455fb8f05b964ace856d5b761cdae6e09e33a1a3dcba0097ac4a1d749aa24acd

Analysis

user interaction
yes
max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Begin.exe
Size 6.6MB
Sample260814-nrpcessclc
SHA256 455fb8f05b964ace856d5b761cdae6e09e33a1a3dcba0097ac4a1d749aa24acd
MD5 ea2b851fb3aeecc9295168c2cdfbbaef
SHA1 bfa9a3fdf94ac2c1296599fd0c54e3577965ee10
SHA512 27e1af5b7cdac42d50e67d3cc36c72fb904867703048f8f65337f3ae47bcc22f1aa6ad9061e4bcd7142d056af9da752d4e4407b7caf867a0e0b915add0e1b92b
SSDEEP 196608:RADKGj3LZqoEScnpMISxWB+1rksXREjgd8:c/LZbESopVAWB+h5408
TLSH
T15C6612BEA258222CC02FC434D533AD06F376741F07E999EBB6DBAED06B1A454D529F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\lmhosts.sam	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	beg_run.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	beg_run.exe

Executes dropped EXE 1 IoCs

pid	Process
692	beg_run.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2880	Begin.exe
2880	Begin.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1929838671\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1480862098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1480862098\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1480862098\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_671450270\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1890940447\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1929838671\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1480862098\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1890940447\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5868	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311810976907157"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{9FE32040-1C31-4086-8BFF-F30DE677395F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2880	Begin.exe
2880	Begin.exe
5192	msedge.exe
5192	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	beg_run.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
844	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 844	2880	Begin.exe	90
PID 844 wrote to memory of 1760	844	msedge.exe	91
PID 844 wrote to memory of 3192	844	msedge.exe	92
PID 844 wrote to memory of 2844	844	msedge.exe	93
PID 844 wrote to memory of 3192	844	msedge.exe	92
PID 844 wrote to memory of 3192	844	msedge.exe	92
PID 844 wrote to memory of 5992	844	msedge.exe	94
PID 844 wrote to memory of 5992	844	msedge.exe	94
PID 844 wrote to memory of 2584	844	msedge.exe	96
PID 844 wrote to memory of 2584	844	msedge.exe	96
PID 844 wrote to memory of 2584	844	msedge.exe	96
PID 844 wrote to memory of 1568	844	msedge.exe	97
PID 844 wrote to memory of 1568	844	msedge.exe	97
PID 844 wrote to memory of 1568	844	msedge.exe	97
PID 844 wrote to memory of 5408	844	msedge.exe	98
PID 844 wrote to memory of 4928	844	msedge.exe	99
PID 844 wrote to memory of 5408	844	msedge.exe	98
PID 844 wrote to memory of 5408	844	msedge.exe	98
PID 844 wrote to memory of 4928	844	msedge.exe	99
PID 844 wrote to memory of 4928	844	msedge.exe	99
PID 844 wrote to memory of 932	844	msedge.exe	100
PID 844 wrote to memory of 932	844	msedge.exe	100
PID 844 wrote to memory of 932	844	msedge.exe	100
PID 844 wrote to memory of 948	844	msedge.exe	101
PID 844 wrote to memory of 948	844	msedge.exe	101
PID 844 wrote to memory of 3824	844	msedge.exe	103
PID 844 wrote to memory of 3824	844	msedge.exe	103
PID 844 wrote to memory of 3824	844	msedge.exe	103
PID 844 wrote to memory of 4412	844	msedge.exe	104
PID 844 wrote to memory of 4412	844	msedge.exe	104
PID 844 wrote to memory of 4412	844	msedge.exe	104
PID 844 wrote to memory of 5904	844	msedge.exe	105
PID 844 wrote to memory of 3044	844	msedge.exe	106
PID 844 wrote to memory of 5904	844	msedge.exe	105
PID 844 wrote to memory of 3044	844	msedge.exe	106
PID 844 wrote to memory of 3240	844	msedge.exe	108
PID 844 wrote to memory of 1284	844	msedge.exe	111
PID 844 wrote to memory of 1284	844	msedge.exe	111
PID 844 wrote to memory of 2724	844	msedge.exe	112
PID 844 wrote to memory of 2724	844	msedge.exe	112
PID 2880 wrote to memory of 692	2880	Begin.exe	113
PID 692 wrote to memory of 5868	692	beg_run.exe	115
PID 844 wrote to memory of 2632	844	msedge.exe	117
PID 844 wrote to memory of 1380	844	msedge.exe	118
PID 844 wrote to memory of 4512	844	msedge.exe	119
PID 844 wrote to memory of 1756	844	msedge.exe	120
PID 844 wrote to memory of 1756	844	msedge.exe	120
PID 844 wrote to memory of 1844	844	msedge.exe	124
PID 844 wrote to memory of 1844	844	msedge.exe	124
PID 844 wrote to memory of 5864	844	msedge.exe	125
PID 844 wrote to memory of 5864	844	msedge.exe	125
PID 844 wrote to memory of 3888	844	msedge.exe	126
PID 844 wrote to memory of 3888	844	msedge.exe	126
PID 844 wrote to memory of 5192	844	msedge.exe	129
PID 844 wrote to memory of 1864	844	msedge.exe	130
PID 844 wrote to memory of 1864	844	msedge.exe	130
PID 844 wrote to memory of 1864	844	msedge.exe	130
PID 844 wrote to memory of 5056	844	msedge.exe	133
PID 844 wrote to memory of 5056	844	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Begin.exe
"C:\Users\Admin\AppData\Local\Temp\Begin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff87555c188,0x7ff87555c194,0x7ff87555c1a0
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,14435786213986234065,6280170284199263226,262144 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13285802250153471372,11849067168838849644,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,7242894497528022929,16113209544325821526,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,5572403549131671034,704790407769713533,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,9516346308574658477,16288342625566655324,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,8457858930358721065,318582918794423158,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3672523516874631658,7736553616011573874,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3744,i,15245870456054307123,6526885438651704048,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,16542084204040156198,2097307470454248833,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5592,i,8750656830056202620,2616556316990070863,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5600,i,499022398699442160,4322415522806138964,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,3774147824848979681,4309484038517580206,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,11345004589982314373,445235153310726311,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7354186573782242007,11788800051965868610,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7354186573782242007,11788800051965868610,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,10990510256544011407,2801047860538997781,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,3887291308882695523,7199626000405061710,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,50640996980673841,11347070420677797395,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,17567393272665550550,13476071452127673476,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,12961785156973037955,12978185056529626932,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,14625417400941915422,14699143110321671519,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:14
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6616105569215911698,1312413850832113777,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17680901408129058811,5092829468898811278,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7665612482481006483,9331717824197383117,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,8896181126042739797,16161099856535331355,262144 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5528,i,100621901099639824,17010383396063070145,2097152 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,5314464374746005443,15817473543102321472,524288 --field-trial-handle=2128,i,10102167346119276945,10308723079904897347,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:14
    3⤵
    PID:5056
- C:\Users\Admin\AppData\Local\Microsoft\Windows\History\beg_run.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\beg_run.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title EMULATOR
    3⤵
    - Executes a command shell one-liner
    PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7f839739-417e-43ce-9f74-36fcaf37f80d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f839739-417e-43ce-9f74-36fcaf37f80d.tmp
Size 38KB
SHA256 cca5417e79d4de893496b043a22871eb36d623e6b634379e560e950470677549
MD5 0eeeaeb2caf6f5bf064bba559ee1ce2c
SHA1 49cc1dff647582137c7ed16975c1cb5c4c9be31a
SHA512 94454d44b6a0dc50264109f7fdfe36716b5c64a95177eea5dfca7f6eb3f9fbf81a9c084e9100ea17935c1bab4446fa921f60cfcab82fcae1cf2a4713b22ef5da
SSDEEP 768:Rrv+4UNbd43Eykc+wfZOsfcR66I/vShCQtI2bwWV:RbsbO3E3wf7f16I/vS80wO
TLSH
T1D603CF32E86899339DE792487646BB637EB961B3C8C54744DADD1B0D018369F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 8b9a3842c18fae094f55a638dc31c1747c97b49e939347fe3f7e2f111e7198a6
MD5 7e06d211307542f15776a7f92ed73d2a
SHA1 3b6ba764c58f1ca19a235f742e461dba3a712b85
SHA512 fec76e1248485d8d92129d8a459c82d1d2c48dfc680483173ca341e453c86fcfaf892e605a8ba9cdc24a468522b87d5c16c701591247567a719398d418e94237
TLSH
T12BE07D5487220191EF490C70D9CAC3B573E1CDFE72430A5460D42C348D01FB043C1417
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59694f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59694f.TMP
Size 360B
SHA256 9f191212f4b5a91b3e3e121e6d5b92399b1ef4df2d927009bd13f479e764845e
MD5 b796873cdd75f322ceffe8c6a7cb9896
SHA1 bb06976704b0f54e28b95ccc1343e11081de30a5
SHA512 2b6971a370deaa5c96c73aac9a94b7a529befe90b4d7f67d457138be75748ff357b0a41bb4393bea395e1a2bb989f22f867b3870961da5f6528295b6ccc6bb2d
TLSH
T183E02E5083220248EF590CB0EDD9C2AA33F0CEFE72930B6960D8AC348E41FB103C081B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 24ebdfca02e71a538540a9f8d17dea8beaab19bfae8a3269c8e8f9dee5109c8e
MD5 ffc2953a99c7432486a127d8df1f04bb
SHA1 6ab95a34613e56e85e15c49215d98061e6459e62
SHA512 2b45bf773824cf0d3882a91a80d28a59ae055f8e76264001195826e2822690d47476bae6b25773ce6bbf5a76cb98325f8508c06f158c9a4b3138c2bdd40efc2b
TLSH
T13A719EB383F5866D990157F0AB187E1ECE2E0918821C3C2AC9E59F5B93E2471E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ccfe25294e19c4540e9e4013a88ad887a10b8872ea844afe98a5df676a010c6
MD5 fd5a2e69672863748322dd7ded93cc73
SHA1 6d1231c5649868ae2cb4f009d9534b088ef2cc71
SHA512 c64302e83cf7c32e33eb16b0d30c8f88d252b7e6d04e2bf78a9822bdf9bf2104b59baa592fb1c04fcc85ef7ceea3a71f43a744f52ec7511799ae969d52ea9b49
SSDEEP 192:sxR1RAyM/jK1Ml8wCtc/fus+RyLZuuKt6zoD8pfto/g6+WN92l/zJ312234GwL2/:sxR1C8tc/fus+slrZS/5W/z3b7
TLSH
T1EE62E916BA34597B8CCBD21CFA517F53D7F91563A1941E44AEFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b40c335a39cf1d87f3247d0246bf789ee935dcc2ce592b36ad1a6dda28ff30f3
MD5 089baca2c2ece1f11cc448a6a7dc20c2
SHA1 bfb7ef61e8529edfec5dd428ed276fc5cd2610d4
SHA512 b81684e972f93bc301e63d2de9f0f00f6d8f711674f09641193cdad3596bf7cd063212231c7fd96c6f63da9677fa0010aef1bda5d1a965d89bc0f60183febaa4
SSDEEP 192:sxR1RAyM/jK1Ml8UQ9Ctc/fus+RQLZuuKt6zoD8pFuv/g6+WN92l/zo3Q2e4GwLy:sxR1Cq8tc/fus+WlrZW/5W/hbN
TLSH
T1CB62D816A9385A7B8CDBE21DFA517F53D6F81573A1941E44AEFCCA0C00E6AED211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5e3efe2fb0cea8208d6130118fa8d9b1852a7cb065f5c075e4d412bb90d52289
MD5 ad9d33fe19df71865bd5934c061bcdc5
SHA1 335ae753df987778f7faa6bba047fd91bb763367
SHA512 90c6be656042c029da9c4c9e3aa4e5f91eb48ec26bcdacb366f1aacb23184b5429689599dcfd931adca6cc364dd078add0301059570a1a2559da578e19d4e92b
SSDEEP 192:sxRiRAyM/jK1Ml8wCtc/fusURyLZuuKt6zoD8pfto/g6+WN92l/zJ312234GwL2U:sxRiC8tc/fusUslrZS/5W/z3U
TLSH
T1B462E916AA38597B8CCBD21CFA517F53D6F91563A1941E44AEFCCA1C00E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bac70a8fc03822a558375f4ebab76ca26c6dd875d20d54276679ed324bf1366c
MD5 6e2dc61c2c0ed62e5bd582a02a45c2bf
SHA1 13b31219ec8d88bd390c6a95374a6e40607b7f38
SHA512 bd1fcde782ea8f571f8ff28ff656f99afe3a4589e20f9588807caa5e0dfb5a5fcdb43d1f385d031d1910a3fe8bad4a225ef3a945f60f26580ce15096e764e6ac
SSDEEP 768:GiqbKo7pLuL7hkWg0CfZs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV83oMW6rro5Xi7:GiqbKUE7hkWg0CfZsu1jab3oF6Y5y7
TLSH
T1AAE20C3B680CCB7E4F804A9CEC29BE9B6DA801CF56D8C95447EA881C03C67EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 609d9e4b265907fc8b7072ce23c57595354f108b8971b15089f442646a9fcb59
MD5 92a29373a240e04bb5db0260ed32a916
SHA1 0cd825ffabeb6a685a674dc7e6deec550c17400b
SHA512 5dd31ff7db63de614f5a48fed9a22614975cba94fce8151971f2c6d1836de2005d8bc47228b89cac41963f015808f3eb51ffa31b3a0aba4c619f9b8bb0eec5ce
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHEFw0Oy2UWS/fg8UK4Rg2Uc00/uUJHk0ki:C1i7PF/DWrwfX9mgpct1o7zsHEFw0OyO
TLSH
T10CC15591713A034539BDAA0C91FDD82EC3C379A3311CA86B3BA941965F66E038DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a09e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a09e4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 449043429e19ec1b72f73f4544b145bb8347e3dfdeba860fc21b94b98e8b88f0
MD5 203c17c62fac82f478fbc35faedbe7ee
SHA1 9d2ba3dff68ccbe3b0615f896d691d4f88fef0d0
SHA512 732d3dcda047dbab1c46a5331dc9822dc85c144c0b222b0b7d46174332db5470e8b7a726843dc15399915f75356f0e998ddabe0800fb3b3c91994e98eb598720
SSDEEP 768:6zj37Jc+wfZOsfcR66Igfcl66ZvShCQRePi9PtR:6zj3Hwf7f16Igf56ZvSSPY
TLSH
T1D4F2B0B1E8746A739CE297846A557B13BFF55263D1C40A48DEDC8B0C01C36AE172BC35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 596792495e788253bc5aed20166b551ded4a37b7a81be64a4221d42fc939c4dc
MD5 002762cda51e216ec1cf801c75e68258
SHA1 bd453f2c1d10311ac4f082030aa7f5bb538d2515
SHA512 a68a171a7df86de9e510a02bee250f8d3b06e9831a8aee7dc8410480144b834da67b4834a982dc497e8fa08c6d2030989c7ac0d2efff6964e8d3544bc9a0f6db
SSDEEP 768:yTF5kV32wg8xdtfZOsfcR66Igfcl66rvShCQRePi9PtR:yfi3Hf7f16Igf56rvSSPY
TLSH
T1E01329F298E79576D8EE5787573C6E02AEBDC163B1884984FB884D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 cbd3c2bf28dcb95a300bf773399a5b4809aa0823f407ab34aef605db069f569e
MD5 6f4cc8689eaaffb1996e7e658340bf91
SHA1 01cda0ac605afbca9496398b19ea47100affc0a1
SHA512 ec892b536190157dcead1d203e2fbdc73eb7c30b5b57fb29cec5d35e18fb3e37323ae103a5365d7fa220a39fe3060b41a71e9201d72138b943ab8bd346148cd3
SSDEEP 768:yTF2a3ZwgtxAtfZOsfcR66Igfcl66yvShCQRePi9PtR:y8a3Qf7f16Igf56yvSSPY
TLSH
T18B132AF298E79576E9EE5787573D6E02AEBDC163B1885984FB884D0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 af2e5b36f824fcf3ed37c315018c1a31852ab083d86050cddf297163abe31362
MD5 973336d227e31240182fe6e805d7cfc5
SHA1 c87773f69730e4b27eeee52800ad3e233f906e2e
SHA512 777cc9f1fc27ff610168c5d3237dbf86a94f08278ceb8bc26c7223bee3743c2e4c0b5c127d2b915ebe00f5374e84b9c3eb069aacc3e28e0b98dd8a1581dfda57
SSDEEP 768:Fzj3aJc+wfZOsfcR66Igfcl66ZvShCQRePi9PtR:Fzj3awf7f16Igf56ZvSSPY
TLSH
T141F2CFB1E8746A739DE297846A557B13BFF55263D1C40A48DEDC8B0C01C36AE172BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 239b46e9b766401a0b4a5b3114b59c2b06d8f7e4f576e434b0a09a36ab22ba56
MD5 d6faa6e7d512fb96599898ef2d7c87d6
SHA1 e2e4eb4c1d489484d97af06336bcde79ecb20b44
SHA512 1b91f22d66699bc00fcc9ece492a5bb5a8980adca433d3f1bea40f931ee2f0844764a78ae55bd811a9558d305ec117573359a5fe1caec081da7aba73c72ea626
SSDEEP 768:F7j3uJc+wfZOsfcR66Igfcl66ZvShCQRePi9PtR:F7j3+wf7f16Igf56ZvSSPY
TLSH
T160F2BFB1E8746A739DE297846A457B13BFF55263D1C80A48DEDC8B0D01C36AE172BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d9ab40abb2033044cee0d421b4fbda6d15fee05f876004d63773e4bf492b74b3
MD5 e5bed92448f28cf67444a05c58090951
SHA1 78146511a9527fa408bf3f65d41dc19f7754a504
SHA512 110a35147dca2d5154da4a587a075bc645975c1595abe3014e8634a3edcd1397a87bd047e0f1138fc7249fdf4bc7df7c85c4f6cb76a7af73992c67068b758239
SSDEEP 768:FFrv+4UNbdI3cJc+wfZOsfcR66Igfcl66yvShCQReU:FFbsb23Mwf7f16Igf56yvSSU
TLSH
T12503BF72E87869739DF29744B60ABB13BFF5516385C40A54DEDC0B0D02876AE272BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1d800a45464cdd0ec125642726f8e026420048cf79fe23a946bf6c7b9eaa22c5
MD5 6430e5741e14c75e8e81c1ccdac97b9a
SHA1 4bc33b5f0fae3d1f83990df0e6c319d96b8c02d1
SHA512 0927e8dbf5d68c83548866b498be9e11eb452bf09645a1e6cc2087b62e06acd2de07f92248480ff1ab17298b7da7c972380b522dd5b39af8629b60e918e6a521
SSDEEP 768:orv+4UNbd43q/c+wfZOsfcR66Igfcl66ovShCQse2bwWV:obsbO3Ywf7f16Igf56ovSV0wO
TLSH
T1AA03CF72E8786A739EE39644760ABB13BFB55263C4C54684DEDD0B0D018769F331BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1bdda990-41a5-4c43-a0b1-ebf27f3befdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1bdda990-41a5-4c43-a0b1-ebf27f3befdf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

beg_run.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\History\beg_run.exe
Size 374KB
SHA256 dc95d49da80c1b8b36a174648ae7544c086895b4ff054a86f4af2e9779498108
MD5 f3abd041aafd4c29b64c829f7aa7207c
SHA1 3a65b7a9f60a78b505f0135c0bfd24b92ac7397b
SHA512 b8d6a1d179bcd5cd9a735eb3933d125742e84c3b599c7ed339ce6abfc6d813af22df4d2fab72c7439f5baf7a1c13c6cdfd009abc6099dfebb7de210ac89c4b17
SSDEEP 6144:zQa3+zbrMxW+I2ekqCe61WQCPOKISlBa58zZXbNxzvtCloWni8tTKxXofEF4I37q:zQBzbEde3POKIiEi9DWnjkBoA7HdR+X
TLSH
T10F847E2AEA5404B8E177D178CE578803F772B88D0375ABE757D49AA21F175E0EE3E600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir844_1386741002\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2880-0-0x00007FF6646DB000-0x00007FF664AA2000-memory.dmp

Download

memory/2880-192-0x00007FF6646DB000-0x00007FF664AA2000-memory.dmp

Download

memory/2880-5-0x00007FF6646D0000-0x00007FF6650EA000-memory.dmp

Download

memory/2880-4-0x00007FF6646D0000-0x00007FF6650EA000-memory.dmp

Download

memory/2880-2-0x00007FF892560000-0x00007FF892562000-memory.dmp

Download

memory/2880-1-0x00007FF892550000-0x00007FF892552000-memory.dmp

Download