hxxp://www[.]g20investmentweek[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.g20investmentweek.com/
Sample261102-2rth2agd98

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{2D93CF08-1095-4CFC-91B3-0DED999DC212}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4172	1180	msedge.exe	84
PID 1180 wrote to memory of 4344	1180	msedge.exe	85
PID 1180 wrote to memory of 3736	1180	msedge.exe	86
PID 1180 wrote to memory of 448	1180	msedge.exe	87
PID 1180 wrote to memory of 4344	1180	msedge.exe	85
PID 1180 wrote to memory of 4344	1180	msedge.exe	85
PID 1180 wrote to memory of 448	1180	msedge.exe	87
PID 1180 wrote to memory of 3084	1180	msedge.exe	88
PID 1180 wrote to memory of 3084	1180	msedge.exe	88
PID 1180 wrote to memory of 4872	1180	msedge.exe	89
PID 1180 wrote to memory of 3084	1180	msedge.exe	88
PID 1180 wrote to memory of 4872	1180	msedge.exe	89
PID 1180 wrote to memory of 4872	1180	msedge.exe	89
PID 1180 wrote to memory of 4536	1180	msedge.exe	91
PID 1180 wrote to memory of 468	1180	msedge.exe	92
PID 1180 wrote to memory of 4536	1180	msedge.exe	91
PID 1180 wrote to memory of 4536	1180	msedge.exe	91
PID 1180 wrote to memory of 468	1180	msedge.exe	92
PID 1180 wrote to memory of 468	1180	msedge.exe	92
PID 1180 wrote to memory of 1280	1180	msedge.exe	95
PID 1180 wrote to memory of 1280	1180	msedge.exe	95
PID 1180 wrote to memory of 1280	1180	msedge.exe	95
PID 1180 wrote to memory of 4912	1180	msedge.exe	97
PID 1180 wrote to memory of 4912	1180	msedge.exe	97
PID 1180 wrote to memory of 748	1180	msedge.exe	98
PID 1180 wrote to memory of 748	1180	msedge.exe	98
PID 1180 wrote to memory of 652	1180	msedge.exe	100
PID 1180 wrote to memory of 1896	1180	msedge.exe	105
PID 1180 wrote to memory of 1896	1180	msedge.exe	105
PID 1180 wrote to memory of 1896	1180	msedge.exe	105
PID 1180 wrote to memory of 836	1180	msedge.exe	110
PID 1180 wrote to memory of 2940	1180	msedge.exe	111
PID 1180 wrote to memory of 4568	1180	msedge.exe	112
PID 1180 wrote to memory of 868	1180	msedge.exe	114
PID 1180 wrote to memory of 868	1180	msedge.exe	114
PID 1180 wrote to memory of 3848	1180	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.g20investmentweek.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe964c188,0x7ffbe964c194,0x7ffbe964c1a0
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,15543023393170018397,3556078855082953824,262144 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8456744981764172460,17273263566160193445,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,13482927249181785288,3745067355132408263,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7897656107590678635,8481406727318068758,2097152 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6119551041461747136,8370244093139187284,2097152 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,11569098848295713588,250947040582277424,2097152 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,17656109127982327168,9098848750976303434,2097152 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,2053897257617398978,5829846154973151483,2097152 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9053699302316277085,15430124759239095764,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17527071896395449773,8763918218309195180,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,18367515104525191721,14670401647681291261,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,18367515104525191721,14670401647681291261,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3672,i,11165678191414132188,12877567149334076137,2097152 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,3675522327500185561,9648900510575821527,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,1303044066493888273,4957206813551694958,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,7700524350596442632,1955004879097574298,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,18026486106838791089,12088994182689067829,524288 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4420,i,9025380909096948708,3160278909057100003,262144 --field-trial-handle=2292,i,2915841306216630851,15737202762993826130,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

082057d2-f603-4081-8727-5439e131ade7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\082057d2-f603-4081-8727-5439e131ade7.tmp
Size 8KB
SHA256 e4dde9572bfa91a768112bec4cf418a932ac984e14d12a82b0ed9fd0a621e644
MD5 c25ca5362b715a22c15fefd9daed89bf
SHA1 e23eb5b48cb9a7f85a83f37fb6eaf50e6c3b8fa4
SHA512 4114b55224109344ebe723397a9cd1b42e9b8722db6937c7eecdf9a427c1148c81b5efae63c51c770dcc875f26916db70833114d8801194732a70dad6c5f2930
SSDEEP 96:3qONkgQsjpfe/tyng7X5ih/cIPURHl8h4otop5RYDJNBnP9ZvEI0IG2jbg00Lx6v:aONI6IE7QmiUyEJTPuIGmF0LVC7sYbU6
TLSH
T19E02F939EC7C7C7B9EF3AD48F4876B23AEA5112BA5952F84D9E81A1D00D721C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10ad9a18-de21-4db4-b964-5bfbdc8537ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10ad9a18-de21-4db4-b964-5bfbdc8537ed.tmp
Size 18KB
SHA256 dc646006931d52c94c5ccc97cda7639680f93e78a0ab309d2853cdcb7853b50b
MD5 65a883af0ad97cbbf2e83d23282fd3bf
SHA1 bb12b79e4df828b5b9745bd0a6afe441ebf11845
SHA512 cfeb04b58f3be7645b4002a68225708eaf01dc8d6268e78fb25738f0036e7730317d049a64ee582850aa4681752bfa2b7b81628457b32561baf8ef47b3b6f1d2
SSDEEP 384:WQkUSv0sNCA01RUxzIGmFAk9wXdiLH7vBEvsIIlk:207g9CTAdiLH75EvsLe
TLSH
T14D826D76A8747C3B4AF3E514F1863A139E749167E6D85F80E9DC9B1C01DB28C230BE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32f0bee6-5c03-45db-9605-dca8f7a93a85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32f0bee6-5c03-45db-9605-dca8f7a93a85.tmp
Size 26KB
SHA256 59bd245a8622b0d3cd16cb9a5a3caceafa5254a9b93ef5e9af6abe5a67986876
MD5 4389270840bfa42ad2250808689e6ba6
SHA1 8b11cd89c63cdcffa42b5d85cbc553c1950d2304
SHA512 d21c2d54f158f11ed94b785943395d4b0d524c8618e04aa7de5bc23b20441159e4c1fe40eb7bf421b01be6fbd1627136b31e9fc76e5b7a7528166df53b32c229
SSDEEP 384:UiFzQkUSvEzsNa8TUNTUlIlA01RrxzIGmFAk9wXNaiLH7vBEvsIIlk:vFd47wgvX9CTANaiLH75EvsLe
TLSH
T13DC2F7F298D7983AD9AE9B03A37D2E139D7CC067B5845A50B788491CCC8A1BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b2cc752-2446-471a-b2dd-ee1ea1c558cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b2cc752-2446-471a-b2dd-ee1ea1c558cb.tmp
Size 8KB
SHA256 6b6e77a396ec80ad54956acc25214d449c78dbb37bcdcbdabfff989112a17a52
MD5 8ad6d7ecff96e78dbd7a8d5d79e9fd2c
SHA1 2dc3d46deee8a00af2064c3a15f6e242c1f3cd31
SHA512 bbc5485f6a08b765afbe73cd9e16a0a6ca7bac9e333ee1fadf20ffa9420cb7c6e78d8aa2095628a2c7a94aeab7321bbd8dbcded716a0bedcb64205f6cb25bdee
SSDEEP 192:0ONz6IEZQmiUyVJTDuIGmF0Lk90FXZ27Hlqp4U6:0ONz6D3mDuIGmFAk9wXGHLU6
TLSH
T10E12FA35A878BC7B5EE3A454F4C73A139DA54227E6887F80D6DC1A1C01EF65C130B966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e382c3cd-a83b-4129-a565-88f9565d808d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e382c3cd-a83b-4129-a565-88f9565d808d.tmp
Size 105KB
SHA256 7fbf8b23a13854c0c33f9b9cc9b82042dfb881d0f9995938391cf2da54cfb3de
MD5 f027022507ec94f32265883243245251
SHA1 a21e2e3703475c52ae4b2881bbdf87320a7a1aa4
SHA512 b618f5fec905802eac699560ca9b2bc85f4fdd04e41ff5ea96bbc8db8724a369489826c4b1839db0a0fe4023e73b7e95ac2ee4efdd1fc7f55c8c5ffcbd19d4cc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T1E0B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

3f29366a-b0b5-465f-b6c2-fb4326ac80fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f29366a-b0b5-465f-b6c2-fb4326ac80fd.tmp
Size 27KB
SHA256 f481ca55a552e0878a1f9d7951dd7cf2388c7dade2b9281f0b7675921b641daa
MD5 1bd3e3787d320f38a6795e2ff359e619
SHA1 2d62de05c89ee9bfb1be5019b1ed2068e3efda8d
SHA512 a7298ac85fcc430ced38cad80fba735579b574a25d01b60d275da71be98d28460992651f102af16cb3317fd786e513f73650ea5219c1e95a9a1c5fe43c226aee
SSDEEP 768:D5WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7cro46feumRI:D5WPcLKWvKeEeu1jaClLiF7H46WumRI
TLSH
T127C2FB3B640CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4464a694-bf0d-4b02-af8d-82bdfc195737.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4464a694-bf0d-4b02-af8d-82bdfc195737.tmp
Size 10KB
SHA256 4337b9ddb5b74b9834583f28f95d6cc8bdb91a907d5d20aad1e070c0e427e4ac
MD5 5acbb88a29c26f44229a110210fbed2c
SHA1 81ec5c6e9ae60dcf615720e5a7a9121e048ea08b
SHA512 1c6c7517bdaf8f5e44da9d1da779305f73a483bbf728cb9aff02e20127c90d80e1b96bb08e6872222b0fe1784d88370f7132c02c80fa8e3a9727ddbe3b4497bb
SSDEEP 192:sxZt7R2W7L/fbYslxt8IdpGiHW6+WNI1Vp/YapzGwmIg5PJ:sxZt7j7L/fbYslxn9Hb2/cH
TLSH
T11232C7226E34697B9CC7D209BB55BF53E6F9143291D11E48EAFC8A1C04E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5910c891-1cc6-4f78-84d3-a0e398eb0073.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5910c891-1cc6-4f78-84d3-a0e398eb0073.tmp
Size 11KB
SHA256 42c26d7482183b640c3639565558abc49197bff81f8d426e79f4ad9fc2bb73cf
MD5 dfb23e7aebecdf3f5fc09865e03808c7
SHA1 d55eecf79f803c4373486ecee55acca5e8ec5b33
SHA512 4576e7c940f150d52881cbf8095cdf7437444bb11c8fa7aaa54a4d55fbbc20d00e846fb07432973bc8cda960142c55c73e7ada4ada095456ff2ba872512bc89f
SSDEEP 192:sxZt7R2W7L/fbYslxt8IdpQiHW6+WNI1Vp/Yap0JOmIg5PJ:sxZt7j7L/fbYslxnPHb2/KH
TLSH
T1E132C7226E34697B9CC7D209BB55BF53E6F9143291D05E48EAFC8A1C04E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623635cb-dd06-45cd-8d78-776162f65c1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\623635cb-dd06-45cd-8d78-776162f65c1d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 350KB
SHA256 9213695e49135b2b4210878deefb3175bda171b6b435beac015f402684e5ddd0
MD5 ec8b9b0c9f3c90635368e649421dfa07
SHA1 abe7ca6128a3b1b393c902eff3ed39605279cd9f
SHA512 2072062f4ed9d3a5f4d69ed6fa79c52c12336147b03b9e0258a61cfb7efa411ec230fc8c28f2dca7bb8253bc48ecfbc51a06083ae5433962dd0f85a56f96acb0
SSDEEP 6144:VatIoleCgd8D9UZrUqr3NI5bwvb8PgMvlYeUyPWzDL80niVq03XfEt:gl3G8DWiqru5bU2yeUueL80mXfy
TLSH
T132742317566A63A822A9DCAAFFF31F02D4EDC23150ACC45B412653BCD64E6933538F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 bc18275cacc73a49026c57b2b201b276895973d103ae0cd4c5773a9d27bc2473
MD5 6bb91c5deb40d489879bb2db2b26b84d
SHA1 9adff322e63b8593a12a3366344c317e51c1d0fd
SHA512 dd685943f204377486764c8a313de0e44e19ecbd18694768c9cc582590dd3fabcb5402ff548a0be6c58a22dfdbac1892744cc40dcdd9f15beecadf2652702bad
TLSH
T1D051528126A25370FF64F87E59E413AF3B38D481D3C76E5A0C92DCBC7B8A39D5006004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 587bc707abda995ee040743c60689c755a3011240487bda9e7c4cf0e196e9b78
MD5 d220b6271f8111333c8a0249b1a73f55
SHA1 a15894ed06c06b57f1c137bcab721b6d35c3e66c
SHA512 c10ad6d594bc967406d45905391a0b79383eabedb6d44953a3c591d445bfedb1bb94b92e4702d6c04c9db8c924c0afcd7172fb42c614ca6bffd6e07ba5aae25f
TLSH
T1AF51328056925374FF64F87D99E4136F3B38D481D7CB6E5A08A5DCBC7BCA39E9106044
MD5 SHA1 SHA512 TLSH

Submit Download

c07ddb12-9e31-43e2-91fd-e90772880e1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c07ddb12-9e31-43e2-91fd-e90772880e1f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3cc0b50f-08b4-45cd-b016-3ef33510482d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3cc0b50f-08b4-45cd-b016-3ef33510482d.tmp
Size 4KB
SHA256 096bc34a1e7fe40f52a887bac44236682b8602b49ac4ad30694e00cdb62505cb
MD5 be92416bd1e0f4d15869dafcf28878ef
SHA1 4018a39ce6b974eafcd77916f26f59a6a75a29c1
SHA512 0cebdc6815bd5536ff84399afb9eb984fba9785227d6bfae9aa08deedd0d5d5badd006cfc5df5794383eb73b786efa4d40c6726dff8b0b1d4a20886d5a3a159a
SSDEEP 48:YALlNKONYNy2L2I2Ss+9zBBsrCKs+pks+prsS4zsk8Rs3YsZQWgwEsn7sIesLewC:D4OuwWl39zBg7sLG885QxwTBRewBI
TLSH
T1F3A181F7CAF8C22DCD01B6F4E62CBE1BCD1A155593287CAE88D49E57D7E2422D10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

926e2742-d10f-4419-b5d8-0da528beeae4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\926e2742-d10f-4419-b5d8-0da528beeae4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ff6636ca-0614-49ff-9bd6-d0f3892ec22a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff6636ca-0614-49ff-9bd6-d0f3892ec22a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3fdc6b2cb07fb28f76aaee436ab03740624a1662876840bdc4544ff1c3b3f9e
MD5 7b157b46bbdbf78ebae264fde243948c
SHA1 29658d0bffbd4c885407718816757bc6ec47811c
SHA512 873047e627df687ba0f331ef5a217238f2ac378775b7d52110245d38ea3ec5e2e8a01aaa6723b9b857f5062ade1cedcf8dfaa07be7a326eb2fc2d606378cace6
SSDEEP 48:KMIIbKZa0fyFPIlKoEYLk/YU+aWkmahPIhMkKAB42k800PB+05yj5+9pb3jkz3Qi:KMIAKZa+2PSKoEjt+K+AqK6q
TLSH
T1F9A1D00132BA024238BE691981B58B2E525235B37516F62F3FFD44A64E6BF194CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0928c10-7ce2-43db-9e18-e3c4d39d4fc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0928c10-7ce2-43db-9e18-e3c4d39d4fc2.tmp
Size 10KB
SHA256 7ef5258dcbd498ce867cd6ac022a534d39ee0745b0237034bfcdb292de9b71fa
MD5 65a7a62e54ae344e165232c156e20aeb
SHA1 bf94e42cf505dd2e8a07aeb2acc5970bbaaa363b
SHA512 d720ac515cea35889b02c6aec97949cbd7e702fd240067d0eef3fd807f9363e80af0b2870ffc38a780add205ea7df78043dbcde771d3878e4f120dabe17f6984
SSDEEP 192:sxZt7R2W7L/fbYsdAt8IdpGiHW6+WNI1Vp/YapESwmIgrJ:sxZt7j7L/fbYsdAn9Hb2/F9
TLSH
T1C022C8226E34697B8CC7D209BB65BF53E6F9143291D55E48EAFC851C04E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df4bffc6-37e8-425a-a168-f4dd65782ad9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df4bffc6-37e8-425a-a168-f4dd65782ad9.tmp
Size 10KB
SHA256 29197aea61488396720d7ec1070204ce6069cd2ac34ced593fad17cea9090da5
MD5 5234b2c09ce363877f90109004cfe8a6
SHA1 cf3e2b30456bacc4a01f401e74df44b187ca100d
SHA512 ae1aef32da792a8f4b3c88246305f772a356d938deb8382f2d083564e8a52fbab1d7558b4e5761e67a6ded79c49e179e953e9b6fb51344dd2d98da4505dd73fb
SSDEEP 192:sxZt7R2W7L/fbYslAt8IdpGiHW6+WNI1Vp/YapESwmIg5lJ:sxZt7j7L/fbYslAn9Hb2/Fh
TLSH
T13E22C7226E38697B8CC7D209BB55BF53E6F9143191D55E48EAFC891C04E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcfc1d7e-07ad-40c7-9581-e882fb623366.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fcfc1d7e-07ad-40c7-9581-e882fb623366.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

76541caf-9c40-4990-a2ce-25875461a125.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\76541caf-9c40-4990-a2ce-25875461a125.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4113c51-2c77-4d52-b140-8297bf4d0ceb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e4113c51-2c77-4d52-b140-8297bf4d0ceb.tmp
Size 18KB
SHA256 28ef2ac93b9d0a50305f63148b7449a6c6313fb493350641e913ad6a4ae903d3
MD5 762b42a1ec98b8d309e75d9c4df2957c
SHA1 e2e5d4662fff60499504609c4475fba10d4fbf26
SHA512 a7f0fec4f2be5a0d47c6b9f6af1b4c1435ce41d93ca27f0423988e24a04c13942446a99bc2956e7db11b032e50d9e4eab08bc06dbed6e694e06c7e269b7c7daf
SSDEEP 384:pQkUSv0sNC501RUxzIGmFAk9wXdiLH7vBEvsIIlk:L0og9CTAdiLH75EvsLe
TLSH
T135826D76A8787C3B4AF3A514F18A3A139E749167E6D85F80E9DD9B1C01DF28C230BE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3700ea29-f277-46fa-aace-dbb222ddb07e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3700ea29-f277-46fa-aace-dbb222ddb07e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 06751025836393d15405bca514663e5e02926a4f41a2567aed31d8e9508baf88
MD5 f19417cdbe06c4405936c7f9ea4747fc
SHA1 efebfe83df0c58578b7365c7f5227d341a4c6651
SHA512 9f9163e39e00b7a297ab5ca91846569eddafad1f56642ec5734d4e5860ae04c5783749e23b3e9bdfe8d5c8a5e55652183e8668a2a677a71e62148298662ddc19
TLSH
T1B8412C5DA6ED1048B3777F96ABF6A96D447EBC372E06C59D10110E4F0623A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download