hxxps://3dergonomics[.]com/uscourts/download[.]php

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://3dergonomics.com/uscourts/download.php
Sample261110-e7hp5sch35

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4088	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{6A9AD1F2-E85D-4E66-9324-26CD521349BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1196	5004	msedge.exe	84
PID 5004 wrote to memory of 3780	5004	msedge.exe	85
PID 5004 wrote to memory of 4088	5004	msedge.exe	86
PID 5004 wrote to memory of 3780	5004	msedge.exe	85
PID 5004 wrote to memory of 3780	5004	msedge.exe	85
PID 5004 wrote to memory of 3816	5004	msedge.exe	87
PID 5004 wrote to memory of 3816	5004	msedge.exe	87
PID 5004 wrote to memory of 4784	5004	msedge.exe	88
PID 5004 wrote to memory of 4784	5004	msedge.exe	88
PID 5004 wrote to memory of 4784	5004	msedge.exe	88
PID 5004 wrote to memory of 4196	5004	msedge.exe	89
PID 5004 wrote to memory of 4196	5004	msedge.exe	89
PID 5004 wrote to memory of 4196	5004	msedge.exe	89
PID 5004 wrote to memory of 2516	5004	msedge.exe	90
PID 5004 wrote to memory of 4952	5004	msedge.exe	91
PID 5004 wrote to memory of 2516	5004	msedge.exe	90
PID 5004 wrote to memory of 2516	5004	msedge.exe	90
PID 5004 wrote to memory of 4952	5004	msedge.exe	91
PID 5004 wrote to memory of 4952	5004	msedge.exe	91
PID 5004 wrote to memory of 3668	5004	msedge.exe	96
PID 5004 wrote to memory of 3668	5004	msedge.exe	96
PID 5004 wrote to memory of 4864	5004	msedge.exe	97
PID 5004 wrote to memory of 4864	5004	msedge.exe	97
PID 5004 wrote to memory of 4296	5004	msedge.exe	99
PID 5004 wrote to memory of 2328	5004	msedge.exe	108
PID 5004 wrote to memory of 2272	5004	msedge.exe	109
PID 5004 wrote to memory of 1136	5004	msedge.exe	110
PID 5004 wrote to memory of 2876	5004	msedge.exe	112
PID 5004 wrote to memory of 2876	5004	msedge.exe	112
PID 5004 wrote to memory of 1760	5004	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://3dergonomics.com/uscourts/download.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7fff50a6c188,0x7fff50a6c194,0x7fff50a6c1a0
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8210832702011227059,16696634714926961687,262144 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,9760108334759385760,13274035182187232055,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7089393344162861701,2679645422646967399,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14999788756652580178,13653825039390991931,2097152 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17453272043306847233,6650441766761729464,2097152 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,12270538360120315763,803757397866188149,2097152 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,11923950538109585062,10108952800521494310,2097152 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,13205364193311470490,17154052562110700024,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3591027088820946205,4354526562046263833,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,14706497437045472387,11804148966126162981,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,14706497437045472387,11804148966126162981,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5567695858080453529,8190164584514416960,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,6844792343560495536,10735161444515134985,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,4255193723081701618,9052347825590367963,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,4773705630475690199,2449867584465813797,524288 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,12094839514489991392,12433434057957022029,262144 --field-trial-handle=2360,i,8587642714388735274,16706894073242928008,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c91c49f-1cec-4868-ab81-964aa68239d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c91c49f-1cec-4868-ab81-964aa68239d1.tmp
Size 8KB
SHA256 035329933800a2ad33712e110e3f1b84d5e9fdbd45722cfe0f1e0e7248bb143a
MD5 78ae8bb1678883ecba66942a450cfe44
SHA1 786cf6221984a2ccd0a87a67266a91c099773eb5
SHA512 bf8c549d10c1229de0e6f7a7e7ff940adab478451215f2496ade07f5506ad16e0cef695fd1ef48c6747e8be4caaffb078f97a1611410bc85ffe9d96774c2ec67
SSDEEP 192:EONq6nnHGQmiUy5mQYcX5hQDP1C8jzorqo/qMcoZp4U6:EONq6nC/QNX5+DtCM8l/So8U6
TLSH
T13B02DB35ADB87CBB8EF36E46748632139F95212BE5942B80D6F85E1C00D765C2306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cfc2b6b-f8b8-4c00-be40-43141481776e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1cfc2b6b-f8b8-4c00-be40-43141481776e.tmp
Size 26KB
SHA256 00aac94c7e5104691116a2839759207fc25a6dc86d58546e0689c6f031c72eec
MD5 11afe86482ed4ea0bd5153e70ac0bb48
SHA1 a666172d7fc3b96b65aed7e51d5d8aad9053dbc1
SHA512 d72f954b0a70ba532df9c99266c92c09c475c63c69cd155a0dae091e16f966b8b73013784147eb33c15d5c530796ac1ed106852e6e32bb5dde7bd4ecde0a1b2c
SSDEEP 384:ZBiFzQkUSvCzsNT8TUNTUlIlMhxISib3VQX5+DtCM8l/+Xv8rwom1vaTZcKIIlv:SFdKCwgOISCykDY/u0rwom1vaTZcKL5
TLSH
T12EC218F258D7983BDAAE5743A77E2D038EBCD153B8845A80B399591CCC8A1BFD346C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e0a2ad-f1cd-46cb-8aae-521ba5c0b81a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71e0a2ad-f1cd-46cb-8aae-521ba5c0b81a.tmp
Size 8KB
SHA256 ef50360689899e498f75cc9b409253c9a6beb489a9229b4e6d7b89e4a07f4d62
MD5 c3ed88804877a3376ec8944d87ca41b5
SHA1 dc9d64eaa640de777e26bed2b583c68a53e4b571
SHA512 998ed4d757d842895054616fc20eb8edd1bd8783844af859eb2dce110466699ab02bd537e422a7c3d8a6247a54d0a8a811e38f551f2ecf6c06e92183175a9430
SSDEEP 192:WONk6nnHMQmiUy8mnYcX5hQDP1C8jzorqo/+XEcFfErmg3oVq51U6:WONk6n8InNX5+DtCM8l/+Xv8rBom1U6
TLSH
T13C121C31A8A8BC6B5EE36595B4C731139EA51127DA887BC0D6FC1E1C01DF66D134AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

1cd1b660-d59c-4545-b805-1daa4bc341af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cd1b660-d59c-4545-b805-1daa4bc341af.tmp
Size 27KB
SHA256 917bdcdb868c44ee772afc0de80ac78a903df2ebff3fa0811c5a28459e6340e5
MD5 2c05a46a13f8711a4cb66a39f250e307
SHA1 9d9e6b6f4c53317f9e33f7cfbb88376df1eab2a6
SHA512 b9a3d22d43eb8e9bf2a8b0c53d8aca95a6cf7063ac2834cdb80ac8a6ee12fb925e4803833efac2089de25dec333e471b0c668b686c129bfd6d25a9d0bb7e993b
SSDEEP 768:B2yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXyropwb0:B2yYR7jWv3NpBu1ja/CL8OXpf
TLSH
T14EC2E93B640DCB7E4FC01A9DDC5A6F9B7EA802C7A6548D4047FA944C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ce23e5e-8fd6-4958-8cd6-8909ef890949.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ce23e5e-8fd6-4958-8cd6-8909ef890949.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

96fc99f4-a4bf-4fe7-beca-89041c6ce963.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96fc99f4-a4bf-4fe7-beca-89041c6ce963.tmp
Size 10KB
SHA256 9e1e48ad01fc6dd049fcf902f5ef44c1283a8f6a8abfc3738dd852646a8442c7
MD5 b5a6416d4e043f4411675abd48a0dcfa
SHA1 2e708f2145635c3c901a0354988f064660fe4686
SHA512 c4511aeee9917bc3385d4c67f0deb1902cad9f6c44b626c1c7f5bfe69da1c4de94efbb52d76c55904e11b0b861a5518d2c562fa45e1b1085928b48af0b66ba03
SSDEEP 192:sxZzRpWO/fWszGnSIdpxWHW6+WNW181/YYBH11klIg5nJ:sxZzOO/fWsAb4Hbx/fMpf
TLSH
T12C22B8526E28797B8CC7E209BE55BF53E6F9503251951E44A6FCCA1C04E7BCE224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 a97a3bf05ab10edb150dbfe49a6d72fcd0d322f938e71264de6d91d388e816c8
MD5 0ef621a7bd5f71d9164e193d8502e76b
SHA1 c4e2081d1919a82bd32eba762b486deed00c5bec
SHA512 ea4fa5c069f2c73d574e5550a06edbdce45cf8f62148c5746d6ac4c9040720c0216e4ac6fed4c9030b3fa92b1e4d2b850f9b68d03a3c15a4d277404bb23e5836
TLSH
T139516385954DCBD0F3EA4CB145D9478BFF32318447A7BEA632A8DBB95456764C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 497c7e30b56a8cb71a8bc3431606877dea6d5ae8f2a5161af471a8a4f2ccb525
MD5 61446deb6649c4e008830af7005910ba
SHA1 5bdf2c589660c7112062a3320d4d7b84416dadd0
SHA512 7de24eea72b73e9e3b1a5334893207235abfc35d787eb7bc3ce18ab4af4a073a6835c61a2c6cda7ca6b0d839f494dcac4478503744c09c9dbddd7c8ff3efc366
TLSH
T1AC516385964DCBC0F3EA4CB189D9478BFF32318447A7BEA632A9DBB95456764C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

5f05bde0-a824-458b-980c-1c155de1c1d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5f05bde0-a824-458b-980c-1c155de1c1d2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

23453ab0-7b4e-43d9-a820-1c081392fb89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\23453ab0-7b4e-43d9-a820-1c081392fb89.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

96f7148e-33fa-404a-ac2a-616b38d7a755.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\96f7148e-33fa-404a-ac2a-616b38d7a755.tmp
Size 1KB
SHA256 2a6b8e4fb1885d71b2fa95ccfb163caffbb91720b67d6407dfd3c218b0d777a3
MD5 5dbd8621e0850f67192b3106b9e26fd9
SHA1 33ff5cfd2d1633aa19c7c4e7accbe7089a4c02ae
SHA512 c9b1fd627cd6414bf79e5ac6c94f3b8f1df0bced08b7c7c1bd8c717f7f9b87df357ed4ea52dfe9f74f6b9309b5809b58f061af529856f7bb8e070c3d563eba3b
TLSH
T1FD317CB3C6E48AADE9151AF05B147E2ACE1D091883283C1AC9E4FF5B93E30B1D15166F
MD5 SHA1 SHA512 TLSH

Submit Download

dedbdfc1-a4cc-473d-a777-328defd1c16e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dedbdfc1-a4cc-473d-a777-328defd1c16e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ac7c73246529c66af3751b73e096aa8639cdc9028ef8e6a300f20045bf71b11f
MD5 7b59398ae8cf690bdcd8f428cf118099
SHA1 9dda1393c18ae00eba862c093517fc9565928a8d
SHA512 140280ef76187e35ea940563613997dd30a67e3da8859c6d9c750609581c389da3593c850de79eac8cb3e4d7cb24addfd5dd6f4eb6f10f51fc3849745a82445e
SSDEEP 96:KhrANJD1l1GBqIEh1KMEET1IeyMKHqeO/KKYU/Y:GrANJD1lkBqFhHEETSDDxV
TLSH
T11E912480316B460838BE2D8D80B7875A52417273B01CEABBFFBD80955D6EE445DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3869188-cba3-460e-9cc5-211efc230b5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3869188-cba3-460e-9cc5-211efc230b5e.tmp
Size 10KB
SHA256 10b265e53226662e45fee33376718a6d4e064c6faafc3fd70a74e42c33db47af
MD5 5a6c6ef98af5a3e81443c2a197d93c23
SHA1 07bc54d4dd3a0c98f505870abbb83a2eed3f2c41
SHA512 2de4c19ecee17a0634a53edf77cac247e11f4097cb18cad5aece930ca8bd71630a25d027afb5d431cedbbb081ac9058969d93fd9d93a825fba3fc552d0dbc65f
SSDEEP 192:sxZzRpWO/fWszknSIdpxWHW6+WNW181/YYBqF1klIg5NJ:sxZzOO/fWsyb4Hbx/fnpJ
TLSH
T1DC22A7126E28B97B8CC7E219BE55BF53E5F9503291941E44AAFC8A1C04E77CE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7c3b803-9b80-4428-8a7b-78aaf9571bfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7c3b803-9b80-4428-8a7b-78aaf9571bfe.tmp
Size 10KB
SHA256 eb8ba702d0d146c50cefadb2f5f338c435b5e2a7fb2d8f3f99dc88c3e0001738
MD5 be962cf0ffa617f7a8e4f8990a135cf3
SHA1 a11d7e9c33fce2e5a45c334e53fbf31441d6acf3
SHA512 8f5d24a4934569d8351cb9b556d6b8ec795f50551da77c22b02fd2a0bae4f70aa17408b946ae6f92ee0b155454651b3689b768a214d6726705893d87f7ca7ed5
SSDEEP 192:sxZzRpWO/fWszGnSIdp/WHW6+WNW181/YYBTC1klIg5nJ:sxZzOO/fWsAbuHbx/fLpf
TLSH
T13822C8526E28797B8CC7E21DBE55BF53E6F9503251941E44AAFC8A1C04E7BCE224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f150ba3f-f919-4cca-afaf-0fdef22b01bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f150ba3f-f919-4cca-afaf-0fdef22b01bf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc2a7cff-0fe5-4da4-8142-0eaa702ecd35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc2a7cff-0fe5-4da4-8142-0eaa702ecd35.tmp
Size 9KB
SHA256 7db890c4b89b3c376321193f92c33af79bb9a4af75fdad15da3781c7e3943860
MD5 a693e227e5cb4561582b353031708510
SHA1 3ef9f8f6b5cda6061532bd76a59cb41601943f73
SHA512 1a32d2862dca8fd7a71b6b9e8d5114a70a67cc362fe7123779dddad521e6e9b578e4a03e3e09826286f8d677cba1402c465c1b59d600b140c66f69e12a3347a0
SSDEEP 192:sxZzRpWO/fWsxnSIdpxWHW6+WNW181/YYBqF1klIgrJ:sxZzOO/fWslb4Hbx/fnp9
TLSH
T1F822A7126E28B97B8CC7E219BE55BF53E5F9503291941E54AAFC861C04E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

495d35e0-d663-48a0-8ef3-a45e56971d7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\495d35e0-d663-48a0-8ef3-a45e56971d7c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bad89cf3-c498-468a-93c9-021dd01caf2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bad89cf3-c498-468a-93c9-021dd01caf2b.tmp
Size 18KB
SHA256 dfae82d12218b7e4d8bc5eaa233d38b3702cb7b3271fe7386ced3ca8e3214c3b
MD5 12d1fe5aa93c13a50a59eaee08da88f6
SHA1 9be2eaae3ea0f80f5453b645ddedbfe5c7762e16
SHA512 aa79da80e921fa220d776f2d8fbc25e517a3eddd05809438ef034649f6edbed995a78853b457cba746a285be146657a414bde1c57cb67d3d81d557f33641f8f0
SSDEEP 384:CQkUSv0sNBMhxISibOVQX5+DtCM8l/+Xv8r+om1vaTZcKIIlv:60/IS3ykDY/u0r+om1vaTZcKL5
TLSH
T1AC828F31ACA87C2B4EE7A551B18B3253DFB05117DAC81FC0D6ED6B2C01DE69D234AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdb5de1d-ae3b-4812-88aa-ef44fa6b1fc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bdb5de1d-ae3b-4812-88aa-ef44fa6b1fc1.tmp
Size 18KB
SHA256 c4f36fa6457ea82daf79113b021e184be6f44be67dff7aaeb971e8401aef65a3
MD5 d9ec50b7100878c9cbc347eae21d654c
SHA1 c37b72eb0191a4674da74c1a5a5d8378cb6f6ccc
SHA512 6cc1b7021405f2f05e095e52ada9d939270d8cbc55b4cc07506dfab21293e01742980408274e6894fd133b185ca110260e0ca7f45e8be518ef2a140b40900625
SSDEEP 384:HQkUSv0sNB5hxISibOVQX5+DtCM8l/+Xv8r+om1vaTZcKIIlv:Z0EIS3ykDY/u0r+om1vaTZcKL5
TLSH
T134828F31ACA87C2B4FE7A551B18B3253DFB45117DAC81BC0D6ED6B2C01DE29D235AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf5fa7d7-8976-4f6a-9ea9-c7576173f547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cf5fa7d7-8976-4f6a-9ea9-c7576173f547.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b97fce318b947827570aca7094d319aec4ffc8ad18c5a02505f48345c10ddb1
MD5 655827188a6774348025bcbef52b4ceb
SHA1 d7d71d085b066f053e4614726942d00ce3635b44
SHA512 727f469e7659ce10eb580550e567d54b90db06198a48f328669fb62bad7d9c2222e153d53fd17f72ac0718021c3c7b0c11e62527769563898fac450cb3d7d229
TLSH
T133410658A6FA1108B3777E96AFF6A86D447F78372E0BD05E00010D4E0A23B41D872737
MD5 SHA1 SHA512 TLSH

Submit Download