hxxp://www[.]sinokeelectric[.]com/fJNeshWkCYY3DC8iBvQ2RRqf8x1jsEHzYe5IukOf6Vgyz4LXgAcgCAcMalW7wMyOvEJWmX86P2d47TadVNg4cEP

Analysis

user interaction
yes
max time kernel
42s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.sinokeelectric.com/fJNeshWkCYY3DC8iBvQ2RRqf8x1jsEHzYe5IukOf6Vgyz4LXgAcgCAcMalW7wMyOvEJWmX86P2d47TadVNg4cEP
Sample260708-m7deesew4v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1180	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279823728870671"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0138EFB2-23B1-41CC-A02A-8D0C874A1D0E}	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 2028	6004	msedge.exe	86
PID 6004 wrote to memory of 1180	6004	msedge.exe	87
PID 6004 wrote to memory of 4960	6004	msedge.exe	88
PID 6004 wrote to memory of 2112	6004	msedge.exe	89
PID 6004 wrote to memory of 4960	6004	msedge.exe	88
PID 6004 wrote to memory of 4960	6004	msedge.exe	88
PID 6004 wrote to memory of 2112	6004	msedge.exe	89
PID 6004 wrote to memory of 5240	6004	msedge.exe	90
PID 6004 wrote to memory of 5240	6004	msedge.exe	90
PID 6004 wrote to memory of 5240	6004	msedge.exe	90
PID 6004 wrote to memory of 2200	6004	msedge.exe	91
PID 6004 wrote to memory of 2200	6004	msedge.exe	91
PID 6004 wrote to memory of 2200	6004	msedge.exe	91
PID 6004 wrote to memory of 1212	6004	msedge.exe	94
PID 6004 wrote to memory of 1212	6004	msedge.exe	94
PID 6004 wrote to memory of 1212	6004	msedge.exe	94
PID 6004 wrote to memory of 5812	6004	msedge.exe	95
PID 6004 wrote to memory of 5812	6004	msedge.exe	95
PID 6004 wrote to memory of 5812	6004	msedge.exe	95
PID 6004 wrote to memory of 1700	6004	msedge.exe	97
PID 6004 wrote to memory of 1700	6004	msedge.exe	97
PID 6004 wrote to memory of 1700	6004	msedge.exe	97
PID 6004 wrote to memory of 1764	6004	msedge.exe	100
PID 6004 wrote to memory of 6032	6004	msedge.exe	101
PID 6004 wrote to memory of 1764	6004	msedge.exe	100
PID 6004 wrote to memory of 6032	6004	msedge.exe	101
PID 6004 wrote to memory of 1276	6004	msedge.exe	103
PID 6004 wrote to memory of 5956	6004	msedge.exe	107
PID 6004 wrote to memory of 5956	6004	msedge.exe	107
PID 6004 wrote to memory of 5956	6004	msedge.exe	107
PID 6004 wrote to memory of 5268	6004	msedge.exe	118
PID 6004 wrote to memory of 5148	6004	msedge.exe	119
PID 6004 wrote to memory of 2340	6004	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.sinokeelectric.com/fJNeshWkCYY3DC8iBvQ2RRqf8x1jsEHzYe5IukOf6Vgyz4LXgAcgCAcMalW7wMyOvEJWmX86P2d47TadVNg4cEP
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc25fbc188,0x7ffc25fbc194,0x7ffc25fbc1a0
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,10624881281702177095,5963355462739669965,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,11996054876278312184,17876147894691967164,262144 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,16896921236191387804,790284090925557701,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,885280602574473658,10228935216243319396,2097152 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,12754892329902715986,15586973300030854105,2097152 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,10872492977201939785,762094570694319926,2097152 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4844,i,4592177395282805804,13337114092706476936,2097152 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,14453360764992810164,2121613662456512006,2097152 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,483394023201225986,14925726674918802984,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,16253916331932769667,13040376303115033383,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3908012982102540033,16943426212963436383,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3908012982102540033,16943426212963436383,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6020,i,10525434213256601790,14366576604644828687,2097152 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,17938740935172967256,6735593901915845272,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,12734218574868818614,5945064989519646338,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,9794400250118244393,10876539050713915841,524288 --field-trial-handle=2320,i,16242759057369206186,5949538761964364007,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e8c02ea261d2b0aea7f310391ad6f4777ab3a137d56d508109cf2aab2bf42e3b
MD5 ccb95fef7105f14c1ef7e29c8c7cf3fc
SHA1 e56dd50980813304e02387874cff449a4a6d5aa5
SHA512 6f58a3f3c60461dfa6d5eacec2985bd0231f3c89ca3daca2e0255f3ec09bacc70295bd2235147f722c43799816621200793a628634c104f3875b78013341a45a
TLSH
T174E02B77C822EC2B18FD0728A0599756FB1513172650498F3B3C820D8FB162A49D5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1016417f7d2cc314c2e27315c5261d7faf5ed3c408e7fdc2bf4e52bff9218a63
MD5 883dba825876d43657814595b2590612
SHA1 2aec847509c1242f733ddc291fc6f7562ef877fe
SHA512 ba842747e0c5403d5a9c5e16533763284cee76ce38af5e95e2b64c41716368b6081ea859ac1589b066419ef9a414252bab322124c1bbe39c62128ff1428990bc
TLSH
T1B4712A3E01016CA0E7217CF5A4D37679B8BEC5C9FA1BDE54C20439375E1B35B4326288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f1be.TMP
Size 3KB
SHA256 faa95d35615a846943d2d7315c160fc4012b0654e57701eb2fa71b5223ee5d2b
MD5 71cb9ecc8d33def2c888f30009b83696
SHA1 076d050a40379a28f9fbbe766c4b74e180cea082
SHA512 1a4aee6a0edbeb4f0defd508f7e5d0a60ce39aac9251a1b171e82941b7c8b830dbc2b85b9ab3a20db8008db384c98afe970236fb7a2008d3cb4c288e06d7ee68
TLSH
T108714A3E05016CA0E7217CF4A8E37639B8BEC5C9FA0BCE54C50035335E1B35B4329288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ea3aa17ca6c75781d0ef058a7d98c4fa61d443c0d40f6a8679305ff0baee2517
MD5 a7d6b3bb534d2f46fd8b35ec5cc43ae4
SHA1 99eb6c5b63a6eb1c640b163bd6230821dbe754d9
SHA512 3ea81dd5589f2654d1fa1b8811275114c875b3a2cd221ae51b935720d737a45f962e10b7458b3d346304636c0fcd1e9d1d34cebb72b4da11fba407a1b3d29c06
SSDEEP 192:sxZyREyMqZjK1Ml8MkK/fcssmPeaZdEzodpm1HW6+WNol7/YvRuX7WwIgjnJ:sxZytMK/fcssmmaz3OHbS/LhjJ
TLSH
T1FB62E8166A3899778CDBD219F655BF53D2F91163A2904E44A9FC8F0C01E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 a951917a4c8c95425873d7334426313458331c98caa2e0cdc3c10ef8126e576a
MD5 656b17a9cf400a06b94627f9742414d6
SHA1 18d43272e78ffe5903436bfef900338fc2967b03
SHA512 507d4fc7a4389ff99fd89970f96c5a1a98de2c9a201b78480b7d5c32f77c36a3286e2d8d6e8a9133b6c29791a680a46fb7bcaf90dbe54ab6e115a65c49d86968
SSDEEP 768:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdpS:0LppY93PBZJPtN53DbpS
TLSH
T15FB2695A713E0211393E2988B39596364F8235A37058E4AF7FB814A14F67E235CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 422357ba2f3bf7daa9fd6a167fec4eb9c46979d275abe178362337a33a49c9a2
MD5 8d444d8f832f791d42c94aaf54785493
SHA1 f6665c16b4db8b6e86920dadf147fe6feab76292
SHA512 17c6edfe429146a865d4696ffa530b252dad2f67f655e5c42a8d922ad494adf05007617435b1b3e20c6b06fba1611e72c05b8b02750274c56cadce940bd2778a
SSDEEP 768:p9F1j+913CwgQkEqEoGpENdwjnMai1jdAP:S913ZPHObTAP
TLSH
T1C6D25B33E894DE6BADE68AD9F75A3A47DEE0016385CC5AC8D9D82D4D00C71EC430BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 da872a123067ec015536d65351cfe55f761d6aa4768c734beabb7bea997e25a8
MD5 bba148de7aff75246ab3af5aad921dd0
SHA1 a63d5f51296db514a9ed39e1d93a08c9c87b3ee0
SHA512 d38a576230603c56a9a7e1f1b92a4a437020788c8d16acb582ff30fb24ae26d327d4fe04a53a362d4b144e72058f603633921606d9196799df8a8afe54a66fa2
SSDEEP 768:ZF1j+913CwgQkEqEoGpENdwjnMai1jdAP:I913ZPHObTAP
TLSH
T126D25B33E894DE67ADE68AD9F75A3A47DEE0016385CC5AC8D9D82D4D00D71EC430BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 de440f28c33cf449d951ac6ffad79b5d845af761ffe93d3cf6303115349bd432
MD5 91625a7a241391215bd29702147b5c1f
SHA1 7b0955248b79e2ee0a8cae21ee1b20a4474778d9
SHA512 932c7809aef099946c343b81b1e8524e462e81cde5d9736efeea3fdcae62471c56b0f78f5cb16f8e1182fa01c95835c6bfddb768fb760e2d7162271ceb5f7497
SSDEEP 768:pGFccps3SwgbkUqqFoGpENdwjnQaiI8p0KS:os30RHOPI8p05
TLSH
T1C8C24B32E858DEABECD74F99B75A3903DEE04227868C9AD4D9DC5D4D00971ED430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 804a9d87c6fa6049e7ebae9d97dfc24eae16886d50a18af6b2aa1463e75502bf
MD5 e41e1082e5985a93932b20000ae8823b
SHA1 cc133cb81855e662ac3be76e875176f52b2beed0
SHA512 dfe310f60eb8112d71bbf6cd59804fc64027378bbeeb58c20e10b22dcdc60c25fd2731053c9fc8165c0580a1ee709ae9bded7e190d52a200178655e8b7ddd8cd
SSDEEP 384:npWiF9CcmyWCE3sNH8TUNTUlI4VQckCrIyqjuphiftGfFmmEEXIQ/4dWnjnKaioN:p9FccpE3CwgQkeqEoGpENdwjnKaioY6
TLSH
T1FCB23932E8A8DE7BECEB4B99E75A3543DEE04163868C99D8D9D85D0C00D71DD430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cd098e31ae937f6b3850a237fe815b1464ba09648153aaf146c426f0687cc660
MD5 f0e54e1899d1193af1ba91e9b7b6286c
SHA1 3dce830b959982ab7d3f536e6213fc2e86386600
SHA512 3ae8e35a0ec0f6b9a6cad9308a43410788fdbaf9835e68f021847944504a60d1d49771628cfbc35ee62a48bf5dbf48725e707bab31e060c8babf64f2a0e46c82
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lNKphiftGfFmmEEXIQ/4dWnj2hpde4a:poFccps3bwgbkUbkoGpENdwj2ZI8p0KS
TLSH
T100B25B36E868DEABEDE74F89B75A7A07DEE0122785DC59D8DAD81D0D00931DC430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8bf9dbef6b804108a3a24a8b38735b8ca9a0e1e2b1a7f1c0cb823ad50aca02de
MD5 90e4b7080897dd26779aeed26a0a9eca
SHA1 f32b84609449da0b2a59f3b0aa4c628ad9720c3b
SHA512 b7e39e7f3875180a4d2a881379c0894845dcd13bf9a5f9b292fa941f3245da7c9bd0fcb782a7cd5847880eb5e9f35b353c8384cfb41b0a7d41a741c360ffb4da
TLSH
T1A5411648B6E92158B3B73E56ABF7A86E487BBC772E06D05D00110E4F0623A00C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1276-210-0x0000029690DB0000-0x0000029691DB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads