
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8203e1071294a3f3acdfa6608d8f13710f7d7d57d5ce4f45f530838549f88d17
MD5 8423dff3ec99bedf2fcfe40ce3101ee3
SHA1 1678466205e54bdde7be81b9e2f2f9479fc8dee4
SHA512 4814db6dd880d842d18a74c3dfd10a5e3284c3de39715535b1f339199d231ecfa63d7bce648e4375885862fd71c6cc27ddc41b36d0ec8e69047beb9a979efdd9
SSDEEP 96:KRzc5t7xxNWlqggVNK4sg7NcD7SFR2qY4KZyeWJeKqYyOTswO8chBQh8bYhKJ:Czc5t7xxolqxVHsg7iD7SFR2nz1/OTs1
TLSH
T1A6A12052357B02443D7E690E81ACCA665382B573311DA47F7BE810B24BAAF126CFF5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 d34673710b8d21469afc6c6fc90ca9e3226777eaebaacc52f682ba9e39f6f4b4
MD5 4b4c1d9f3eade7cb2dbba113cd65e156
SHA1 23d985eade866fc634118183842c58a4dbbe59a8
SHA512 0de8ad6236b155da83d65b5f06478858d413bb5f540e00a9eda6b32eead6700ca84bd4d6b3d5d7e434333434195719a99dc6968800a129f9c5e973975a4411fa
SSDEEP 384:DNrRZyCSDnxTICicJmMEhIKyll7svbFKfk7:xFZJSDnirc5yI1l7svbF9
TLSH
T1E444850A7B747001EDE6D9721CB080771E3CB16E8F62A6D15DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 98b43b52381732d9b9b0bda1fec650d4a3f6cd1cab1cb6283120cc832faa4530
MD5 08a7db077c81070c8b2214f73964ecac
SHA1 d39022d9f698229965f52ce22a8216ecab33c3f8
SHA512 a9c859ef36ed30da74c76f010a346c0910808aaf08fadab61af16cdfb040734ea9fc516bb94ce17faca3bc24c72c723c2d3ec83add4f867eb10c74c008655854
SSDEEP 192:0QEIII7brMIMtMYcYLDRyOxiAsolu1FQ2slQ4f4DE4YMAN:0QEIII7brMIM2BixbsKh2s
TLSH
T15B42769F16051B77C05E6B3A13A386455BDA48834072212F76567C0F8EF3AD783E66F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 313B
SHA256 fc997872507ef2ef2b2ad02f7161bab21ac033ebd672aab88c0e6d34fedb58b1
MD5 2d02bc62c547d1b2542eb8dbcd3cbc0f
SHA1 63b19edd7a6768b8addc9c7bea7a8aaa0966535f
SHA512 5a01376bdf758a2b9eb784136fc66a0199833e93605a8f8d4f2f9b9e883e80dc98ebf0c5a6738e9fd38f7112ff8528d251640500a271b4aebea0baa29712657c
TLSH
T1ABE02692A8CCC16EFD942087212C630882A03E53EB88B9876F10C848A409600BACB1C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 bd5c88db24b7b005f79c879235564c5d92057acbed4d11d485aa257902482b01
MD5 c2d10bf15884cde999813dbcfdd9b477
SHA1 638365ec2960aab4b55c1e74a82b048d33d64c68
SHA512 5568b3ea61f728ee3e4063a393a2cd8de1e3c327feec4b7545f35a0cce53ea6295c71d63d497ba147459816713735884c19142d1b165198d5cf5b1d51faa0270
TLSH
T1A4210496F330D148E159827E907E9B3A1735E8128FBCED0F557924346E72B441E4B2E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 331B
SHA256 8554aedeb032ad31571dca2ac5031e1d43d56a5bab69b7f58e864241c33356db
MD5 2704cfb888faa70b9e9ed195bf36c97e
SHA1 96dfec15b282a3f1e4b41ba39bca459d5b1e8ebc
SHA512 dfac2703798a246057f025dee0097d7cd9cf43b0a5f53931f6c298b2b16400e62c247e1d78f2c7872c38d9864b61560f1337b3890b8310c6c052e79e00c7a6bb
TLSH
T153E02691A8CCC1BFEE90208321ACB34C82A13C13EB98BE432F00CC48AA05641B6CF1C1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b0849.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b0849.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 78e41340c850cfcae15424372a517cc14ebacccd8ee0d439e0502080d74098d1
MD5 652950fea1167eddbd2edcf79c0898bf
SHA1 125e65995b897a296278341dbbafe40cffff2218
SHA512 8519d9e7662fda8e06e0462be045642ce8632c58ffe25c595e73c8e316bc4688a42e1d3bf8876b04e0c8069b7124ec6acadc5a72920db2a6be7de4626fa3ead2
SSDEEP 3:MsEllllkEthXllkl2zEelab5lll:/M/xT02zNab5lll
TLSH
T1674402086B841405CA141030401183610364D96005125F5729510812AE8A5541C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c570a24ab6644e7892770fbb46a54ce1f2ed956f838027b209d96860d192d841
MD5 5084e33228ba2f2f00f97b8da67d4c95
SHA1 f933a3a72d65ef268fbd54159e258d325abacf1d
SHA512 672710b3ea02694dea39b971627581831d68cc9dce07557599198f77745f956a2769ab8806687d4a728c8d87d791f192997cca9192de74326e823eabbc238ab2
SSDEEP 3:MsEllllkEthXllkl2zEelZFlll:/M/xT02zN/lll
TLSH
T1D444040C7FC51405CF3410305011D3700371DCF0055357C735510C13DFC75441C04104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 504709e0dc27862d9ea4a0c505cbef53e51cf277e8562e3b33de5cd009a2f180
MD5 cf0bf109435c6e23665098a275edcb1f
SHA1 2110ca6d7a57e799cd88eb4c43bd83960a68b0e6
SHA512 ef5e21f8acf794698ca97676eb3a8b1b77205c23c2b0f8732a86b9452229c0bce11a5cd9c62fb989fba82adfa70accb51968076f4b2072164c60086e6a8123e1
SSDEEP 768:Qrv+4UNbdf3OqGkNDDK48dHeByERRFzjK3Y0eVH1SCj:QbsbJ33GKm48dHSyw/yEH1Z
TLSH
T1B703CF71A9A85E734CE792897683B617BFF4421382C81B64C1DD6F4E86874DD130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 846ef2435a8a37f155fe4c9bae50052b292773f7d53cd12c684ab4a8257edd24
MD5 dc53005e7071898856327b39773ab333
SHA1 e69a5e3f4d6af5bce0f70b8fab83fa2ea2bc0526
SHA512 fe4fc713e52b2e83f5176fed1d82a28c574ed123c9d082a7f2e97bed2202072b0fab8e03df68c49ee05088f2d3bd88d5e8c2381bb7cb3a621f0189194794eb52
SSDEEP 768:Vrv+4UNbdbK3U6gqGqSmD0hK48dHeByERRFzjK3Yysh:VbsbJK3lG80o48dHSyw/osh
TLSH
T1A903BF70A868ADB38CEBD28975437A83BFF4016385C41A68D6D9AB4E41871DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 57KB
SHA256 b376de161b9bd3200463aaa35ab2d359a73d49ab2767635ebf882ebf8814893c
MD5 00c6b954797e64a764b823b2bce3dde0
SHA1 7fa7f74f97058dd5c7628a1a5ee9f0b7b9e3eb82
SHA512 64a5ab406658edb9bd832b5f4bc62bca127036bacdd522aedff7eba70a381240901207c35266c64edf419d19ed237fee20959c7306d01136157426490a9abd09
SSDEEP 1536:nZ35G348dHSyw/11q1UsN8HYnPk/JiSNDG:np5G3ldH2/1oteiyDG
TLSH
T11F436AF088D3897BC8AE6787A37D2E0698BCC063B5985994F7D85E4DCC821BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 33149172a9d9b8a6bbcc9fe8c328964122f9d35de66da37a882d10c1e2ea76d8
MD5 d81cb6def4c25ebcf98d090c407a22a6
SHA1 3affc8a5c55affdac376a8751421a4d8a3f5f137
SHA512 0a67cd33929fa02aa6ac443eaba19c1ba2965456dee1380ded7aa4deb1b98b031fff90c1585886d992b30142b87bb459fc3f897032b93a8f3f388bf7daee0ec5
SSDEEP 768:oZ3q6gqGqamD00K48dHeByERRFzjK3Y3nbSjhOsy:oZ3XGY0R48dHSyw/JbSNOsy
TLSH
T136037C7C9C545C7F8CAEBB49260E7A16AEE40237D1F41968C7D99B0EC0A258CF707C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 41d580130e93de28666c6c85ab0300d3bc4f36dbf6070ce7da2e38d28ec25d22
MD5 e529503519ed0f298437899201b8f8c6
SHA1 29c06cf9f0e48cdf1c2015874dd57b93d974007c
SHA512 becbca9b95cc34e0e7b0d3f019af7288e73eb60b029a2445d25511c194e96e9f3eb0956d29f1f0ff079a6f5ca61cea26cadbbe850e6b04c275cea5a1fe28bcef
SSDEEP 768:eF3t6gqGqbmD0aK48dHeByERRFzjK3Yysy:eF3WG70T48dHSyw/osy
TLSH
T1BBE2AFB068649D734CEFD28A76437787EEF4416395D46A28D6DDAB0E40C319D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e4307791e2e4d32fd22fd6baed67730574daa7398d092614f1d06184ca34f5c3
MD5 32381b90bd540d8f1f072930538a5db1
SHA1 f24c83727ecac5886600a8faf09ab25a3b299cc3
SHA512 8ca45baa4273965b8f320c35f2c5cc5ef7f442bac774a724ed91838f1e0769c38aeef0d0420a14328cef8f395353de75aa6d099fd8e665c18999312e968af1ea
SSDEEP 768:nZ366gqGq7mDkK48dHeByERRFzjK3TYYbSjhqLG:nZ3nGlB48dHSyw/JiSNKG
TLSH
T192F2AD749C654D3B8CAFF34A364A77569DF44137D1E85A28D3DCAB0E809359C2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ab2e81788df777c3e0ebdef3eb1cfa1a90129db7c69b5b7fb071f53f8b6549fc
MD5 9717eefb5da361f6fe3162c8354fce13
SHA1 0870ab9588abca48fb2b738c109fef4f304ee8a8
SHA512 ee308b9d37dda1b0fa7c1943eedac23aba5ad7f14061db6eb5c4fe05a0c06d76c1c8926d11742840d40e5399ddca129c6be0881e462332384d28b86d8ec2504e
SSDEEP 768:Hrv+4UNbdf3kqGOID0jK48dHeByERRFzjK3JyeVH1SCj:HbsbJ3tGJ0G48dHSyw/DEH1Z
TLSH
T18D03CF70A8A8AE734CEB92897583B757BFF4016385C40B64C5D9AF4E85874CD170BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 9391bd81a5299a20431e5dd996526c7b87abcf93c33662796d36571bb4287907
MD5 9a3a1ad8b1f9851c05b29e65534e9aea
SHA1 6ad466b52c838a29d44dbd1993a0ea7dcfa7bd2c
SHA512 0f43e5f10c5b50906528ceba1d1a0d4688420f2d9452b536af08b2b57234dd640fcda4fe07c0c293c741a7490b8e67e648f12f94ab9b648b979af243f6f38cef
SSDEEP 3:MsEllllkEthXllkl2zEelQ5lll:/M/xT02zN0lll
TLSH
T17D44040C7FC41405C53410304011C37003F0FC740513575735513D135DC77400D50415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfc43696-6cf1-478c-a3a8-63512ad7d4f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cfc43696-6cf1-478c-a3a8-63512ad7d4f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59b07a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59b07a.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

beg_run.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\beg_run.exe
Size 375KB
SHA256 4d953a571b7535bfebe4934c85af4fbebaeba6edd3130b27a5f5f1ad5e208da2
MD5 bed6e5c0330cfea739a67578b39e5947
SHA1 86e90b181864d907553cdb99e8ad02d5c2241beb
SHA512 09328ac23039c22bff1310697ecfceb5bba5da892efbed0425a856bb51550aff0f48892807f22ec82d55720a2259bb2fd2fb733e901bb3e1cda62eed57fb3ac9
SSDEEP 6144:FHV3Am/B7IkcuvL4uKPAYf7aEAxJv76QQbUYPZAlsLSlL6XpVwF8HTL1ap+5Ac7f:F13AmBFu4jxJjyXaLcVw6X1a490Cw3bo
TLSH
T192847E2AEA5804B8E167D178DE638803F772BC8D03759BE757D49B620F175D0AE3EA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

473de4a7-603e-47ba-ab29-f492501293cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\473de4a7-603e-47ba-ab29-f492501293cd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4228_1186021863\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3840-0-0x00007FF600F5B000-0x00007FF601322000-memory.dmp

Download

memory/3840-1-0x00007FFAB6410000-0x00007FFAB6412000-memory.dmp

Download

memory/3840-2-0x00007FFAB6420000-0x00007FFAB6422000-memory.dmp

Download

memory/3840-3-0x00007FF600F50000-0x00007FF60196A000-memory.dmp

Download

memory/3840-405-0x00007FF600F5B000-0x00007FF601322000-memory.dmp

Download

memory/3840-4-0x00007FF600F50000-0x00007FF60196A000-memory.dmp

Download