hxxps://cdn[.]discordapp[.]com/attachments/1532533050049560806/1535763842737504316/the_groupchats[.]zip?ex=6a7a4489&is=6a78f309&hm=628b248efbf4ca2c7a06c4d9136b0f3b100073f670fd2eedb71cd01fd074ed19&

Analysis

user interaction
yes
max time kernel
177s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1532533050049560806/1535763842737504316/the_groupchats.zip?ex=6a7a4489&is=6a78f309&hm=628b248efbf4ca2c7a06c4d9136b0f3b100073f670fd2eedb71cd01fd074ed19&
Sample260810-b2mkcsdd75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307995200391531"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D16D754F-D238-42DF-8391-A785061C7441}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4360	2420	msedge.exe	86
PID 2420 wrote to memory of 4220	2420	msedge.exe	87
PID 2420 wrote to memory of 1852	2420	msedge.exe	88
PID 2420 wrote to memory of 1656	2420	msedge.exe	89
PID 2420 wrote to memory of 1852	2420	msedge.exe	88
PID 2420 wrote to memory of 1852	2420	msedge.exe	88
PID 2420 wrote to memory of 1656	2420	msedge.exe	89
PID 2420 wrote to memory of 800	2420	msedge.exe	91
PID 2420 wrote to memory of 1676	2420	msedge.exe	92
PID 2420 wrote to memory of 800	2420	msedge.exe	91
PID 2420 wrote to memory of 800	2420	msedge.exe	91
PID 2420 wrote to memory of 1676	2420	msedge.exe	92
PID 2420 wrote to memory of 1676	2420	msedge.exe	92
PID 2420 wrote to memory of 3700	2420	msedge.exe	93
PID 2420 wrote to memory of 3700	2420	msedge.exe	93
PID 2420 wrote to memory of 3700	2420	msedge.exe	93
PID 2420 wrote to memory of 5076	2420	msedge.exe	94
PID 2420 wrote to memory of 5076	2420	msedge.exe	94
PID 2420 wrote to memory of 5076	2420	msedge.exe	94
PID 2420 wrote to memory of 3196	2420	msedge.exe	96
PID 2420 wrote to memory of 3196	2420	msedge.exe	96
PID 2420 wrote to memory of 4240	2420	msedge.exe	97
PID 2420 wrote to memory of 4240	2420	msedge.exe	97
PID 2420 wrote to memory of 3428	2420	msedge.exe	98
PID 2420 wrote to memory of 3428	2420	msedge.exe	98
PID 2420 wrote to memory of 1080	2420	msedge.exe	99
PID 2420 wrote to memory of 1080	2420	msedge.exe	99
PID 2420 wrote to memory of 1080	2420	msedge.exe	99
PID 2420 wrote to memory of 4152	2420	msedge.exe	100
PID 2420 wrote to memory of 4820	2420	msedge.exe	106
PID 2420 wrote to memory of 4112	2420	msedge.exe	112
PID 2420 wrote to memory of 1600	2420	msedge.exe	113
PID 2420 wrote to memory of 4420	2420	msedge.exe	114
PID 1600 wrote to memory of 4380	1600	msedge.exe	126
PID 2420 wrote to memory of 724	2420	msedge.exe	127
PID 2420 wrote to memory of 724	2420	msedge.exe	127
PID 2420 wrote to memory of 724	2420	msedge.exe	127
PID 2420 wrote to memory of 2832	2420	msedge.exe	128
PID 2420 wrote to memory of 2832	2420	msedge.exe	128
PID 2420 wrote to memory of 3716	2420	msedge.exe	131
PID 2420 wrote to memory of 3716	2420	msedge.exe	131
PID 2420 wrote to memory of 3716	2420	msedge.exe	131
PID 2420 wrote to memory of 1696	2420	msedge.exe	134
PID 2420 wrote to memory of 1696	2420	msedge.exe	134
PID 2420 wrote to memory of 1696	2420	msedge.exe	134
PID 2420 wrote to memory of 3568	2420	msedge.exe	135
PID 2420 wrote to memory of 3568	2420	msedge.exe	135
PID 2420 wrote to memory of 3568	2420	msedge.exe	135
PID 2420 wrote to memory of 3504	2420	msedge.exe	136
PID 2420 wrote to memory of 3504	2420	msedge.exe	136
PID 2420 wrote to memory of 3504	2420	msedge.exe	136
PID 2420 wrote to memory of 1100	2420	msedge.exe	137
PID 2420 wrote to memory of 3736	2420	msedge.exe	139
PID 2420 wrote to memory of 3736	2420	msedge.exe	139
PID 2420 wrote to memory of 3736	2420	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1532533050049560806/1535763842737504316/the_groupchats.zip?ex=6a7a4489&is=6a78f309&hm=628b248efbf4ca2c7a06c4d9136b0f3b100073f670fd2eedb71cd01fd074ed19&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffff83fc188,0x7ffff83fc194,0x7ffff83fc1a0
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1406306651360583441,8524206647154633208,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4241167752686172550,1967067642959940900,262144 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,433996783674997795,17120537482382592724,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,2328502167844946634,8441343745094753871,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3518274831742816546,2485323879883318061,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,14014206336191503062,10446972383010127402,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,14947990790953030251,12887053538007814020,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9950583506950776475,7496553759592967220,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,11681463610601158480,4105757563554675653,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,3823843686424225519,6247040546789376403,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5720,i,6064736968044172349,13444295457399283874,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,13883559907274584681,9040413697704988642,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11352147461420523218,4016995331593644300,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11352147461420523218,4016995331593644300,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,5037499250381622633,17480883220155428480,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1536,i,13044747128240885207,5957586481122668947,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,4149069963277436064,11088579647367217353,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2172,i,538052213791007138,7424711065286562775,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,1007432716335733969,10322807527378779488,524288 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5776,i,7682426367933915253,16975447441574550873,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7016,i,13413062932153268018,9723528761934464830,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6620,i,9742657548916149698,13002165419106190321,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7232,i,15674096386778974520,6114462803197759469,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4688,i,15877113267089491192,10959273180378847778,262144 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5508,i,16443100859983459388,10028513048020271873,2097152 --field-trial-handle=2428,i,10494812145800471159,1832606021761827171,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_the groupchats.zip\the groupchats\pressing a zaenderist or something.html
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_the groupchats.zip\the groupchats\pressing a zaenderist or something.html
  2⤵
  PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_the groupchats.zip\the groupchats\Operation ZaenderDeath.html
1⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_the groupchats.zip\the groupchats\Operation Annex Skyllan.html
1⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_the groupchats.zip\the groupchats\DPRK Kaddin Project Management.html
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 70ec916fbc4bdc762d303a32b425b3e0261fdf5d4861f31961987ba096c316ad
MD5 996e8e432c1af85dbbc9617643df9f45
SHA1 d0195d75db411ad1a86b9c76c84c53d5dbfa292c
SHA512 e3b70f66cf03c6c9999788962930b9cabd2ecfa0b384ab514e85ba204c430600ab36e315c9acc46dffdc31af52289db2f445b572d3c1a4cf9868b5e4604b5b6b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1B8B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 55KB
SHA256 ab6fd402cc54d04b5c0bd7346f5ab5eef291c2e81ae3f52400c2c23d98ffd45b
MD5 cd0e8976a7c97849ad7a572f878855e7
SHA1 55df8cd8b5b793d78b52409e2b7af675c1b955a9
SHA512 28d75cd75be20845599cf2291f874be7526a76f929de09c2a838ff76533ca6ff6dfaf038c1d0d51408fb3a74f89437c900805bc372d5a29070ad8482a630210b
SSDEEP 768:5VMEUYCWcKFY+Tl8/r1t/jr5++Lx0Ni4H/Zo5ic41Favfaeb4uxR9/UeUmz0Nd0q:BUFWa+TlKr3/5LWQ55eknaez0rXf
TLSH
T1004302AD67B0F563D9E0BC540A2EB9DAFC3C9E00C0EDB557C509B59F050F4E2A298E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 17KB
SHA256 f479c160fb1184b5381245dcf5b8c213587a4c72288a318cd168975070838b50
MD5 fc8669e65896eb4a7f1ceb8bec7398c2
SHA1 f100fcc2c3c455d2d09fba59930517e47cc351e3
SHA512 cd58d4981096a00dea62fbe261b716d48a6fb9b2e98ef2e4e9350a62e54851d90c87b84e0bc89697681221df7c567413d5a1fd1c48255efbb5dbf18d458e2c8a
SSDEEP 384:Jec4yOi44I/iN+bukc3vlAYa24hzDG640gQfNye4GMG7v2oGj4mk43lfrfiVD:w/zi5NjkcfyYF4hfGH0gQlp4Kv2jd35y
TLSH
T1A682E16C111A1C417CBBC555330CDF3580ECB24A709B935B9A86EA0D137CA9DA5C1EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 24KB
SHA256 4bf3050b6062e0e00c61e696cf26a7d6162c71c29062f2ae4d4647260934370f
MD5 8713b8a90bded5ae0c4872484f54fbde
SHA1 98a15e7d455fc20760b035693d152f71534414c3
SHA512 ed675ff93f851b1cebafc02e72f9ad19969d134df9dbcadee5234f3e8f8f0f493139540db621b0ade21bcc57c6522af4cb1d5030e8a9927453beaaed88e4a444
SSDEEP 384:Xplg1V8aT/LeH8RJugSpor0OcQUUaTg+3rfp8YxbSegTH/CmImON+OoJ27NBkrrV:Zl+zLzJugVon3drb2dOowYjK/Z6d3
TLSH
T19BB2E162D37989D4ED8F3C24CBE563E624BCA84F18E718452BBC6B9F0475732650DAC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 25KB
SHA256 eb23e767e0b0e47ad43f7f14558e003f451aeaff87315ef3e5c0acaf35a843ee
MD5 2d7928e1003804522e56efd448d4777b
SHA1 34c5059a9d65a678765e7e4a4494f9ad1baa6ccb
SHA512 b8bfe9a409764df86a7c4aeea9d0342011e847bcbfbebd8b85cd8e5d61eac6df2d71bc48f9d6f39897667e1a68c64caa911112f71ad63bb4bb37b42c6c64445d
SSDEEP 384:qps2NytrQFT2mOmLlYy4TRwqyzh+m7zDvq9YqmphcnqTrZZf2mbnDA0u7CliTDVm:q65qQ7olxtFG9Y7fUqTdZAo3kLE70UX
TLSH
T1D5C2E18FCA989EE6DE6AA4327CDA3D02352058F796C356470D733C84A21B1670BDF295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 25KB
SHA256 91b8d4590199e0014f5f89468d4224e6b5b3c19ac13ace79de0bd5111cc3d68e
MD5 bafc4dc2ddf48b1844be205a1a41f7d8
SHA1 b7d00a60ed3c8e48178cf2e3b69adbe2a58fe2fe
SHA512 9b116fa618a9190dd8c1895cc3e27bb055b6318302c2f582bec9a275fa70c84dd1a70c69181c3dd2e2934d98b2e374d42cbf7081ca67821b104f54603b176ec9
SSDEEP 768:jepKb6LO4BuYa3BDwZQ4WhPT/tMhxq8JngNTVwMwU2s:r1p3wQdhPTahx7nyF2s
TLSH
T1A7B2E0266C8B6B73260051702670D5B67A0FBEE9C7CF2F17409864F5AAE52D8C03A5B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 26KB
SHA256 061b7a582a0a5dd252a71fcf01252a4dcb5e82504052359a3c064c1f09ed225b
MD5 568d4eaa150e7daa3b0b03bcde881aef
SHA1 86cb45993b91be209004cf14dbaa58be71121b88
SHA512 00b90dbd360900d5e6e4c64a5a483abd9eea737c206ae965e3c6ba64abf6acf5e646b096ddfbdacf43cd3ab5ce6ff50b26db0f407f222e16a827fe794d21b3cf
SSDEEP 768:3bqTHJA2AOyJXBNQcA+c5TPgMlRpxf5PvdR:3b4u2AOyJLW5bgMlRpZ5NR
TLSH
T1C3C2F1DD48D98367E54C70638DA1D370E1EB84BE30A84AD997A3CEA04919B423D25DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 95KB
SHA256 e2e6738c1ed7444bc47d8fdd6e93c8ec58a828a35a749cb1d973725e14069112
MD5 da2d9dcb036bbacafe3adb598fa6f76f
SHA1 1a396a237e870a5962ca6b15439e28b77adf965c
SHA512 49a4fcd06dd36c8408c6e739280856cf4b5388b1cae12d07a9fd8195a961dfb96422547b9c6802435788af2bb5cdeca222c4d0e1fcf61e1de6e3c071248a8442
SSDEEP 1536:zvtukB7XFdS7I12lRzg7095MVM8Lm6ECDWhmlxl6WAZlmxwKqxIuvuq1FGrQd8l:Tri7TlzW1umlzFRxwFHmq1l8l
TLSH
T170A312B45409DCD01EA1E1475E479E6035F233940C6A87F8B91D8FAE4CB6B2AF1E75C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bfc2328cf3b6fd413b8aebf386d6243e8d26e4286fc87329bdad45124e48407c
MD5 658a2b5ec82f02149540ba847642b1c8
SHA1 f6960b490270f47f8502c96db0457a982bc4f2ad
SHA512 52207e9a33fdd241e6827259cae83636a0ccb7869b2fca01b5af20ab2d3bc8fe61e1df636456cc20344d48b8d679625eac6fb4600573977caff63982d501ba85
TLSH
T1DD6180773D3505A2E3AF067094E12AD23035F4DBFB5B2E8E1684B9F51524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5e8d45df2c3d014ffbd5b9f50d8a9ab5cd99a393faaadbdd14ac9879e2f94f6b
MD5 cb6bef5ba4c83e53617cabcde692a5c3
SHA1 93ef621d4d01c395c87aec1cc25f4d919546ea90
SHA512 d81a8f6432cb4364adc6eacd6e155b132654ccdf52eb4f3cf3dfd19b1170cde2abde30647e7e4bd5cd455272b1bda27b583cb2d6b7095aad46970ef507dbac96
TLSH
T129810777BDB04892E3AF063058E16ED23035F4CBFA4B5E4E138478B51126FE4CD9A808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588cab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588cab.TMP
Size 3KB
SHA256 21b16278dfa22f4bb9dd74937d3977824e6710a69ce29480f39f2856ad49b334
MD5 91cc7c97964f6612e4f720d3cef6a7a6
SHA1 c5dbfa111d06ff451cf228c20117aa570da687d3
SHA512 e386114dad05a6f14b378cbad6d3a2f1966d10f085ac4b94903dc05d213e83c9aaea30613b0c6ec5b9d5ef5d8b98c73894236bdc41198233c69fe8d9be592e33
TLSH
T1A46180773D3505A2E3AF067094F12AD23035F4DBFA4B2E4E1584B9F51524FE0CE5A848
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d6fd560bb07b3ca294de02cd70c3ac14df9a0745b0edffe3ffe9f5bf8d556220
MD5 deda96668f2ed9720b90486ff170c15f
SHA1 65856222828b9f75662cf9bfc6eb6f81d1297603
SHA512 f8bd6633fa376a217aeba211e9f4970677d984f6f452fca7848d2d7d264ce6d95d61aa36bd67b759f08a6a9ecdc7790397b11fcd3a7b0534c645916898e225c5
TLSH
T17751DCB6C2D9876EC81656F4AB246E1ACE1D055A82283C16CDE4FF5FA3E30B0E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 96ba52c09e1b89001a1c88ef35946123ae2965dc8b15d0d24b9d7df1951638d3
MD5 471ca964cac88269be408e02359fcdc4
SHA1 d36da687a56192e2559a0cd137804fb40d047cfa
SHA512 bf4d818b3440c7c4ada0f875a8ba021efc19d8a334edd4bed4046eaa2802d4173624a3970dd1aedb04e40fa11aecc1571ec9aaafc7cbde591b90f4a65a1e6765
SSDEEP 192:Dr4dSrTm5+rgyLe7M1uN5ZjZIgqJsbyxEoGwro0E+W13iWafZDm:Dr4dSrTmMrgyLe7M1uN5ZjZI9JsboEos
TLSH
T17CE1A9B6C2D847BE881656F45B257E2ACD1D055B42383C528EF9BF4F63E10B1E10269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 72b5784a8e43f0943eeac6de2cf2b90038fde06362f50695422869e759c52151
MD5 de6b86ebe54e13a0879f0488aa117cf6
SHA1 30f0779ea8324e48c3cbb0d798c77a73ec42620f
SHA512 fcfaf23fbbcc5cf53bd19a758112cfb5ad1883825e4922fdee93c4ca10910b3a906dcb32ab54225b56bd707e77201068abe87000af99210074e4d4751d79a57b
SSDEEP 192:sxZDREyM/jK1Ml8M9g/fKsGs47aIdpJHW6+WNGY9Iow/+JIgrJ:sxZDa1g/fKsGZ/JHbGZK9
TLSH
T1EE42D7126A38A977CCDBD20DFA557F53D6F9047292900E54A9FCDA1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6457d3dbbe2d31ff7371316c7103d3ef1c95c50cc973fc88a8ef4869e156aa12
MD5 f98a1404739e2c10de0630ed42ebf50e
SHA1 e91a2e16b84dfa33a0a9aec95cadcee5707e141e
SHA512 57370ce3c17e0cb0da75e93d6b6b42ef0175ce9264614884d294279d76b7a22cb6436566a8b7b02a7f44a13f381d4cf2c7a2d32366c2a71af989152645053d50
SSDEEP 192:sxZDREyM/jK1Ml8M9g/fKsPsQmaIdpHKHW6+WNGY9I7m/+JIg5aJ:sxZDS1g/fKsPNkqHbGKKs
TLSH
T1E452C712AA3469B7CCDBD20DBA557F53D6F4047292901E54AAFCDA1C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 86d2da167823fa5b75503573370347bed9789fb8bee95cf8cb06b67fe23f89ca
MD5 e29fe9f47d4b6b9c8ff926007dd4a40a
SHA1 337f5f05a6d9da72b75b39ecdd5d6757250a3778
SHA512 c3006445739b65626725a3c8cb9e6443bc8552cd0f99ed1150064b607c8f2afa85ddb4ac471e8d60c63027455d79b37ce34065f98d6f9f01490dc3aed6e8cc36
SSDEEP 192:sxZDREyM/jK1Ml8UQQ9g/fKsPsQQaIdpHOaHW6+WNGY9I7M/+JIg5aJ:sxZDSqmg/fKsPNqXHbGkKs
TLSH
T1E052C711AA3459B7CCDBD20DBA557F53E6F4047292901E54AAFCDA1C00E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ed846d7185e92b294bf399c324aa21ffd6ded08496520cca52231fbd65fad526
MD5 c5e988b0a63baaddd7bc8610a4414aa4
SHA1 80cb7672a04abad9baffc3252259b978a4a1d462
SHA512 70f66d245023c1d791373c3cd7f4f95766abfebeea4c414e0da3199af98f488ba75ef9fc51ea258c114580548e18788c47e067287fadde70273268f824ce3ef3
SSDEEP 768:CLcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNVroqg6B:CLcv21wWvu+Z+u1jaeFLeRNuqR
TLSH
T19BD20B2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 458163a69731b4deb2e80e11f6194affb5d005f77fff464f317fd62a1befb662
MD5 3e2ae58fbaa42784178d80792ab11b36
SHA1 64aa23986b1726557a4efb11c4cbd4afe9280c69
SHA512 0961965ce56a6388124d2368afdd223c0de84f89e37ab6ee5dfa92a3a9a8712e546a5fc84ef6a4f90dc71ad43e109bb4daf659452bca202bc9448be833c48940
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiY2:mT5RXfdb
TLSH
T11DC1EE06307E0343287D6919A7B586378E8176A37854E9BF7B7800A68F67E115CFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 65B
SHA256 26e78cb8e189406e12ca36d7fe0eee3d0757dcb21dd8c84917e09c50bff3b708
MD5 f012cdf7eed009b6531e662c6b34787d
SHA1 b0cf0127db406b6184aa1230ceaef87f6d0f7c01
SHA512 89ab98a58175d02e277f293cd9cd021d3dffd012d12bd15f4163b6a90216d6bc3fabeaf18fbefb17b9d007eb734624065a9ce52fa418ee5216d4250c588573f0
TLSH
T1ADA002B70911818B6F30A9D82135A21EF80FC3CC8CC0CEF4D049C0432128A334052491
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59d027.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59d027.TMP
Size 149B
SHA256 58c819e6a6d218c18fa6c2105eb01c25eb3006ae47bb102922774aa3dc75e694
MD5 8b46771c6a996dfe858801b1c74dc96e
SHA1 c799a3e4b448e69621a52ebe75581fe9c993b96e
SHA512 7ee29581b7f3ea34da316436974a75b6341e859a865351eade43905205f35a94ce0993cb237d70e3f45bf3109eb33618c176eadd35237542c40c9ca1ad00d8a5
TLSH
T18EC02B9A0F3151473B34E7C81272508EA85BEFEE8CC0CAF4C045F5432178223C0E94A1
MD5 SHA1 SHA512 TLSH

Submit Download

aefa271d-fdd6-49e9-b456-06fd8fec52dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aefa271d-fdd6-49e9-b456-06fd8fec52dd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 29dfaa2f6915c83135f095c4d675390a9cce1aab817474d7d5c17897c5cf8165
MD5 d2297de640e4647f096bb9bb00310fd8
SHA1 3e0982d1926e89f48891b4bf95c1ab82f5d89f4c
SHA512 cbf11e9137c9e60f88140da6b4f6a20579d462ecb2e3f34010c6bce6460409e0adcac56fc083a753710b34d84e285f05a7cd26d05e6b8f5a8264de507fe53989
SSDEEP 384:YZcIhsN5UeSzigOl4e+C/dHeWS+2LnB16HlytEDq1w:mhtslLHkJlLB1oy6Dq2
TLSH
T106928D30A8741C775AFBA145F48735138EF88023EAD93F94A5EDAF1D01DB6A8230A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0277186d1f168afa3a79c8f746795acb2437816ddd53a4e4ec851280e790e524
MD5 bcf86ca037199545462c9c0db676a9b8
SHA1 7b980c1a52260e99f8b5fa50f69cc20d325faf62
SHA512 9e587d6208f77f8e54f963218657983f7e476e4aef1d122a655160673edaaf20cf6150e18d58a5477372285b358b14dc7f0d4018eb6f66050fd0429fdd591675
SSDEEP 384:iiFPZcI/0sNa8TUNTUlIlfSzighlJ2e+C/dHeWS+2L0B16HlytEDq1w:pFHMnwgkblJBHkJlwB1oy6Dq2
TLSH
T11EB26D325864597BAEFB9A45F84B36138EF44063DAD57B90E2DC9E1C01DB1EC230AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2ddc6db5083ea20fefca5175d2b00648c40d29a5a2240d8c7512ade20cca2c13
MD5 85647019c60f7f78971902348702f5e5
SHA1 0a09e72e1462c563e37cbad55b6a6125d82e4654
SHA512 6b4b78c971b2b9a6479137428a5a37aa4ffcd3ea6ec5875171fe0db2b992f1de98e8d0aae7dbae373f71371896c4a76a51ee886b0ac38252f50ccc7074bda120
SSDEEP 384:lZcIusN5UaSzieOl4e+C/dHeWS+2LnB16HlytEDq1w:dutmlLHkJlLB1oy6Dq2
TLSH
T197928D31A8781C775AFBA145F44735138EF88063EAD93FD0A5EDAF1D01DB6E8230A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 062284fa752ba62eefeeade0fbe6811b31b95a1a517e0a9a72f941f8d63c38e3
MD5 a40e2e19397a7b2e422016869e559147
SHA1 08d2f8e816c6266d313253c2bba3682ab10cbc66
SHA512 90b562935c59fd14424a57665364dd05987891baaa5ef820b5b6e6a2316ba5063021c9da96232593e30f30a3a5b24dfe96a19623ef983722827e119d483aa715
SSDEEP 192:JONv6v+YLNQmiUyAmZh+CGx+Fdew9ohXusBsfU6:JONv6vz/8Zh+C/dHe5BWU6
TLSH
T16C02E935AD381CBB9FB2AE49F4873A275FA41177E9952F80D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 97c57cb1b85d8448eb055cfbf723002c0ec551d9b57d4268697bcb19092f2aba
MD5 93f464a421c485b54354571bb6dd32fe
SHA1 55e807be7fd6a8a602d430e3313ffbfa88a5bca3
SHA512 500f6dadcb7b6a231dd5985153fdebf64bd84e73dcc8f396b023028bc3b705fb47acd73e1d9c41eba31c67fd662b8cce2f99f45d74dd1d2f68606bbb34e7a1e7
SSDEEP 384:yZcIusN5UfSzieOl4e+C/dHeWS+2LnB16HlytEDq1w:Au8mlLHkJlLB1oy6Dq2
TLSH
T15E928D30A8741D775AFBE145F44735139EF88063EAD93FD0A5EDAF1D01DB6A8230A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 322fa3e20e7402d8d80f0110d122fed0f00649e20215a8b8d03f0d80835fe8d8
MD5 a176cca8061021ddbe521e3b53602a87
SHA1 3c879312b89d644fbad2730ca321f88d83e5e578
SHA512 f3c9d1a159f3b04458d6583af9e34a3b98f02244b1b41c02da6978bcdc7ac5dbc8496070cdb5a0c4db4740a06bcf0d81cab743178b4f4842cb558997c2af9484
SSDEEP 192:1ON76v+YLnQmiUy3mqh+CGx+Fdew9oh9aFS+2ZlHCHBoqjU6:1ON76vz9Bqh+C/dHeWS+2LcB1U6
TLSH
T17B120A35A8386C6B5EE3A555F48735135EA84167EA8A3F80E5EC2F1C01EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6fa2b0f51f01ffd4ef39a7ffc94ad8153cd0a3c26a7c5d09da5f788f5ca18074
MD5 66ae73d260ee465ba29f857cc2dd3c06
SHA1 fac2548984ecf8fc01ecbaea339edb23f59b8c8f
SHA512 230f05a3a760082eada808ada0ec0160177a9fd54bab93c4d0875fde0e9c96c5e450cba7a2d2ade82c6d0ae43f0f7a6ccfd4ab475f6c1bca5dd3eff625ba6a7e
SSDEEP 384:iiF3ZcI/bsNp8TUNTUlIlfSzinDlEe+C/dHeWS+2L+B16HlytEDq1w:pF/jCwgk4lPHkJl6B1oy6Dq2
TLSH
T18EB26C325864597BAEFBAA45F84B36138EF84063DAD57E90E2DCAE1D01DB1EC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4af8de965ca56546d2b1d68a737071477e26635dea1bd9ef90e73ff7cda3aaf7
MD5 ba4f39a1dd319ae886b424c11f452326
SHA1 6fafcb787cd2bd284565ff3f3bec35090177164a
SHA512 8da28fb529f15c8695291cafef5fb29f4d58c24aba31f8c8f451e94047c4cfac17bd09ce87aeede09a565c5fa4722dfeac68fb63ab5e10e3e8617360b7c2cf6b
SSDEEP 384:iiFKZcI//sNp8TUNTUlIlfSzighlJ2e+C/dHeWS+2L8B16HlytEDq1w:pFonCwgkblJBHkJlAB1oy6Dq2
TLSH
T15FB26C325864597BAEFBAA45F84B36138EF84063DAD57E90E2DC9E1D01DB1EC230BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c2c3e1cd482fcfcebd054882ebfce3c1a1f65e4ea1e6492f2336884473bb2a4f
MD5 115ea1f6871251a4ccf4089186f403bb
SHA1 3a49ca0cb43bad5083387b49651c323d5526dba9
SHA512 4317062396a8c0d81b99f428ff2e9cfe777402e59116a5611ca2066dfe43dd253baefe7e3d210ddd10eeeb2456fe31b8cb38514e72a8d91b397904ad0b2f2df7
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 71cb40841dd38ed462d90df34adec2e119e265d721f7dff12af0321dd3b67dba
MD5 3b610231516a5aa504d058dccdf8700f
SHA1 509805efbd7687bd729cac5a8b9fbffbdc4b6bef
SHA512 b0643b54f82904b21cfc5cf209be0176d2802e3d37637679adfe68e8859d865b5ab99c9ac1e47f47d61253ed97f0af0b23e229362299fc9fdfb14e8037345c06
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59d40f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59d40f.TMP
Size 392B
SHA256 54246f9c413aa285ade58ec4537c8dbadcb3afb7cb75d07c0729fbe78988f0a6
MD5 7c4dc62a5e9abf7dec4d5cb518f5ffc9
SHA1 047dedbf9f957d1850bd6c593bfee29b2a362fdb
SHA512 607b15759f690c011dfe7dac2e4641a227f12d6f41d3137636e37c2b5f76cca5553f32107876a69084574000dd0b0d4b8b22b4111d6a6f52cdc4c3c53a710936
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a052fd00bdefd0af93291d48d26f02cfce5ae711ce122c81f5c28a1c3ec155a
MD5 62951fe9d014759ca21110ac3be2dda9
SHA1 c9b28f217c3eb7dccc4bf2ef7b9f5c9f39bb7710
SHA512 3e4090351a4c7d845841e963aab5a04f2d9e8033008ef76d07bdb4aaaea8f3ecd9626a14f1277c22046c632ac58eea0e7b06d1e888e9c5531af52b896a88374b
TLSH
T13C41EB58A6F91148B3B76E1A6FF6B86E547E79372F06949E10110D4F0A77B00C962B33
MD5 SHA1 SHA512 TLSH

Submit Download

the groupchats.zip

Path C:\Users\Admin\Downloads\the groupchats.zip
Size 694KB
SHA256 b62c31fff51b177572af9b9bb65330236cdb6723dcd49c9d94946b5a548aa21b
MD5 640f786276f96c6b3d523fbad3e4d499
SHA1 107f17ceb5769fd2484a638724ba310f2d38eec9
SHA512 001f15450117f18e85149cdd1c86c19727752ddd9e34a02b738ec86cd98220eff6f0fed5d13fc29a5f1bacb4d046c4e5a766521c21fb9b4a45337e652f428c82
SSDEEP 12288:qG4BEo41zSBMDM8C/GAssD1PDToAGx0fnR3a02P+kNC3oYdp9sgBJ:qxBLqprCHvwORq02P+kNC3TB
TLSH
T18DE423114F3558A3F6E298F04EAF139F97A978CB51269CB108C193FC701A78AF07596E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download