hxxps://beyond[.]genesys[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://beyond.genesys.com/
Sample261024-1vwbcset9m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{B6A08AB8-BD97-4989-AF62-2A23514B4433}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 4124	748	msedge.exe	85
PID 748 wrote to memory of 3872	748	msedge.exe	86
PID 748 wrote to memory of 2356	748	msedge.exe	87
PID 748 wrote to memory of 2356	748	msedge.exe	87
PID 748 wrote to memory of 2356	748	msedge.exe	87
PID 748 wrote to memory of 2976	748	msedge.exe	88
PID 748 wrote to memory of 2976	748	msedge.exe	88
PID 748 wrote to memory of 1664	748	msedge.exe	89
PID 748 wrote to memory of 3348	748	msedge.exe	90
PID 748 wrote to memory of 1664	748	msedge.exe	89
PID 748 wrote to memory of 1664	748	msedge.exe	89
PID 748 wrote to memory of 3348	748	msedge.exe	90
PID 748 wrote to memory of 3348	748	msedge.exe	90
PID 748 wrote to memory of 1816	748	msedge.exe	92
PID 748 wrote to memory of 3160	748	msedge.exe	93
PID 748 wrote to memory of 1816	748	msedge.exe	92
PID 748 wrote to memory of 1816	748	msedge.exe	92
PID 748 wrote to memory of 3160	748	msedge.exe	93
PID 748 wrote to memory of 3160	748	msedge.exe	93
PID 748 wrote to memory of 1372	748	msedge.exe	97
PID 748 wrote to memory of 1372	748	msedge.exe	97
PID 748 wrote to memory of 1372	748	msedge.exe	97
PID 748 wrote to memory of 812	748	msedge.exe	98
PID 748 wrote to memory of 812	748	msedge.exe	98
PID 748 wrote to memory of 812	748	msedge.exe	98
PID 748 wrote to memory of 3556	748	msedge.exe	99
PID 748 wrote to memory of 3556	748	msedge.exe	99
PID 748 wrote to memory of 3556	748	msedge.exe	99
PID 748 wrote to memory of 2812	748	msedge.exe	100
PID 748 wrote to memory of 4112	748	msedge.exe	101
PID 748 wrote to memory of 2812	748	msedge.exe	100
PID 748 wrote to memory of 4112	748	msedge.exe	101
PID 748 wrote to memory of 4936	748	msedge.exe	102
PID 748 wrote to memory of 4936	748	msedge.exe	102
PID 748 wrote to memory of 4936	748	msedge.exe	102
PID 748 wrote to memory of 4428	748	msedge.exe	103
PID 748 wrote to memory of 4428	748	msedge.exe	103
PID 748 wrote to memory of 4428	748	msedge.exe	103
PID 748 wrote to memory of 2988	748	msedge.exe	104
PID 748 wrote to memory of 2988	748	msedge.exe	104
PID 748 wrote to memory of 2988	748	msedge.exe	104
PID 748 wrote to memory of 1004	748	msedge.exe	106
PID 748 wrote to memory of 4812	748	msedge.exe	115
PID 748 wrote to memory of 3728	748	msedge.exe	116
PID 748 wrote to memory of 3464	748	msedge.exe	117
PID 748 wrote to memory of 1172	748	msedge.exe	119
PID 748 wrote to memory of 1172	748	msedge.exe	119
PID 748 wrote to memory of 3984	748	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://beyond.genesys.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff16cec188,0x7fff16cec194,0x7fff16cec1a0
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9060541149412873448,17026614426069669901,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2538438786906459125,7432408990170348264,262144 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,712186129159614232,6651542322022369285,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,165236152568091756,741142416164782186,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,13895321727088377130,12981927242802416826,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,8647266346986768793,11153659049271168307,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2260899768008043435,8737937147748945436,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5172,i,3645271491548168802,839350258193989101,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5316,i,3194252040563744731,129510247369272998,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5476,i,11322835856962465275,9847634577664114365,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,7550342279957487882,480909229167779892,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,7069963093535213822,7284552508102388812,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6040,i,324152269698867095,10054696780544290772,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6216,i,13762885998479459809,3048391018517205539,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6348,i,7232455984641373828,18039024646500536097,2097152 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,8824548418498316758,11997847118899831848,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,8824548418498316758,11997847118899831848,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,11978765093256810625,394239787118605095,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,13528875397693290981,13367211611612739850,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,611782007421715605,1943087539849787507,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2968,i,6294562336507017303,12925978269436449363,524288 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,12030495927280562729,15726355494704985067,262144 --field-trial-handle=2420,i,2948926877973873726,14562938247041564276,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0119eb24-2bae-4518-a01b-15d92f4d07f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0119eb24-2bae-4518-a01b-15d92f4d07f7.tmp
Size 18KB
SHA256 66293432bfa4939cefdaac130517002cdaabd5ffbcfb0625cdecb056c1787326
MD5 d87011f23d4eabbc0432a0f369c71cae
SHA1 56a865ceffbb8e952056265f96b823a840a6b779
SHA512 17f3e76dc622144dfb5267a3c2b1a5a2c8c7256d98f21149b46357418294aa706b112f568af9e4abd60a125a4b4a6601cad60980b04ae113fffe5e8624ee9e3d
SSDEEP 384:iQkUSv0sNVeyhVDgMibjkuQX5+DtQODEB5oP2IdMtUEIIlH:a0ahBgMkakDeOQroP5kUELN
TLSH
T18F827D35ACA96D378EA7A150F48A3243DEA49127D6C45F84DADDAF2C01C92EC235BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12042a49-d41a-4754-a584-49b525bfe976.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12042a49-d41a-4754-a584-49b525bfe976.tmp
Size 8KB
SHA256 5400398bc0daf185527511877447b4e91592fb6fb530d7097c5060f4b3948933
MD5 2064e8a14797273620ab6ffa4e900cb0
SHA1 63bfe02b7489f0abad19ddc9a9e8574a40a45747
SHA512 8bff3f8a66d236942802acdeaf34a9bc32043f3cd2fd762aaac1d37aedbceea78ff5488fa068fb13581fdc27a49dc92c6af865430c1a8e1b0811c34fa9b6c54d
SSDEEP 192:cONQ6nnHnQmiUyIIvYcX5hQDP1QODEzNKDg3bq5PU6:cONQ6npAvNX5+DtQODEBdoPU6
TLSH
T178121B35BDA8BC774EE26590B08731139EA52227E6897FC0D5EC6E1C01DEA6C130ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35dba023-afba-42f5-958c-651a6395fcfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35dba023-afba-42f5-958c-651a6395fcfe.tmp
Size 8KB
SHA256 45bb529b556e664a7538fb59da5f8ac4a390074b53e7749ad3af3faad648c9ed
MD5 85911a2a8fa4fd447aa75374a00b58c5
SHA1 122e8d933a0c3acafdcc8ca33026cdbbf7898d33
SHA512 4f60bef7c1680e8637eeb6216004cdeb842969a11ee79bd230429247680d01094893c459eac73178ac1be40c0d08cafc55372981742e001946c637cfeca7f6b6
SSDEEP 192:EONT6nnHGQmiUyyIQYcX5hQDP1QOD1McHUmU6:EONT6nCuQNX5+DtQOD10mU6
TLSH
T14C02EB34BCA97C778EF7AD49B48633139FA4217BE5946B80DAE85E1C01D765C230AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39420033-bdbf-4300-907a-b0f631e5b614.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39420033-bdbf-4300-907a-b0f631e5b614.tmp
Size 18KB
SHA256 f27a483640da37442d4864e41d9bd74a72f740ec57fff9b969e817f96f744a23
MD5 52f4de6530f1b091944292552f338955
SHA1 e46e981f634bff4e311bb9c1df837300e4b3d200
SHA512 df3f98ef042c1cc14c89cca06f68dd24625202a6bba58c7fe1d67f1ac2d99f96a78751f838633a2fdf6b80c3e2664d47387cca650516e58b81c2bd09f6d51180
SSDEEP 384:GQkUSv0sNVryhVDgMibjkuQX5+DtQODEB5oP2IdMtUEIIlH:m0JhBgMkakDeOQroP5kUELN
TLSH
T14B827D35ACA96D378EE7A150F08A3243DEA49127D6C45F84DADDAF2C01C92EC234BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

475eab51-d436-4000-82d7-a465f7a0f3c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\475eab51-d436-4000-82d7-a465f7a0f3c1.tmp
Size 26KB
SHA256 750dff9add5bd6719a5d4d214f6945bc9e24f47aa8b4f0c9a3372916df0db92e
MD5 aab238b75f781b8b68cf7aca96af29fe
SHA1 91b6a62c4cea17b798716149608ce0fe69389689
SHA512 24185ad58a036ec1289aed3913534b83e9bb4fb511ce73399b52f70e6225fe371521e9fccd0bc494be2f31994af35be41b5895d3b82c1d1812c469744f63dbfe
SSDEEP 384:RiFzQkUSvfzsNv8TUNTUlIlryhVDgMibTkuQX5+DtQODEBPoP2IdMtUEIIlH:4FdbiwgshBgMYakDeOQpoP5kUELN
TLSH
T1FBC22AF248D79837C9AE9743A37D2D039EBCD163F5845A80B788591CCD8A1BFD30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf62da6c-46c7-4ce9-bb7a-e5f9f81fb829.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\bf62da6c-46c7-4ce9-bb7a-e5f9f81fb829.tmp
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

1151e02a-4bdf-41b8-ae5b-012064d4660c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1151e02a-4bdf-41b8-ae5b-012064d4660c.tmp
Size 10KB
SHA256 415af62871d857bb673a8068e66f0cbfcb4fac3998ab20cd53618c657bfe65d8
MD5 63d7232799c216609bee247e56344510
SHA1 a5c32ec6e092dc4a3532f658491eabae9c450eb9
SHA512 04c32a42c14ba6f2338b2aef21daddecd461186aac2a46159b9d740354bf3cbc0a4a534ccc55f1c8dc06b2f51db0d05f3d2e62eb512b31373372f21c08b68670
SSDEEP 192:sxZ2aRvWN/fjxsqaJIdpCqSHW6+WNElq9ns/YYBgyV1IgrJ:sxZ2aUN/fjxsjC1SHbEYa/fH9
TLSH
T1ED22C9526E34697B8CC7D21DBA15BF53E6F9613261D01E88EAFC861C05E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c57a98d-e0b4-4e7a-acb6-8d108389dcd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c57a98d-e0b4-4e7a-acb6-8d108389dcd7.tmp
Size 27KB
SHA256 fd23e30a71c03649bbeb59af436fe6e624c89f88078819e741c5ed1fa12a5c36
MD5 3031fbf113c1af8b66ee42fbc33d1f12
SHA1 c5a0287b58edd4b5adc35803a874776e1f1e747a
SHA512 69985af7d7d2046e0727c0211ab3a861127f94a709517e8c7d448d4fda5818f8b805d45da32586da907fdbf2f379db9dafe04458b17be8041ec7dd91a9343aeb
SSDEEP 768:IhyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXTropF87:IhyYR7jWv3NpBu1ja/CL8OXga
TLSH
T14CC2F93B640DCB7E4FC01A9DDC5A6F9B7E9802C7A6548D4047FA944C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8285c36e-2358-49c5-b636-2eeb9c16dd0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8285c36e-2358-49c5-b636-2eeb9c16dd0f.tmp
Size 10KB
SHA256 370f41695d3a7c3517f1f1f7ba4410e660139d99642efb6e83aebae956122b13
MD5 2395cc33e14138c95d55b8ae0ad928f6
SHA1 208df763f7b61e69104ce9873d27df441cb051e8
SHA512 2c2fe79d7d4e6c0836f802b798ec80e718dd23d3d022ff2b0538656b19b4aebd9becda4fab8ec51afbe2f5b0759d067332683ee4ef6fa3f22b0cee52143dbfcc
SSDEEP 192:sxZ2aRvWN/fjxs8aJIdpCqSHW6+WNElq9ns/YYBgyV1Ig5xJ:sxZ2aUN/fjxsxC1SHbEYa/fHJ
TLSH
T12A22B8526E34697B8CC7D21DBA15BF53E6F9613161D01E88AAFC861C05E67DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87902f82-27bd-4cfa-b6d2-22422adfaef1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87902f82-27bd-4cfa-b6d2-22422adfaef1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87d83503-9d0a-489f-b451-9c21eed84082.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87d83503-9d0a-489f-b451-9c21eed84082.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 174KB
SHA256 dc827eb25168d4b59d18d7278d300088b6c0e41a70579e8bb6e23008bbe0b68d
MD5 e4052b58ee58a7a8d4f29ddc2cd9e16b
SHA1 cf50d27e0d9426086c583f3271f2853e476196df
SHA512 b7693dbf25ccf95fb9a11f99aafff88cb199572bdd39b80d5c7ba92503c759d070e7ee1de29cdb9a03b9327769a0667b09805155a658b7c6b2c0ff9bf2561d85
SSDEEP 3072:3XO7dpuv3SdBaop0Ojcm/9/nnhQmj1cJ9td20Ff22qzpZjYPRmnW:3e7dpuv3SHaWLcm/1nhStdNF+TjKRoW
TLSH
T1BB04123414EF556A84949ECFD5FA973C395743F9BFCA001AA6E02010EAB46F9E54E860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 219KB
SHA256 2392afff07ac0c07af195f2b73250cde8353be08e0c877fb1d7d7efece1f892b
MD5 81e185831a8911a63850be5fa3208c60
SHA1 8ae5ff1e0ebd32d09dc6ce39225e7aebf2c55950
SHA512 6692399f39f7ffe2509f6108c94431c9924b82318fcb0f21f72225ad88647e96bae0270483400df9237036d1ce7994f3105935837a23b7d272712a161ef0654b
SSDEEP 3072:zdLnAmMgjbyMvATzXEk1yec4FDz8lmFOU1l5UFfOD8aqki4qRfvzXJoDuIGec:RneM6zXEOyz2PjUxYEkX8HzX0jc
TLSH
T1882423FFEFA68EB93E839361055799311D8274E207BBD800A961B973BD220911D36763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 28KB
SHA256 1b9e9b46474bef1f4cd4bbc0e4ee4d560cb3ea5f4bfd7f19ac7b811aabbba0dd
MD5 a1a80ff28a1fbec767fac503dea2e35b
SHA1 0f10dcd7eb1cbaf73aea780bfb23926f810d8312
SHA512 1f84df60ec464e444bb8ff4eb0a5a5a73bba2d21123a884fa2800a4e7666eaf4bced41b5ad752a239899f67d32f874d96a97d2f7d64a1175eade9c1ceb0c19df
SSDEEP 768:TnFBCpmGcODI9TjPIUpzAC0jJ6EN5OvZek:jjOmFMzUpO52Zek
TLSH
T192D2B5B032A98D3543A80119B27DF3D6F2F111F58E1AC46886DEEC2D7094EC684A5BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 19KB
SHA256 ea50ac7fddb61a5ce248a7f8b3a31a98fe16285e076b16e6da6b4e10910724bb
MD5 dc3e086fc0c5addc09702e111d2adb42
SHA1 b1138b84ff19eac5f43c4202297529d389bd09b7
SHA512 10123c785c396cf0844751a014413ecf4d058ad0c00caaef5f8ffef504c370f03eacd0b3c2a49211eee0877b7ae7d0ef6e01264f04fc910c2660584b5e943be0
SSDEEP 384:U0iwaxoOUPVkOJJSu6SsCKTIRDqG9oHKwZh98OSv+MsgkAOY:75mlUmOSu1guh+fZhLSxkAr
TLSH
T1FB92D1ABEFA435A8A81598F23C296F3130BE12182359E6733171DC275DB5BA7D31C934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 c959abd6d7cb4679286adf2988f47864b5bcc486ce7dd7618ded573e2e95ccd2
MD5 03b1add22576c8bbc18da4cf92a66cf7
SHA1 27e00236bca24978360958b7327a4910e348fe5a
SHA512 fbcfbf8a2c05b1e6442109ecde577f55d0c5582b7e33ffc4a7dd309c704452a4f6486dbd4df970eedd9317f419a18069c5b1367f015c680db1212453a3ff690b
SSDEEP 96:bqDYAwPRqVft6y30Dy0nyqhnDPUmAAkpS5:yYAwPRwl6tyuymDPUmNOm
TLSH
T13591D841EF88837BFFA96EF28AD49597323AE4F925430D2A00F4C7B593663A5180B084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d5d62a3e9036993b95243039a0d20f5eb483cd45ece60119152fc7992763e3e0
MD5 51d523b1b764025f7ef5de80bffe158d
SHA1 be47d76647c8dc8bbe135410cf8199f3f42c3a91
SHA512 a7873dd382dee97fd4d3cf8059abc8a941c78a37335ba6210bd0483dd88e900dbeea018c7c278b36d6364a05b7f18d89897ef0fe3db991bf9f95a3a90ea8b1ad
TLSH
T13F514242ED5082BBFFAC6EF18EE4A687363AE5F815431D3A04E4D7FA97563B0050C054
MD5 SHA1 SHA512 TLSH

Submit Download

12678992-4f1c-43a6-885a-6298afa9c967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\12678992-4f1c-43a6-885a-6298afa9c967.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_beyond.genesys.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_education.genesys.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

12b16a02-f603-45ec-b9dd-0aa44ded3821.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\12b16a02-f603-45ec-b9dd-0aa44ded3821.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b89a0828-c5d6-4349-ac7a-c83531493a8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b89a0828-c5d6-4349-ac7a-c83531493a8d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f99ac932-a8f4-4b4e-8fde-f892804d46de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f99ac932-a8f4-4b4e-8fde-f892804d46de.tmp
Size 8KB
SHA256 13928c47309f72288f4d5f59a486afe47bc124090c9258573e47fc0e66776d91
MD5 c9b6a318735b9b2e83e4c673e97b0964
SHA1 a0e156672f85fd94b9668934258090f83b8bac44
SHA512 b00c9379a9a11d994cdf3d463bd2b9cf43f406bfa261ae5da54b38134e1f46990f71429d9f95afc87182b744f66470071adebe33563dbe528d503001f09a4bbf
SSDEEP 192:DR0wjHX/A/foAOtYaDAXu8kkGgVRI5hHh6GhAaoqbDuuQU3ERglEyT:DR0wjHX/A/foAOtYaDAXu8kkGgVRI5hX
TLSH
T1060259F783A4423DD92151F4AB182E1FCE69282107AC7C37C9EAAE46D3E1871E14675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e8002cea4ef3468d02ad3dcd91379ecd576b518a59456c24004b71b6546db763
MD5 eba754a6c46329e6bb96377ef7f055a9
SHA1 2f8db3e66a6f7bd39a11156aa2f9c36f79c7f006
SHA512 e87cb30aca834a705e68679e7630ed89e476e1316362f6f2cec7d4d1e54cb5b351825929789f9a5ee460f44bad8fd204c6ee910058df1c111c9a8f9382af7a0b
SSDEEP 48:KglEZVnTHIbbebIStIK9N1/IxNYYO/VFyLeZ04WcMFbwX4ISQFK901GFx+VYvwsk:KIygK3KmWNKKuIFD6KIAKOhKKKwu
TLSH
T13EC1E05031BB064539BE39989474872A52813277306AF52BBFBD08A24E6FE1C4DFF4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcf1833e-f87e-4748-9054-b63f4742cf6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bcf1833e-f87e-4748-9054-b63f4742cf6a.tmp
Size 10KB
SHA256 554954546d39722e7c07bade3a5180545dd96ed91a67f91c3e5f3c479b889c56
MD5 72512d8562c3f886591f4e96c3dc05c6
SHA1 cab2bda3d9724c88458dfcff10c57a5b0cb11524
SHA512 4ff9b9a5deda1051495050a7ef823ae0b4542690c8619c90b0790bef6cf0d62ff973675a7b7027bf3e03f4aef1231149ff0e9bf8548ecc3897678584c5080291
SSDEEP 192:sxZ2aRvWN/fjxsCaJIdpsqSHW6+WNElq9ns/YYBlHV1Ig5rJ:sxZ2aUN/fjxsLCXSHbEYa/fJf
TLSH
T1F232B8526D34697B8CD7E21DBA15BF53F2F9603261D01E84AAFC8A1C05E76DD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4f6e487-09f4-4ecb-92cb-36c30b8af220.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4f6e487-09f4-4ecb-92cb-36c30b8af220.tmp
Size 10KB
SHA256 710f2cacad24e1043462401734ca577e4c3f3b47d1c6e07d203609c3bd284dfc
MD5 0a400f62ac2fddb86e3e0600a4d57283
SHA1 a1d026f168348d7bc85374d11abc75d6479c6895
SHA512 0712750b717f975572eb76f2d6eee5e00931d3d892e5bde5d17e56043f4238ab0360f269034017000d62d315fb840d39b4763c3e08897f9352bcd4fd2bfad009
SSDEEP 192:sxZ2aRvWN/fjxsCaJIdpCqSHW6+WNElq9ns/YYB9QV1Ig5rJ:sxZ2aUN/fjxsLC1SHbEYa/fQf
TLSH
T13522B9526D34697B8CC7E21DBA15BF53F6F9613261D00E84AAFC8A1C05E76CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e586af67-58f6-40b6-8daf-4d0fe35629c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e586af67-58f6-40b6-8daf-4d0fe35629c2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d70c9e0-c6cf-4a3b-9f85-a3d45430f502.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d70c9e0-c6cf-4a3b-9f85-a3d45430f502.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 efdb9e077b1491615af2169432078718ba9bb80e26b3ca8be6c78752b9836bd7
MD5 342ddba7837e3ec602a4312229e27f97
SHA1 266edeaa90cb748ce161093a7d331038fa0ab26b
SHA512 4218bec5686dd9f850ad927f0afa7099a05f1b51cdf3bb126d1ed856b22b0f87c73d6b17e8841eeef29f8fabdaa192046bf81eeeaa9e0671fc7ce2f0c4add4bb
TLSH
T12E41095CB6F91108B3777E45ABF6A86D443BB8772F46D59E00110D4F0A26B40D9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download