hxxps://login[.]teams[.]document[.]portal[.]auth[.]3n8v1q6z4m9k2x7p0r5c1t8w3j[.]bhatbhatey[.]com/

Analysis

user interaction
yes
max time kernel
100s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://login.teams.document.portal.auth.3n8v1q6z4m9k2x7p0r5c1t8w3j.bhatbhatey.com/
Sample261001-scqzxsshmc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{8CD94599-8036-49F0-B006-710E06855047}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1412	4716	msedge.exe	85
PID 4716 wrote to memory of 4540	4716	msedge.exe	86
PID 4716 wrote to memory of 4748	4716	msedge.exe	87
PID 4716 wrote to memory of 4052	4716	msedge.exe	88
PID 4716 wrote to memory of 4748	4716	msedge.exe	87
PID 4716 wrote to memory of 4052	4716	msedge.exe	88
PID 4716 wrote to memory of 4052	4716	msedge.exe	88
PID 4716 wrote to memory of 2424	4716	msedge.exe	90
PID 4716 wrote to memory of 2424	4716	msedge.exe	90
PID 4716 wrote to memory of 2424	4716	msedge.exe	90
PID 4716 wrote to memory of 468	4716	msedge.exe	91
PID 4716 wrote to memory of 468	4716	msedge.exe	91
PID 4716 wrote to memory of 468	4716	msedge.exe	91
PID 4716 wrote to memory of 1456	4716	msedge.exe	92
PID 4716 wrote to memory of 620	4716	msedge.exe	93
PID 4716 wrote to memory of 1456	4716	msedge.exe	92
PID 4716 wrote to memory of 1456	4716	msedge.exe	92
PID 4716 wrote to memory of 620	4716	msedge.exe	93
PID 4716 wrote to memory of 620	4716	msedge.exe	93
PID 4716 wrote to memory of 3748	4716	msedge.exe	98
PID 4716 wrote to memory of 3808	4716	msedge.exe	99
PID 4716 wrote to memory of 3748	4716	msedge.exe	98
PID 4716 wrote to memory of 3808	4716	msedge.exe	99
PID 4716 wrote to memory of 1676	4716	msedge.exe	104
PID 4716 wrote to memory of 4192	4716	msedge.exe	114
PID 4716 wrote to memory of 744	4716	msedge.exe	115
PID 4716 wrote to memory of 2552	4716	msedge.exe	116
PID 4716 wrote to memory of 3080	4716	msedge.exe	128
PID 4716 wrote to memory of 3080	4716	msedge.exe	128
PID 4716 wrote to memory of 3368	4716	msedge.exe	129
PID 4716 wrote to memory of 3368	4716	msedge.exe	129
PID 4716 wrote to memory of 3368	4716	msedge.exe	129
PID 4716 wrote to memory of 4892	4716	msedge.exe	130
PID 4716 wrote to memory of 4892	4716	msedge.exe	130
PID 4716 wrote to memory of 4892	4716	msedge.exe	130
PID 4716 wrote to memory of 4864	4716	msedge.exe	133
PID 4716 wrote to memory of 4864	4716	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://login.teams.document.portal.auth.3n8v1q6z4m9k2x7p0r5c1t8w3j.bhatbhatey.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffef25cc188,0x7ffef25cc194,0x7ffef25cc1a0
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,13130529256620748777,12360161598114196330,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,14813163274894643518,16808057654754320491,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12213879054542729056,15897668718509697078,262144 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16927117368512072527,9806014736418106763,2097152 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10310724107337275616,15284859946498989448,2097152 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,17177844707380084774,16966691096577294472,2097152 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11073389059416027639,17674128605457998355,2097152 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,8580983260313100420,3920211497003231686,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15680619825919455160,6561835512088268437,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17860369180601378135,9201655238581172659,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17860369180601378135,9201655238581172659,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,11800261164283295274,2090646576178293872,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,10155596149231485779,12751825498882881955,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,17646923079960695689,14058789427936454358,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8739645512331323267,9358584473400807161,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5808,i,12561148370692714190,17852331585078191071,2097152 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5664,i,8580111426551303340,10246086084989561070,2097152 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,16981577468241259847,15475333496670651171,524288 --field-trial-handle=2480,i,17821943531708044157,15069433706411992268,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 108KB
SHA256 4d08b944dff680ea090ca70bb8b24c5998240af9b7d9f6e7aff6e57d9e49e3ef
MD5 7488204747df959e3c8f82655346c069
SHA1 a73c41f50eabd590a7b4c2e9fd9a6ce2384cda78
SHA512 946c013c8edd9502f8980844e1e7d1726128a27435f55020b3f25c952716ad773a5d33d09cd524a0ebbea72ba744e78e830f996565d7150c16ed9a752a42178c
SSDEEP 3072:rSdv0/Jthc2hpiGspk5unqnwUCObKvhv7HDORB:Od8/JteOpiGspkzNbK5DjOj
TLSH
T1AFB302A74FBD6D22E0722317DD65E29A467611F977C2BCC89A48A0F184321658F39C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ebb1910acdad79d42c484a1924e21b5bdd31903e490016317f3d5f1bc2288f19
MD5 2e8589491a810a03808453ce94d8ca60
SHA1 4a7dab1749f09a8dc9f86ab3b1c0a88a61c5d7e1
SHA512 2c6e34a1ec2515f02ec9e1c80370077dfb87f4684df9aef5106a7805c1fb0c5110c5b7b5260aa7671b0d14b1f5cdca826c68a246c67eced7bd6e6a92cce30784
TLSH
T18C612E86E54E4463EBB891FD9DE12CCB3938D6F042AB1D5A0398D8795F27F9272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f72aca9a08564540fe9d8beabbd087c74c595342e62665a40bc54e3f8be2d6db
MD5 8a120d149de6a572478d04a5e4b85111
SHA1 c09764e6d344ddf6c083358e4e994f741dc213a6
SHA512 90c9c2ab32a0430930c9fa83a2f98b461e67742cb28bcb8d350f2df61490cffa399e3646fa72c011559839dd0f8de8120fdf0ffb08a0794207b7ef14bc38cdb7
TLSH
T198613F86E45E4463DBB491FD8DE12CCB3938D6F042AB1D5A0798E8785F27F9272B001C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595c4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595c4f.TMP
Size 3KB
SHA256 506530fb307ed3173d098108585011e74e091dde1bc20b97e3a59d35d5c80137
MD5 878657bd098c07c6e0a32d87fc43c528
SHA1 4ab297a68af403a03fc2bd375d591c57fd36c57f
SHA512 8944068ee378d3f5ccb51768ac86dbcc6c886884bce4c737270308e31f34e499f1baed53323e32e49abe67752d96aec20eadc76be99fb089e4777104e4a1e678
TLSH
T12C612E86E44E4463DBB491FD9DE12CCB3938C6F046AB1D5A0798D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 393082ec16ed00aec4cbe7728ae5ef62461de575144004dbac96bb0895fa10ce
MD5 9d942e5532aa50afcd1d9fcbae92da3c
SHA1 32a066b3bfde2f148ba438fcacb57c158914b6b3
SHA512 76625a667ba9d6574dd34cbee665f7507f9690a18e9e3d8c449436ddb32847b08b25ca0e25c48825de07c4ca56f37723087d3cde21cd6470ac6d4b81fd172be9
TLSH
T19041BFB7D7DC866DD82112F05624BE1BDE2D051982183D2E89D4EF9BA7E2072D101A8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0ef2bdbe4795a007c4c100f0ca7561e6b44639fded49e86636d76fda2a6b878a
MD5 df1b903b3ff38c232eff4ab926339ca7
SHA1 1482a1d8227de43b6b42d2fd6f382455c499ddd7
SHA512 f683b9246360b3bbb6f21a39a42894503ef99db45737993ea8c880f022923a0a5955fa09660f8e5dba1f95b3bed9c54205cac7558c50c59c3a5039e9a7914e36
SSDEEP 192:sxZnRHW2/fmsgB0IdpWaHW6+WNtqZ/YrXztIgrJ:sxZnA2/fms+t9HbC/69
TLSH
T1DC22A7527E28A97B8CC7D24DBA25BF13E6F9503255D51E58EAFC861C04E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b928add286c2fa23b0a061a5400484c4761cceb3bdfdfc657212b8c5f5a8f959
MD5 b3278d77d3e99b36372e5d6883cba47d
SHA1 a6a3eb8671225ee08ae3d19df06f1284154e79af
SHA512 4d06843635107ece843be81c68ae91dd69ca50b7c3a12471bb3e45be447d5912a10a6ff194d90958391c0d1e492720a9dc48095a6f52302b5ac1a4167e8a8c7c
SSDEEP 192:sxZnRHW2/fms+hzIdpcjHW6+WNtyOdYrjiztIg5NJ:sxZnA2/fmsEsGHbNdvl
TLSH
T1B522C7527A38A97B8CC7D24DBA15BF13E6F9503295D51E58AAFC861C04E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3c92b3c875cc51a0de9b68a7cc353738fea5d126d5fe14172ec6ed3f530444d8
MD5 7a997a9e7ece29fd1af2a695a27b904c
SHA1 78105cfeee43dce070dd361b75d4536c33d02c35
SHA512 4917be1d2ca3d9f96f1af6a340da976807d819d4b51548e5514e3d632883a51bb3cc01b4aeea83b47c9aa51e6dce8d11e54a0f11ce563a4f25f43a2fe73f448a
SSDEEP 192:sxZnRHW2/fms+hvzIdpcEHW6+WNtiy9YrTiztIg5NJ:sxZnA2/fmsEERHbh9fl
TLSH
T16022C7527A38A97B8CC7D24DBA15BF13E6F9503295D51E58EAFC861C04E77CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f07dc69d3419cfe5758e605a1e3db0b3e39f223756789da3b35814990ae22321
MD5 35351303de8383acb2b90cf95d489e2f
SHA1 5d52b06046de421ea10f12f19c959ccd49d71924
SHA512 2c6f6a3e21fb37e31dfc6bbba08edb566973a05546a8d41f4046a0617ab1e0e0cecccfe415765de179047d3b96f83d45f04fd5b4f4d6562236e2971cf38b2a5b
SSDEEP 192:sxZnRHW2/fms+B0IdpWaHW6+WNtqZ/YrXztIg5vJ:sxZnA2/fmsAt9HbC/6z
TLSH
T12E22B6527E38A97B8CC7D24DBA25BF43E6F9103295D51E58AAFC861C04E67CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fbae4a347cdaabf01cce5b2dc439b1d5464d081e946abdd56b8b1f87454b125f
MD5 8b947152847b1a0e592e38edef950143
SHA1 3ebafffb5747e8e52e580c092f7aaffba1508937
SHA512 1df4feb93df31ccb64a4febcda0d0211c760f1e1795ac3a4c403ad7d496dc985a2219e43dc2af34d8c70403eada4b5f2ef1e649351155cca2a0ca217d1f6417d
SSDEEP 192:sxZnRHW2/fms+h0IdpWaHW6+WNtqZ/YrDtztIg5NJ:sxZnA2/fmsEt9HbC/Kl
TLSH
T11822B7527A28A97B8CC7E24DBA15BF03E6F9503295D51E58AAFC861C14E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8aae3d9564fea2e5a8f5a8772853c308ce0da8cf38d5e87af7b9b08c3d1946b7
MD5 dbebf3796154ac612a245d7b19fafc7e
SHA1 2d6166705c85090dbd90520bcbdb31744a793293
SHA512 54ec045fc0eb5e0520d098c88adb7ad56754999129e87a225ef25bc991f044d3430c12d7d957fe8ff51a111799bb7b526854bb1c593546cd55d9b273c60a0545
SSDEEP 768:fMy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb0roRGLn:fMy4J/DWvbtBhu1jajiLm0bfYLn
TLSH
T12AC20A3B684CCB7E4FC01A9DED5E6F973E9802C79A948D4047FA994C02C77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e15250c96cb81e64e2649ee230e0bffad964714f29c9de05585101eec33bb867
MD5 b569eebe72820bb8ec745de3ad57db08
SHA1 d4503fa29d83757e14db97ca9fa4455602711ff1
SHA512 fc4a30ba2f3eb1eaa963463d248b7916c53076b62670926deed28a0a09bc8ce4748c2eb92273a6a67ce15f6108c6c44347edf315481c819a6a5fc92341750972
SSDEEP 48:KIDI1Ks04jyL10JF3jXYbLuLISHpIBKSkELyZAIXKhGl:KIDCKs0+iSpp6KSkqqAIKhGl
TLSH
T10C916245326B424038BE2A4851B6DA9B135235B37028E57F3FF891E16E2BE154DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1926012b-ee53-4a72-a2ae-6a174891f878.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1926012b-ee53-4a72-a2ae-6a174891f878.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fe90db8b6a682d5dc5b1935058a21150978d5547aea0da286426b6c4ec68ee62
MD5 6ad433c0635c98089f06cd1d38a3be05
SHA1 3e52fe1bd3bc93e38c18442a042687aaa2efa5c2
SHA512 21244d2c20c156b81a20734d8fff8aee4244050284053422e174ccf21089e0952128e0aca06ea5164f1ecfca4bd11bf7a241eb102096474a5e52771db8bbd9e7
SSDEEP 384:8ZcIhsNqB1TJZ/IiHX58EC8xJgXw+2AjtgOIwZOyDFoO:qhZFuEaHwlAjXsA1
TLSH
T190828D76A878AD7B58F7E185F18636034FB8902BD6C96F80C5FC5B2C01DA6A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f3350bab19fc25e3475eb49cc6191d1dfddf9fcc33ffff87c08e4a596f35da1
MD5 0003e04417403e94319c26204eee9785
SHA1 192b712c2b6ad6c0476f538f61eacee6e7a142cc
SHA512 285105aa7f6f20d689d7090702694832f5f5e2cdccf9459f684d9bdeb45bc119ce848bc0ca88e0cd304c53d0a87d4077a78c453af94e2ce27cd3980f040b9821
SSDEEP 192:1ONO6wlDgQmiUyIIW4X58gZejzorxJlDllFU6:1ONO6kgoW4X58EC8xJLHU6
TLSH
T11202F934F9687C6B8EF3AE49F58627139FE5112BE6552F84DAE80A1D00D775C1306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9c8ed6f5ccbe17495c8de556f45c09562f83e7eeb9d6d4a49f877af697a40a9
MD5 bf4c92b450974dfb8a753410a8e37770
SHA1 95a1330f20501734b0ecbb8544c4964abbba2bce
SHA512 77867c493543087a32e8a06fa7560d0f0ae57c6f8e1397745e355f334bc512651776b3b797e935a6c01341dab808548260d9f0c3c6ef0f2058e6329b92391fcb
SSDEEP 192:1ON376wlDfQmiUyLI+4X58gZejzorxJgXA7R+2ave8qNU6:1ONr6khd+4X58EC8xJgXw+2tjU6
TLSH
T1B4120736F468AC2B5DE2A589F08731039FA5522BDB896F90C6EC1A2C01DF66C530AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b5c444221b4b1844613f52c991f84c5489f3c22a8a0a56ca9ad357125d90139f
MD5 68bdf5f18df9a96133eed6fb17429ff1
SHA1 dec8ad8bf258f12028412bbcfb019bab9bdc6596
SHA512 867d5c869d59e62f9676a4a9dda3093779fb9e3896182a63804ecf6f2c2571747037912110f915ac2d51f3a01854f2da4c779e008da64ae1f1c0341294046b0e
SSDEEP 384:iZcIhsNqC1TJZ/IiHX58EC8xJgXw+2AjtgOIwZOyDFoO:QhmFuEaHwlAjXsA1
TLSH
T1D4828D76A878AD7B58F7E185F18636034FB8902BD6C96F84C5FC5B2C01DA6A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7ca52d074e5c93ec81d7a2085fb1ab760c391f127966fa22d76c3fe3f2385983
MD5 cbd2f2afcfc83e4aef4a4134d0e4a105
SHA1 846544fac9b93ddc3d348bf90aa114734e9f2607
SHA512 ca29b28815cb9b500a78a9c4068ca6c78447ce763da1f3772a2a441b79574673b0143921e6f5aefa538b3a1422f8fd4ceba08666766bcfb90f264199f3e7ea65
SSDEEP 384:xiFiZcI0zsNy8TUNTUlIlC1TJZ/hiHX58EC8xJgXw+2LjtgOIwZOyDFoO:YFQIzwgKFPEaHwlLjXsA1
TLSH
T13AC24BF258D7897AD9EE9787B37D2D024EBCC067B5859A40B3984A1CCC561BFC30AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f188ca6d8b7b59dc3a57a4e20a8d1cbc75c3c00515d3b6943e2faae1f1eebac3
MD5 f066161bd2e5ead23aa6ed91e090e053
SHA1 07e5ea4a7bc18a5e0c1cefa71339fe1995d34fcf
SHA512 02ac247c0ce0b72447e691b84134a2ee0c0f6bf822980fcd38ff3550d88cfb7d208d662aacd60353649b7f88a78e33e2db176fcf4ed396ac3384a7045761164c
TLSH
T112E00203A70115E5C064033000431F503FE3C43125A103B79F30015D2C333043D90B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3a6b03ff36c6d2a4e2f218365692f1b0d71a12c8098400437439cf6f4ff9cd31
MD5 6966f459bc6604763cc2d22590c0bc58
SHA1 bf314596796a085a36f40699c41f90938bd5b3e7
SHA512 b99b2ae42f5d5b02e9b137975dad3b624ce98b96072e1a0acdd4a2c596e3908ceca24164e49dbf62c0da8ac60176e8140b9c0362cae709305f645eedafd1bd91
TLSH
T1ECE00203570015E5C064023000431F502BD3C031155103A79E1001591C123002D60B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a38f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a38f3.TMP
Size 392B
SHA256 96aa968b7498dce64ebf42114084e37f28d950c806e1cd040859101771733d39
MD5 e3ada06787151c7771f5300f8efd80d4
SHA1 090a4f95e498257f9e5dfee4a65b99334cb6068a
SHA512 87f886d1b4cb8e23f29f674134e0615725fd83e29becaf3d547b628b6b12c08af34cde1cc168bc1d13140db51cbdff402f0f05d68f24f021cea9c47754b108ba
MD5 SHA1 SHA512

Submit Download

43527a6a-46b5-46b0-9dc6-495f3676b5b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\43527a6a-46b5-46b0-9dc6-495f3676b5b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 992280b47f274d96c2ac43cfab62228940e18eb3a9dca3cb7ba6b0a3e218ab38
MD5 7dba4d1d5d1583dff5dbca3d597e73b7
SHA1 0dc72b2ff694272a794b0ec70887292b3c50bcfb
SHA512 db3a02c32384aad14f529fd3dc895409d86f7151c7828679b2266d93eb407d68a2d22afaae5afb59766ce4060cda5c2cf3c80ad2a2eeb4a305457d7cefad9791
TLSH
T131410958A6FD1108B3B76F5A9BF7A86E447B79373E06D46E00010D4E0A62A40DC71777
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads