455fb8f05b964ace856d5b761cdae6e09e33a1a3dcba0097ac4a1d749aa24acd

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Begin.exe
Size 6.6MB
Sample260814-vffpgaxfkd
SHA256 455fb8f05b964ace856d5b761cdae6e09e33a1a3dcba0097ac4a1d749aa24acd
MD5 ea2b851fb3aeecc9295168c2cdfbbaef
SHA1 bfa9a3fdf94ac2c1296599fd0c54e3577965ee10
SHA512 27e1af5b7cdac42d50e67d3cc36c72fb904867703048f8f65337f3ae47bcc22f1aa6ad9061e4bcd7142d056af9da752d4e4407b7caf867a0e0b915add0e1b92b
SSDEEP 196608:RADKGj3LZqoEScnpMISxWB+1rksXREjgd8:c/LZbESopVAWB+h5408
TLSH
T15C6612BEA258222CC02FC434D533AD06F376741F07E999EBB6DBAED06B1A454D529F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4460	Begin.exe
4460	Begin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2140	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{A93AFE45-8040-479F-BFD7-6F29CF12B4C5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	Begin.exe
4460	Begin.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4972	4460	Begin.exe	87
PID 4972 wrote to memory of 432	4972	msedge.exe	88
PID 4972 wrote to memory of 2140	4972	msedge.exe	89
PID 4972 wrote to memory of 2044	4972	msedge.exe	90
PID 4972 wrote to memory of 2044	4972	msedge.exe	90
PID 4972 wrote to memory of 2044	4972	msedge.exe	90
PID 4972 wrote to memory of 4324	4972	msedge.exe	91
PID 4972 wrote to memory of 4324	4972	msedge.exe	91
PID 4972 wrote to memory of 3336	4972	msedge.exe	93
PID 4972 wrote to memory of 4112	4972	msedge.exe	94
PID 4972 wrote to memory of 3336	4972	msedge.exe	93
PID 4972 wrote to memory of 3336	4972	msedge.exe	93
PID 4972 wrote to memory of 4112	4972	msedge.exe	94
PID 4972 wrote to memory of 4112	4972	msedge.exe	94
PID 4972 wrote to memory of 4000	4972	msedge.exe	95
PID 4972 wrote to memory of 3788	4972	msedge.exe	96
PID 4972 wrote to memory of 4000	4972	msedge.exe	95
PID 4972 wrote to memory of 4000	4972	msedge.exe	95
PID 4972 wrote to memory of 3788	4972	msedge.exe	96
PID 4972 wrote to memory of 3788	4972	msedge.exe	96
PID 4972 wrote to memory of 3964	4972	msedge.exe	98
PID 4972 wrote to memory of 3964	4972	msedge.exe	98
PID 4972 wrote to memory of 4720	4972	msedge.exe	99
PID 4972 wrote to memory of 4720	4972	msedge.exe	99
PID 4972 wrote to memory of 4720	4972	msedge.exe	99
PID 4972 wrote to memory of 4796	4972	msedge.exe	102
PID 4972 wrote to memory of 4796	4972	msedge.exe	102
PID 4972 wrote to memory of 2476	4972	msedge.exe	103
PID 4972 wrote to memory of 2476	4972	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\Begin.exe
"C:\Users\Admin\AppData\Local\Temp\Begin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff8d046c188,0x7ff8d046c194,0x7ff8d046c1a0
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,17257941708784222030,5503164579385111251,524288 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,432206853234029055,7850550543044436946,262144 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,16018776186163966637,15962541035634170452,524288 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3017598140434965439,17115837855516539145,2097152 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17321792650683757094,1884098584681415512,2097152 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,11800454391592075540,3059366175972490301,2097152 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,9893288225019865706,15348015385590145738,2097152 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,18309765521168691820,13208179422498275079,524288 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5316,i,11080362377986857700,12632853127031032455,2097152 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,5720813119815898187,9129905034040381814,524288 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16980156071479616172,6989771881893195077,524288 --field-trial-handle=2100,i,8088958485042174055,5615046532276742417,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2ce0318c35c33b967098227a805dc29c73a2b7f4330779681222d5705016d45c
MD5 112b4d378fb6de8463c4dac9be8211a4
SHA1 ef5a2d0eae647090adbaddba09b3baa65ba512a7
SHA512 6db3b811f5d6a1814cd36363818d7bb4008a1ac3903c1364e64f611373d1406d3067c52b3b65a5858f72c0e8e0527448185040336ca582baef95a88f336228ef
TLSH
T119D0A722692975D2F32A41799062CB011A15417766637701B215981C9A740C5B5876C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 377908b3b2ca36db7782990219e58a347de9b7472b2cc01fd69a2ae6966908d7
MD5 d6b42cf62a604714fffb58b07c099c98
SHA1 7eb9baa7f5fcac41c0bc3416f7c4087b26b5bc89
SHA512 7b2a4b26208aac633e3a1ae05e1ba02e76fa06a194af45c33eea7e62efbb9306141ea3269e5eab284d09f72a055c608c96aeca1e3a8e5a80076ad44ae87937c3
TLSH
T1FE712B3A25030CA5EF52153DC1D9C31136F1A2EAF0532F6AD25085753B7EFB2A21BE88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583718.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583718.TMP
Size 3KB
SHA256 b392a64490611c78641565e4cb0c325df48a10716399b56cece4f2e6ea367808
MD5 d204af9b28963c3bfbec784e31f43d04
SHA1 18a5eaec862808c33aecc8c3634b947b440b1e4a
SHA512 17d78a41fd4e6af3bd80dd81190c23bc0b3ad639928a23b48800a7498f01688efc105df2203b6cdda6312bf7aa30bb1760c50c52a5f9dfcc8d9d3fccc9ce1297
TLSH
T164712B3A25030C95EF62043DC1D9C31136F1A2EAF0532F6AD2508575373DFB2A20BE84
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 506dee240d0eb761757c3ebf040acba47dbfc6f30d373684baee7349223aa5ce
MD5 b99eb75eb729dd67b3d9f58e34975451
SHA1 ff9c63df55802860ba4945392b2c7bbc3d5e73bf
SHA512 d72fc4868f40c5370cf088c2178e370380640e3935ced0137704c1e22e17cef08a1b9728ae2bd595b826d88e56dd14376f39d9353c6ecf25a02c44c2582a8e2f
TLSH
T186317BF3C6E4896D8A0156F4A7146F1BCE6E0954431C3C1BC9D4AF2F93E24B1E14055F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d1838d14bde3606f78bae70f244025eb18b2ee30ece75e9db7dd55112d8a1916
MD5 637a870fd8ddb40f10459586d4d53e42
SHA1 584282feaf4e57b92027eb8c75541597edb6e845
SHA512 e64a53395f8fbfd410cff9bca1de7d17815cefafecb7f6873bc5e3e580c351d01d34fd8ef58d5fc97155122aeb014a799ef0e139cd733a2c647215c824d19e7c
SSDEEP 192:sxZ1RQyM/jK1Ml83jU/fusEdWpVBsXz7EdpYsYHW6+WNy5yI/YA5eUQIgEJ:sxZ16mU/fusQWvBsD44HbS/zsI
TLSH
T1A152D811AA34697BCDDBD20DFA557F53D2F9046292940E54A9FCCA1C01E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 21cd7e011071a3a0eb82796d47ff4f25d02d53940791c30454fab12c499a2d0d
MD5 91bb9dc00530d46884d0cb50b719a227
SHA1 4b42b6f3ccc7b2418430e3dc2c496ba1b2fe1bf1
SHA512 f678472debe2325d163190091e0a132e2958abfad64924e1b4663f34b3ad73bf9a4eab6916384290617525593e84fbb265ef08f8f42fa4e0d4af69b3dc3a4eac
SSDEEP 768:h9sqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV94Ll6AR9GroLU3W:h9sqxAlWvJD6Tu1ja24LAs99L6W
TLSH
T1F6E21C3B694CC77E4F840EACEC2A6FD76ED801CB56984D5447FA890C02C73EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ad9f152c4d13a0331638cfa1797317cf22ad53f1438990d469822812f7f10f85
MD5 604cf8872162fae5f4fc8ca0bad52cf2
SHA1 d1e943665685817889a17e4664f49b762bb2eaf5
SHA512 633754d88b490e9ff74552cf26c057d113d30908d980f7f0ec0e1420df6c7eed645938b6325ba6b2b764d014cf616dfff285b5c9e49235f2dbb7c00d3f1bf1bf
SSDEEP 96:KYbaKYIKeBOKy8CeH+KccvaMKvaO21KKGcu:ExBlRXTRH
TLSH
T166E13D22367B424238BE395CE3AA86774E423163341C6D7F3B7864621D66D612DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5368132542b1a258745cca51bec1ac8ff253b6dcea5b89726a6b7936fe760ccc
MD5 886c7a1017eb84ad2823251e01cf475b
SHA1 505308c49184ff81e691f1e34214242dcac9ca5f
SHA512 8da4117b3b48b85709ac6003dae7da51dbefdeef002585e63d82cb9f19f1f448fc1261f3ed852ad46507464de3b353c7e665b5b70b43582af9c0578e5fb445f0
SSDEEP 192:tONt6JkRtQmiUyOCW+RNoCk1EoPh3tRgU6:tONt6UrIW+RN3ABcU6
TLSH
T13802E9356C785C7B9EF36D0AB48736175FA4216BB9952B40EAE81B1C00D755C234783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e6c32b493c3f9420764094e033915fe0e3d668060f529b45d5fa72037b388cc9
MD5 44bec816748a8b820d2b1bef7b7fb5c7
SHA1 dcfbc7e1a2a3af8fcdae8c22792af39218dad3d2
SHA512 6d5125458bb41e6d393c618f047aa7f45e6381e0c809e187fda3cd51d6ad90b9e75982423e54b9936f9e1e95488f19ddaf769ca5077e255c0197505b3ce8d6a4
SSDEEP 192:1ONA6JkRiQmiUyeCq+RNoCk1EowFVjnVcRqgvU6:1ONA6UeSq+RN3Aa2lU6
TLSH
T16D12F93568785C6B9DE6B405F4C732935EE421BBED466F50E5E80F1C00D768C274B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 0e9229c62135e9880d8d3b0b35faafbd20c068217462c414e8d0f45dc6e09e65
MD5 9797815f8f839d51f0a09b85fb1e2d66
SHA1 7601001c9d78aa9c98f78df3ef08d5d1e560eb87
SHA512 25c52589f712bafd5aeaf4acb1ced9249ddc4574f8858a453fa0bc36f958d128e0d31cf6cb519270c9565636567f64bc14e332683928059ca487f9a4f4a02e58
SSDEEP 384:znsNN9uib+Ql/VRN3Aa8YaAStkk1of5mkch5xY:b7etH3ARISgf5Uh8
TLSH
T1238229B2E8645CE788E1F4C96486F1132DB8413BCA4D6A0CF6F87A3D319F5F85342929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

83796057-8acb-431b-ada8-be0111f1c5df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83796057-8acb-431b-ada8-be0111f1c5df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4460-4-0x00007FF71AF10000-0x00007FF71B92A000-memory.dmp

Download

memory/4460-0-0x00007FF71AF1B000-0x00007FF71B2E2000-memory.dmp

Download

memory/4460-3-0x00007FF71AF10000-0x00007FF71B92A000-memory.dmp

Download

memory/4460-1-0x00007FF8EC8D0000-0x00007FF8EC8D2000-memory.dmp

Download

memory/4460-2-0x00007FF8EC8E0000-0x00007FF8EC8E2000-memory.dmp

Download

memory/4460-241-0x00007FF71AF1B000-0x00007FF71B2E2000-memory.dmp

Download