hxxps://us[.]i[.]posthog[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us.i.posthog.com
Sample261002-2f3ybsxtb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{80733BC6-556A-4D3C-A728-649CD97118B2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4668	4776	msedge.exe	84
PID 4776 wrote to memory of 624	4776	msedge.exe	85
PID 4776 wrote to memory of 4448	4776	msedge.exe	86
PID 4776 wrote to memory of 4448	4776	msedge.exe	86
PID 4776 wrote to memory of 4972	4776	msedge.exe	87
PID 4776 wrote to memory of 4972	4776	msedge.exe	87
PID 4776 wrote to memory of 4972	4776	msedge.exe	87
PID 4776 wrote to memory of 384	4776	msedge.exe	88
PID 4776 wrote to memory of 2368	4776	msedge.exe	89
PID 4776 wrote to memory of 384	4776	msedge.exe	88
PID 4776 wrote to memory of 384	4776	msedge.exe	88
PID 4776 wrote to memory of 2368	4776	msedge.exe	89
PID 4776 wrote to memory of 2368	4776	msedge.exe	89
PID 4776 wrote to memory of 2904	4776	msedge.exe	97
PID 4776 wrote to memory of 1068	4776	msedge.exe	98
PID 4776 wrote to memory of 2904	4776	msedge.exe	97
PID 4776 wrote to memory of 1068	4776	msedge.exe	98
PID 4776 wrote to memory of 4404	4776	msedge.exe	100
PID 4776 wrote to memory of 5860	4776	msedge.exe	114
PID 4776 wrote to memory of 1440	4776	msedge.exe	115
PID 4776 wrote to memory of 2936	4776	msedge.exe	116
PID 4776 wrote to memory of 3352	4776	msedge.exe	117
PID 4776 wrote to memory of 3352	4776	msedge.exe	117
PID 4776 wrote to memory of 5980	4776	msedge.exe	127
PID 4776 wrote to memory of 5980	4776	msedge.exe	127
PID 4776 wrote to memory of 1708	4776	msedge.exe	130
PID 4776 wrote to memory of 3688	4776	msedge.exe	132
PID 4776 wrote to memory of 3688	4776	msedge.exe	132
PID 4776 wrote to memory of 5320	4776	msedge.exe	133
PID 4776 wrote to memory of 5320	4776	msedge.exe	133
PID 4776 wrote to memory of 5320	4776	msedge.exe	133
PID 4776 wrote to memory of 5872	4776	msedge.exe	135
PID 4776 wrote to memory of 5872	4776	msedge.exe	135
PID 4776 wrote to memory of 5872	4776	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us.i.posthog.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff841f0c188,0x7ff841f0c194,0x7ff841f0c1a0
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,16609622396416342862,7053438974441871830,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - System Time Discovery
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,8958837658287329643,5498846220400515392,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,10590272139448179807,1697014960142236732,262144 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,6750317116893516190,8724539371879082301,2097152 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,2266495411524457213,392898365797571125,2097152 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,3723475811703578481,6649744951910893226,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12485166501282104443,1933008796356931771,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,8589136360844942633,5209227331896557881,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,8589136360844942633,5209227331896557881,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,4261340627573130070,5255362200005081187,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11792633875053305567,6433746221573736993,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6809991262012570524,13733077900663729376,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,10461797055471350124,3777395596351230738,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15638055676499716410,15475333640831364662,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5732,i,15335743933592786024,10112184410405667251,262144 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,3170738497518705961,7521668772059526589,524288 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4028,i,14012450301593918046,13174644674612622257,2097152 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6272,i,9587882962054453308,15929385968694891346,2097152 --field-trial-handle=2536,i,2103065548887454169,9499597699505698458,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

65661d52-bbe5-467e-8ef2-d422e9a4611c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65661d52-bbe5-467e-8ef2-d422e9a4611c.tmp
Size 26KB
SHA256 18a3eb12029990e01dcb95f9e52179fcb5082a43daff62d89bb5187847b9f119
MD5 b722f658cb9b825e341a36cb53d0bd5f
SHA1 31a2725b6368bc7d3f2836825787074b77b473d6
SHA512 ac13376aecf758497347f0b6205201905eda7e1876b6faa443f253a677e4cdb123defc95df65b05c2ad7ea25221555713e111047f323afc60c0a2f3a3d6b0416
SSDEEP 384:nuiFiZcIh3sN88TUNTUlI475mgrPEuK2fLBVR8+cns48tgOIwZOySxgL/7Izso1:FFQh3ZwgvslBVR2s48XsgC
TLSH
T18DC24C72D8A4CABBECEB8A95B74A7603DEF0526385DC9AC4D9D95D1C00E71DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1c5c9d60-b7be-406b-9cfd-65f0d99fb2f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c5c9d60-b7be-406b-9cfd-65f0d99fb2f6.tmp
Size 12KB
SHA256 4a0c0893bf3d704ddc727824a9095f5d7a3f6e15ab3a310bb521260ff30aeac6
MD5 de0e5d2b9556fb5f3a0d06a37fc878c5
SHA1 9e2c513043bc71b26f9592a48aba2f6698acec18
SHA512 bd60d27c6934321322110b68645bb7da9c359b4cea0847d8b94ac3c7f343d31fb0434080ee75b9bb9566a2f1d5162615398093ab05423b179b98dbb3e052300c
SSDEEP 192:sxZ+Rfk85/f1swQZZfQKzodpaJHW6+WNw7o/YbIB8YaNIg5J/J:sxZ+uY/f1swOZfY2HbD/F2Yo/B
TLSH
T1D842C7556D28A97B8CC7D61AFA15BF53D7FA1032A0941E88A6FCCA1C14F76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47dc45ef-0871-4dc1-bc65-6dcbe6953701.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47dc45ef-0871-4dc1-bc65-6dcbe6953701.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590ab3f8-3aa1-40ba-8f69-b6acfb8541fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\590ab3f8-3aa1-40ba-8f69-b6acfb8541fb.tmp
Size 12KB
SHA256 200ee55b3aae36d2d8c8ba5313331e43a2e169adad08f09be407ff74f4216e56
MD5 f1ba8ac56bee60e344bb44252840d0e4
SHA1 be11e62e60b37ca781c64d1a82e632e519634f0e
SHA512 f03876b10f9aea6f00c2a0831b6f3f4d1efc8b82a4b255ccbc610b8a336ee1092a9a75daeb6538bf55fda80de1717238921ed3acac84c21cce0fcf4589215839
SSDEEP 192:sxZ+Rfk85/f1s6QZZfQKzodpaJHW6+WNwj0XYbIK8YaNIg5J/J:sxZ+uY/f1s6OZfY2HbtXFjYo/B
TLSH
T15A42C6556D38A97B8CC7D619FA55BF52D7F91032A0851E88AAFCCA1C04F76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73d856a0-a998-4bd1-aeec-993230e57b7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73d856a0-a998-4bd1-aeec-993230e57b7b.tmp
Size 11KB
SHA256 52d9d33dc27396aa5ee0bf9e2a2976c4b9189113fbc76401863c8b55a36229ee
MD5 a5b13016a2427585bf16f02a4cadfb70
SHA1 69d4e1080be504b9f31a29a66dccf8c15bc7ecaa
SHA512 cd92f793a55f385290db38448f19b3eeca0cba8748bf0437b90d4ef355957bbde1510cd0dffdd26d38403f7df0518aaf027c3d72759c417a35b6757959198824
SSDEEP 192:sxZ+Rfk85/f1sYQZZfQKzodpaJHW6+WNw7o/YbIB8YaNIgj/J:sxZ+uY/f1sYOZfY2HbD/F2YojB
TLSH
T11D42C7556D28A97B8CC7D61AFA15BF53D7FA1032A0841E88A6FCCA1C14F76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81612c68-382b-4262-ae76-c1831324d638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81612c68-382b-4262-ae76-c1831324d638.tmp
Size 12KB
SHA256 07501a34ef5802687903fe8eb15b5f20d80e411268add6912cd750b84dde5691
MD5 37751384cf08d9c4214c64968de397dc
SHA1 7e3a9f5390382b3bbe932e1c4bf1654179c862bf
SHA512 380d479a92012a4cf2cfcd5d9f842f3c5178c793d7bb88438c2a77565866c65170ad5fdf6761de186fb222092105717eacf16028ce7b122f218da1f61927e65f
SSDEEP 192:sxZ+Rfk85/f1s6QZZMQKzodpaoyHW6+WNcQkj0kXII/YbIT8YaNIg5J/J:sxZ+uY/f1s6OZMYryHbvhu7/FgYo/B
TLSH
T18B42D8556D38697B8CC7D61AFA55BF53D3FA1032A0841E48AAFCCA1C14F76CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9319c064-eb38-4deb-a9f3-55d5a525b793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9319c064-eb38-4deb-a9f3-55d5a525b793.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 699edb62888d4df464b4983463961a80677c1d1a05c63d8cc0cd3004f501b678
MD5 81b363f2f01bdf309eb2954b22dc30e4
SHA1 a7e525dcea7124d66cbfb26bbe92844b4cc769d0
SHA512 495ff70cdb3b82275cb4dc2beec47acfdc31cf871cd3b5c38b54f0f7e0ab60fe1bcc805206afe2d3bad28b8b0b75619fbf2ff2673d72f0c2f1e337217e99ecfc
TLSH
T1C4E020D515D5C36FF304694B527C930C8390773BA6C0AD0F1708C584754658466E1575
MD5 SHA1 SHA512 TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 44KB
SHA256 34a6a0b4c6521f99ec398ce7663437ea2cbb0d86b4d1322f65ae2b45a53007b2
MD5 f069cb36af3b6c360161ec41ba4e24ba
SHA1 98c3aba0d33b9daeeda530528c6d8a2debcc1067
SHA512 0ea2853fe3ff003193dd3aac8d7e895b91513dbe13e126a540462207ac18c215eb753ed77eded3a948ab5f0adac084270bccce77abf77ff99d5a375a5f607043
SSDEEP 768:DkwV7Apz1QrSXVvr4Qc/8Dc08rHPTynh06oYE7BsMlu1U/zWbw+FaBfTPr1feVrF:DHVsz1Q+Fvr439HPTgx5E7B41U7V+FKU
TLSH
T1F923021F23F52C97C23D1E603BF184E0BD64287CB49163E0A11B50196EB49C7EAB89BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6aab40d7-4bb8-44ec-b2f6-17979bae9d66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6aab40d7-4bb8-44ec-b2f6-17979bae9d66.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

bb9604fa-4dc4-43d0-bf7b-7e336044f224.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bb9604fa-4dc4-43d0-bf7b-7e336044f224.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c8919f4c-e43d-4612-b11f-e2948a1eb1bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8919f4c-e43d-4612-b11f-e2948a1eb1bc.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f1b8d70b-8f8f-4271-b30e-1ed553053309.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1b8d70b-8f8f-4271-b30e-1ed553053309.tmp
Size 1KB
SHA256 387aa8e828fbce950b8df995e2bb83a38733baffcc7c4cb540e663118930bbb1
MD5 bd0cd1df80c42b693ab654e318708a43
SHA1 0286ff46080f8b7115a3f397a01db143adafa0a0
SHA512 074788cf193ab4146eabd404824a7373b78e6966f1c57b55c4c451c2125d542e1479608957fd805ff4f5c5c4a7df8c75932613ac478398cd3c9ed834f54fb343
TLSH
T1B841C2F7C3E8866EC90196F0A714BE1BCE2D0914432C7D5AC5E4AF1B93E2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ebda62d9b26a3dc75f4458c2f73a227afa4aceb826eff3ee1141ab74957a81f1
MD5 f0a7071a26a3763a71474687f366f756
SHA1 bb3480d3db3673bb58cc02e488128b1e6986ff0e
SHA512 d7ac31bca0e3bcf91dad7086ac5a121c644606ad439022377b3b4076f9de54f980169eaf8d9afda5e826184f0c1587d5e5417f5b7f2c7d1f8b9fac30431bf36d
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXsfFN:OtfFvpopPxrB4Rhfs9N
TLSH
T16EB2341571BA021038FE690C81B6972F464232B33259E63B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f487c6eb-c971-484e-b21f-249e6ab397b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f487c6eb-c971-484e-b21f-249e6ab397b4.tmp
Size 649B
SHA256 968a6f88d20bb7d98795ad0b34648bbda1baa2ca3e44f2c463f20b6ca889a44c
MD5 132114d646f70da6bc752a6790c69c55
SHA1 90db263bd233cc35d44c9e45848cf6273a6ebd24
SHA512 804724960d3de6010ee838112010f27b8845997eaffc29f793a71900eaaa16dd132dec284699b02bff3c0666e397cdec856d766e550eaac0fc22aee8fc2aef17
TLSH
T1F6F028F5CD25BC3B08FC5B2D20A55A46EB51135B2B80988F3B3D810D8FB1B3B858692C
MD5 SHA1 SHA512 TLSH

Submit Download

a277b08c-6ece-4725-8cbd-b7dacb5baaa6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a277b08c-6ece-4725-8cbd-b7dacb5baaa6.tmp
Size 26KB
SHA256 9c2d5021e6f74b694cae0ae9b109d61c3c98c345ff89b8c161ad65ba7d142104
MD5 d329964502be687102aca1f9de00d695
SHA1 86620a12556237f43dd7f12aeaa13f84bb0c1d78
SHA512 0ecf47036085a4497ef75dd975805413e8fc3f46a9143ad9b6c976318c02ce879cfe6c26d58789051b6bfaad52f781cd063407578fc9b3b6f3746bd0458eefb5
SSDEEP 384:nriFiZcI63sNo8TUNTUlIm25mgx+eK2fLBVR8+cnl48sa+VY9gL/7IzIop:GFQ63pwgShSBVR2l48hgfC
TLSH
T1DAC24B72EC94CABBECEB8BE5A74A7607DEF04253859C9AC4DAD85D1C00D759D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e74b19d6-1ae3-4786-8559-e6f05240698a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e74b19d6-1ae3-4786-8559-e6f05240698a.tmp
Size 27KB
SHA256 3d9d4a1d719125bcdac7bbec5c59d9867d44420b459034b1250d128c8917bee5
MD5 4e2723f95c832c3d9abd022c40d09f64
SHA1 4a25bced36fb0a85dedad01bd676306fb627551a
SHA512 a4b6003669f089de46eba28c386ee366cedfcd1ee50ed206e5624443a82061b87dab0e3d53c0f4d2a92807110929108ff48b443aa5574e32888497bce481f063
SSDEEP 384:nziFiZcIvn3sN88TUNTUlI4E5mgXcPEuK2fLBVR8+cn948tgOIwZOySxgL/7Iz4C:eFQ/3ZwgI+2lBVR2948XskC
TLSH
T1D7C25C72D8A4DABBECEB8A95B74A7A03DEF0522385DC9AC4D9D95D1C00E71DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1ddb2cd-f9d7-4108-b4f2-da39f34a4b74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1ddb2cd-f9d7-4108-b4f2-da39f34a4b74.tmp
Size 26KB
SHA256 04a9b03c686602b9e129b6dd19daa1b975b965fcefd5fb2667fbda59ca784a7c
MD5 7b4af607d40fa5cab79e57f596ead55d
SHA1 5b9b7b8fcc325ad71392c0bbb6de05d2a03db199
SHA512 9ec32cf061de5ff0f2742bfcdb0437a4081dede225f6d91f8f43b55eff89f4d8dd0700c5c7349f916bcc4a52d37b7fb58c3f60059710fa1edc8049aac510bd89
SSDEEP 384:nEiFiZcIh3sN88TUNTUlI4E5mgXcPEuK2fLBVR8+cns48tgOIwZOySxgL/7Iz4o1:fFQh3ZwgI+2lBVR2s48XskC
TLSH
T18BC24C72D8A4CABBECEB8E95B74A7A03DEF0526385DC9AC4D9D95D1C00E719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 65e5cd1e9ee6ae67889d9943cb244604cbe05a43c33c77c0d8e7d49102f14f82
MD5 932fd98feec0b08e4a24ff0a0b8f784c
SHA1 451a93067854113089c05a9a284083924b0a0620
SHA512 b828c9a7795dc11917d7d72c2813bbb0a724e8901e4b1aa34bdfe5ecc1e2ca82bf75ec3d13e34ceedb5cb57936975b6e6adcfff10319aed33e0831a5b7c502b7
TLSH
T1D4412858A6EE1118B3B76F5AABF6A82E587F7D733E06D45D00110E4F0A36A00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4404-197-0x0000018600000000-0x0000018601000000-memory.dmp

Download