hxxp://albarakehalraeda[.]com/officaillyrecommendation/hmm[.]html

Resubmissions

04/08/2026, 17:16

260804-vtaqdaap5v3

04/08/2026, 17:10

260804-vpv6hsea863

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://albarakehalraeda.com/officaillyrecommendation/hmm.html
Sample260804-vtaqdaap5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303373918380251"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{79435C06-1CAE-4BE2-83F3-04C1A6C7EC2E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4340	3740	msedge.exe	85
PID 3740 wrote to memory of 3536	3740	msedge.exe	86
PID 3740 wrote to memory of 2340	3740	msedge.exe	87
PID 3740 wrote to memory of 3536	3740	msedge.exe	86
PID 3740 wrote to memory of 3536	3740	msedge.exe	86
PID 3740 wrote to memory of 1536	3740	msedge.exe	88
PID 3740 wrote to memory of 1536	3740	msedge.exe	88
PID 3740 wrote to memory of 1584	3740	msedge.exe	89
PID 3740 wrote to memory of 1584	3740	msedge.exe	89
PID 3740 wrote to memory of 1584	3740	msedge.exe	89
PID 3740 wrote to memory of 2420	3740	msedge.exe	90
PID 3740 wrote to memory of 2420	3740	msedge.exe	90
PID 3740 wrote to memory of 2420	3740	msedge.exe	90
PID 3740 wrote to memory of 1208	3740	msedge.exe	92
PID 3740 wrote to memory of 2784	3740	msedge.exe	93
PID 3740 wrote to memory of 1208	3740	msedge.exe	92
PID 3740 wrote to memory of 1208	3740	msedge.exe	92
PID 3740 wrote to memory of 2784	3740	msedge.exe	93
PID 3740 wrote to memory of 2784	3740	msedge.exe	93
PID 3740 wrote to memory of 3024	3740	msedge.exe	98
PID 3740 wrote to memory of 1164	3740	msedge.exe	99
PID 3740 wrote to memory of 3024	3740	msedge.exe	98
PID 3740 wrote to memory of 1164	3740	msedge.exe	99
PID 3740 wrote to memory of 964	3740	msedge.exe	101
PID 3740 wrote to memory of 4724	3740	msedge.exe	102
PID 3740 wrote to memory of 4724	3740	msedge.exe	102
PID 3740 wrote to memory of 4724	3740	msedge.exe	102
PID 3740 wrote to memory of 408	3740	msedge.exe	103
PID 3740 wrote to memory of 408	3740	msedge.exe	103
PID 3740 wrote to memory of 408	3740	msedge.exe	103
PID 3740 wrote to memory of 1596	3740	msedge.exe	106
PID 3740 wrote to memory of 3232	3740	msedge.exe	107
PID 3740 wrote to memory of 4876	3740	msedge.exe	108
PID 3740 wrote to memory of 3824	3740	msedge.exe	112
PID 3740 wrote to memory of 3824	3740	msedge.exe	112
PID 3740 wrote to memory of 1636	3740	msedge.exe	116
PID 3740 wrote to memory of 1636	3740	msedge.exe	116
PID 3740 wrote to memory of 3132	3740	msedge.exe	118
PID 3740 wrote to memory of 3132	3740	msedge.exe	118
PID 3740 wrote to memory of 4036	3740	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://albarakehalraeda.com/officaillyrecommendation/hmm.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x25c,0x7ffe6ef2c188,0x7ffe6ef2c194,0x7ffe6ef2c1a0
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2091401775823782522,360279185826607802,262144 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13632395678427716652,4703067226309835974,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,2754893597210494260,10053343441937545728,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6456659812645921587,15431630499848841325,2097152 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4656843993234520350,12323000685174650286,2097152 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,4550097335731857436,16620208576520593691,2097152 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,8637742369451929715,566595194146813413,2097152 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,4109869116533284892,12098224204128124285,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9716655800144049332,1606701591009231895,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,8193354526489067937,12595643982415732112,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,8193354526489067937,12595643982415732112,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6124,i,17529009588926352297,17878825490445808843,2097152 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3480,i,11351082039244211440,13836983837150600651,2097152 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,2121040979934159584,10418998001772621125,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,5488037188511373583,4136029355009034184,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,2671634844874974546,8114719687025137173,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12800312201712913029,3715153720848780487,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13139828496161833876,12193772853526773547,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,15831203681723555943,4227664322755058991,524288 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3464,i,14418474564326274449,4763672360607058775,262144 --field-trial-handle=2244,i,6848259422340337805,17707665957120536968,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 015d053064c8294dba37e3f8142c3dae3b7f4fa618a0735ae1bbadb307df98c1
MD5 c89ae5da810fcbf9f31384733e8c2c1c
SHA1 c90675124f56c9b5f28b208a190621254d23c71c
SHA512 15a0c3c8011e85d70ae6311ebce1cd1d9e221ce677723e4251e9fc8d6a7c25ffdf122043551c809bef2a6527d98f7a41d4ad0b9fbc553a2fbbf08ea2e2317fbf
TLSH
T136E0268888C8C27E9A40B8C75168630CC3C0364FDFC8BD8A1B24C588B542141A3869E8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88b90c6d8cca682c4a3c25de069bfc9f4e771a61d3b123e7c6880f6b338c155e
MD5 1abc1fcbd736c9f88dfcc34731005169
SHA1 93c50016e538f3938548d8875826a53cbfbbc425
SHA512 a497869c17547b991782164b4f14f15bef007a56bffc9dd5092c983e363dd459d9b6d2691c5d775095b4fede9c615a732948819c1f9f65c63de7e2ab33036210
TLSH
T1B2712C302206C46DD3B3C23274E22EF3B47544CAF99FAE7551A4AD783541B51AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586472.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586472.TMP
Size 3KB
SHA256 c343ae671a1fa3538755bc198eb191724ac6fca7ce985f047fd0afded88c178f
MD5 46d0616b8a3febaabe4f05382a8f17e5
SHA1 05e79a6350a2a0ef8d8b50c4cf8aac9357635db7
SHA512 e7ea71ea0f929a2dc712a6eedfcc5832b8a9bd4ab1b795e00abc374a8e999115e7275b3c138988b51c5b6d55bb3deaa2d3f11c13fecf941c4267a83fd4c1bfea
TLSH
T189714D302206C46DD3B3C23374E22EF3B17540CAF9AFAE7550646D743441B91AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ae4cbb44138d1d614beed8be8c50b9e018851f518cf688f76e30dcc5893a753c
MD5 8a3e5d6c69c5b0d6a3e32c92f808a16a
SHA1 87edaf1c66e7eb21c59f5a50adcc48b4c3911bd2
SHA512 e50e27e88df31587014301e011148bba9361da3469a13fdc588bdcc3ccf4d56c7c8d1d5fe66e4df555f44b8fba1efe496504fd4e084bcdc2b5eac106baff61ce
TLSH
T1B9419DF2C3F5966DD94156F09A287E2BCE5D0514432C3D5AC8E4EE9BA3E2071E20194E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aa45205c60918605d1ed380b6f277e046d773c805e8df2739ec66ee625604c58
MD5 5783685b3b4756c42fccb5543de0ae96
SHA1 99aa5e8cff8cce2b6956515cc01666a3dab1b421
SHA512 6c99892e97ff9699a463e57eb22e847a76f01fb6f136c0f88ce463772140aa7dbcec6feeb7de02a6269b74103c0f2b631a2d74c9021c6401109e1ed8f0b43621
SSDEEP 192:sxZTRSyM/jK1Ml8MkR/fpshdS6Idp58OBHW6+WNDAs3IY/YIkW4vIgrJ:sxZTEMR/fpshdST2eHbD1v/i9
TLSH
T12752F9066B346977CCDBD209F944BB93D6F91472A2941E5899FCDA1C04E6BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 24be4c3f51624bca40e0b37fe9fe928b53142c861ec2d3f23f59aa4998972a7e
MD5 028e1f623c4a0eb491a0b5dd33d6edca
SHA1 8dd38bbee529c957207d3f760368b60b12d3069e
SHA512 deeff17ba32033fa44bb025da81a880a6892ed866f1a7fab7ff98391b2c38ea99c381968244c8a0431297e5506ede16ad94fe82e65811390cbfa4c5fbf416b11
SSDEEP 192:sxZTRSyM/jK1Ml8UQckR/fpsW2S6IdpH8OBHW6+WNDAs3IY/YIilRvIg5LJ:sxZTEqnR/fpsW2STceHbD1v/mL
TLSH
T10F52F8066A345977CCDBD20DF985BBA3D6F51472A2900E58A9FCDA1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7dafdca0911b2f0572bee860b76d96b18374b959cdcce72dc9976a924017f7ed
MD5 e78edb21c1a2f009204b6f382372a0f4
SHA1 3660e76ff1cc52e66264a1a7bb01beeff459696d
SHA512 8ea069b17abb4091e9e392d26dc1ef3b1674ce07c054f17f10a9572720cdf61fe3eb11c92b7e64dcd509ff20262ea90e263f2fd34b9ea71634aa934fe0d2b4a6
SSDEEP 768:P3sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9sroVZ0+:P3sqxXlWvJD6Tu1ja54LAs93VW+
TLSH
T11DD21B3B694CC77D4F840E6CEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 4a9eeacfdded4bef1564f869f732512b5912039686cd7dbae63628c1a2a9c38d
MD5 5be62bdbd2cb2d44b4d16279e73fe345
SHA1 c617936bd45e1a4b43defb43b941f26d8b8385b7
SHA512 7f022c752d0a56f585bfc3c0229a14c393930196a402de108a2c05405cb3dc3223dd14f7cf63fb625dc1d1c52ff418c219a348d7f07edd136ff1011858b3195b
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhmCH:ExTjHOJzN
TLSH
T14CE1751A713A465239BE2898B3A686771F4231633118B46F3FB840B54E6FE125DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5900b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5900b2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ab584f4b85da3d9193f5117916ee9133931a3d24a794622f455380187f252a7c
MD5 e6ce047c8a89167704ec6d6066596115
SHA1 7e57227d45c98efbc4a87772d5ecf9b2d66a45ec
SHA512 1a963c27699e4d6c6affb5a5f9265027b9e285c066d6a56ebc4e41adbf29884fac2fbcc7509e204a60e4327f958962659d41a56a1b13ad0788739bbafd0a3505
SSDEEP 384:oZcIhsNQA+FbuFMVRNEOz/9a/zBeRs9JKgqijUntQ:WhhKiHEOj9a/zTjKgqmUntQ
TLSH
T1EC928D345834AD379AF6A445F987361B4FF89027E7C46F9490ECAF1D01DAA9C130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a168a68ad72af9142cb51982dbc38af17af80a721053e94f7219678b9af05be
MD5 f410b4de30618e2ec2599646decdb1b7
SHA1 d797ef2984bc8d0b3b4077940cf424622c2a31b7
SHA512 8c83f4912b92353eefd1c1657137906ec68c3c9240c9755bfeb716ef079043eb17688224b6b642c757dac7ad0b3cd172ba7b1b6433d104afb15da4ecc8f61267
SSDEEP 192:tONnd6JkRtQmiUyU4W+RNEOmAeR1h3BRAU6:tONd6UrcW+RNEOzoQU6
TLSH
T17202E835AD382C7B9EF2AE09B58B27175FA4207BB9856F84DAD81F0C01D765C1347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 407724051f5e06356e2049c357b9f25e3936f0a1667e3e1146ecbca7f692144e
MD5 fc2204656e41feb3a92ad00e8f0ca7dd
SHA1 6a4187ba569668e5dd4ec8e33fadfa16ad6c51ea
SHA512 485ca8e6f2c5f7daa7c654ab98a7d5c956637d26270e3bd46f7339ac63b36d0082f6148c4243e7ad270ceeb8571ca8c49225203d1efd87ca02b8ffe30eb3a2ea
SSDEEP 384:+ZcIhsNQF+FbuFMVRNEOz/9a/zBeRs9JKgqijUntQ:8h0KiHEOj9a/zTjKgqmUntQ
TLSH
T12B928D345834AD379AF6A445F987361B4FF89027E7C46F9490ECAF1D01DAA9C130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 70ca3d239197a000ecf6a796c98d0ba970450cfc8b55744f29f12a65af7825ac
MD5 d98e44cd973ba36395afaad2ad000a20
SHA1 f05ad8c18a019d218586667a2890693b2740c0f9
SHA512 d9be51c2b95654b9fd37493b3f7f89fcdad430c45628f7c5906c3684a01fb767a23989547156276754164e3788613cf3227624c3224fd9b3abe8fed21a36fbe8
SSDEEP 384:fiFiZcIUzsNQ8TUNTUlIlF+FbuDMVRNEOz/9aGzBeRs9JKgqijUntQ:qFQotwgWgiHEOj9aGzTjKgqmUntQ
TLSH
T15FD23BF148E79536DAAE5B47A77E2E074EBCD023F5806A50B3D85A0CCC961BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18725e1d508fe58687dcdc89bf50d60b570ff31d7b0e67ec01672b1ab3ea05de
MD5 c4336e9a62c0fdb48b3beb5e4469ba30
SHA1 fc66e8e84e99966a2c4ca582f40ac739edd1e2b8
SHA512 fd728c8e4cea966cbf960e72fc53c7463a38669a561bc4a4cff6569554b56835bfcce45314fd1ac06e042a325685327b8c96193e4750ad4463f9b0fb2422255d
SSDEEP 192:IONJ6JkRhQmiUyH4c+RNEOmAeRi99agVciDqyaU6:IONJ6U/7c+RNEOz/9aHzU6
TLSH
T13712093579386C7B5EE26845F48732175EA95027FA896F80D1DC2E1C02EFA9C130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05073032-f899-4ddb-80d6-d313a0eafa56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05073032-f899-4ddb-80d6-d313a0eafa56.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a60943abc0dbab38f71313a8488c8ed4d26706f3fec68a14b11a3916e451619
MD5 a78b252e97dd94f92694c47038eb1a94
SHA1 36a59f16b6d8e72b5e42fb2594b24f96fe9c16f7
SHA512 2ed99b1a4e5018a4b90fe6f3dfe9d181f50a5af23a002ecd2527846cc6f12a352f5af446279095ffef7086bb08549bd88976d76d3d95c7764ba06a09f22ae569
TLSH
T1CB413A5DB6FA1008B3B36E5AABF6A86E447BB9772E06D05D10110E4F0A73B41C871B33
MD5 SHA1 SHA512 TLSH

Submit Download