Analysis
- max time kernel
599s - max time network
464s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:41
Static task
static1
Behavioral task
behavioral1
Sample
exploits.html
Resource
win10v2004-20260513-en
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
exploits.html
Resource
win11ltsc2024-20260710-en
10 signatures
600 seconds
General
- Target exploits.html
- Size 34KB
- Sample260718-d89dtaav9y
- SHA256 deee00c6be90bb679453e1cce0d2c810c6cbfbed46fcde0c1e2496d78dcae397
- MD5 2deba74e0cf25db41732e21a7e0e359e
- SHA1 db156f93c1156cbb9b59498326c8edd956a568b1
- SHA512 f14d54f4ee2735b1ff46da9f12f6701fd4082992136685ba4f828014781eea1068380e7a198a7b53e1c971b20240850c8d7e617de4d946f2e6868b59c900ba97
- SSDEEP 768:vru8/i512eH4fvkCqS5PHvJingqna03O7m7Y7AJoNsHnBG2vm37ijk:jJ/i513YfDqS5PRingqna03O7m7Y7qc3
- TLSH T158F2A42621F6B87700A351F1299A070ABEE3422BC65E891177FD069D9FE2F47ED035C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1116 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288201844544982" msedge.exe - Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{306C40AE-B836-49FB-BDBC-7D96825F3FB4} msedge.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 720 msedge.exe 720 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 6032 wrote to memory of 4124 6032 msedge.exe 89 PID 6032 wrote to memory of 2944 6032 msedge.exe 90 PID 6032 wrote to memory of 1116 6032 msedge.exe 91 PID 6032 wrote to memory of 2944 6032 msedge.exe 90 PID 6032 wrote to memory of 2944 6032 msedge.exe 90 PID 6032 wrote to memory of 5108 6032 msedge.exe 92 PID 6032 wrote to memory of 5108 6032 msedge.exe 92 PID 6032 wrote to memory of 5700 6032 msedge.exe 93 PID 6032 wrote to memory of 5700 6032 msedge.exe 93 PID 6032 wrote to memory of 5700 6032 msedge.exe 93 PID 6032 wrote to memory of 2824 6032 msedge.exe 94 PID 6032 wrote to memory of 2824 6032 msedge.exe 94 PID 6032 wrote to memory of 2824 6032 msedge.exe 94 PID 6032 wrote to memory of 1852 6032 msedge.exe 96 PID 6032 wrote to memory of 1852 6032 msedge.exe 96 PID 6032 wrote to memory of 1852 6032 msedge.exe 96 PID 6032 wrote to memory of 1036 6032 msedge.exe 97 PID 6032 wrote to memory of 1036 6032 msedge.exe 97 PID 6032 wrote to memory of 1036 6032 msedge.exe 97 PID 6032 wrote to memory of 2704 6032 msedge.exe 99 PID 6032 wrote to memory of 2704 6032 msedge.exe 99 PID 6032 wrote to memory of 3488 6032 msedge.exe 100 PID 6032 wrote to memory of 3488 6032 msedge.exe 100 PID 6032 wrote to memory of 3144 6032 msedge.exe 102 PID 6032 wrote to memory of 4388 6032 msedge.exe 106 PID 6032 wrote to memory of 2872 6032 msedge.exe 107 PID 6032 wrote to memory of 360 6032 msedge.exe 108 PID 6032 wrote to memory of 3176 6032 msedge.exe 109 PID 6032 wrote to memory of 3176 6032 msedge.exe 109 PID 6032 wrote to memory of 720 6032 msedge.exe 111 PID 6032 wrote to memory of 3392 6032 msedge.exe 112 PID 6032 wrote to memory of 3392 6032 msedge.exe 112 PID 6032 wrote to memory of 5396 6032 msedge.exe 113 PID 6032 wrote to memory of 5396 6032 msedge.exe 113 PID 6032 wrote to memory of 3172 6032 msedge.exe 114 PID 6032 wrote to memory of 3172 6032 msedge.exe 114 PID 6032 wrote to memory of 4560 6032 msedge.exe 115 PID 6032 wrote to memory of 4560 6032 msedge.exe 115
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\exploits.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffe1d8dc188,0x7ffe1d8dc194,0x7ffe1d8dc1a02⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,2244058547864063353,6513830079500808159,262144 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:22⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11318675673797499293,4775861937441054570,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:112⤵
- System Time Discovery
PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,16137205412420805038,6061784077896644554,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:132⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,6762872037123924430,1080023339036655977,2097152 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:12⤵PID:5700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,10403051703392966509,15687161447316840246,2097152 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:12⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,4968774164947075948,5739378803430426777,2097152 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:92⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13290800007368448614,7915093541292400677,2097152 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,9162166163153508086,14541051663248919262,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:142⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,14620757302162975695,7151561347692135897,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:142⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,13400831884055602772,8831656953360327080,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:142⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,13400831884055602772,8831656953360327080,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:142⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,7140494996582109785,14914297883453778460,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:142⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15731446387805520925,1610049312091767038,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:142⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17784876761729823575,16231497532255324956,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:142⤵PID:360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,1086137655466685385,11965502949420470652,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:142⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,17609968676684954966,14177495776736988805,262144 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,7317319289556215093,16169947285110448872,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:142⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,275268731609991053,9439598771356604773,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:142⤵PID:5396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7750209393314951358,16756233248638572410,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:142⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,1753012879874979087,6859533589897245127,524288 --field-trial-handle=2428,i,17491203740884452004,1840662635072719677,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:142⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
- MD5 04925ec9b8ab191e010732cba0eeefe1
- SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
- SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
- TLSH T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
- MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
- SHA1 610df135117504b2857ee3cc03a5ac9797b10333
- SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
- TLSH T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 d630dec8a841fcfc0c47d613f253eb136721672e144f39356d3d6cb35893639c
- MD5 fcb4e0bb3c397eb015248b25d71afc1f
- SHA1 cc25b6a782f61275d2461eea48fdcec0b83e7468
- SHA512 ff88fcc6cc90edb74e2f70c9f663fdc50996fc1cc9c814281810b598fa0b45f32872eb86b9ac3c88a082654dd73d189d2d1d6d32c422355e637b81e246d0c822
- TLSH T11CE07DD926C8CA6FF2407A5B42E8875CC2813E5FEAC86FBA1784C4AC7046150F3C36E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 95fbb285b6b315cf39d691f080d07aaf0bb6e06b70236d7ed9b9265465b9893e
- MD5 8e0d2db18d09961fdc2dddb383d47af8
- SHA1 af58e58d90ed7a73d59736b4dda4d006ca9774f8
- SHA512 58ddbe29abb3632a82554e04d2f39c385a53821598f62684f052b1b633f546791f3c3609c4d0bae8107fd175d3ccbd7c616fdcee75746f8ad93bf78732fe12fa
- TLSH T1EC41A9B44F62B9EFF72885F665D5675772F4BE7502CB6E1141902E309E5332570210B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 97b39624ffa288a5d387761a1736bbea60060e1a39ca3ea3573a64c54d69d207
- MD5 e2e22306c1f59763a435b6dc5e8b3eb3
- SHA1 6c8af5df7d542147b74d7a5c7ec6001386247772
- SHA512 a7211db76bbc0aec24981f59a5ed35d744c0d87ab0e4fe1432215c1b00c8de412d6b2948489ac227e3a66240d4636fd0d47653ad153b044acdd377296a263b93
- TLSH T1DF5189F783E4867E891156F0AB146E2BCE1D0956432C3C56C9E4AF1BA3E24B1E14169F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 cc6cc81beefdeb71bc959978681f8cf0774c65ae3188d182bf1e2b91b64043bb
- MD5 894eb5ee15fb585cc95a75105357dd26
- SHA1 1b8bde1decccc931223097a6ed858878a9b70cfa
- SHA512 e53d3e953e60c8e8fd0bb4d92c547b686952dc916d5a646166e40f5e0f52689926715b9fd69318a9d71706c000070b44c3f66e151c3fd144442e2fc95b81edfe
- TLSH T1DA51B1F783E4867E991192F0AB146E2BCE1D0556432C3C66C9E4AF1BA3F3471E14169F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 be99d39e08140f74838de1ea339cd180790b02d9a25ce129c9105e6bd5566e56
- MD5 287275e297c05214420c7387c46aa390
- SHA1 dfecba68c52d4f3dd5c4d43d74fe363329886d32
- SHA512 d41084eff50c24d63d0869f1d05f9129d621f4cd57ab8e911dadd91734108cb73f17b1f693e65ade0b4134ecb315b2d5445ed5c62d551b9bf46cea2abd76efc5
- SSDEEP 192:sxR9RPb2/fv+sFwfv/2VzoA8p4T/g6+WNIYZ7PKsEGwIgIJ:sxR9p2/fGsFwfvO4i/5I6Ms
- TLSH T1B232A7166D68993B9CC7D21DFB55BF53E2F95032A1D41E48ABFC9A0C05EB6CD220740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 2fa874d3431430c26dd696bf115bf23a7d0ecb64a251a5d9d70ccebcd7e4e8cf
- MD5 91b1848f2ac718bdf9d7e12e3a57e755
- SHA1 0b4e30a1e43172658be5e1e3334feb7a428e309c
- SHA512 7adfa08dffa16a941fac23cc7f45c120a29c83d291f73fbefd6805017e33d6d002908aa76145d8b65bad809ded5e2c3515e17d00470cb90a019e70758fc71aef
- SSDEEP 192:sxRKRPb2/fv+sewfv/2VzoA8p4T/g6+WNIYZ7PtsEGwIgDlQJ:sxRKp2/fGsewfvO4i/5I7MB0
- TLSH T16732A816A968993B9CC7D21DFA55BF53E2FD5032A1D41E48ABFC9A0C09EB6CD120740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 1ccc3ec5973d0e10d1e13bb45de0c5d0402db518b2736a9713e1a3b735186df9
- MD5 b79a1a67c9f4191c4224be17c60d38cd
- SHA1 c625eb377ca268eef85ff6006c20cc8d4747fcf8
- SHA512 4a8e0258c24b3e32a543778f43133b8ec0e9bb197034946576ee538a0a9331866b110c70da4d558e159e695718a4d47e2cf4cb6e5cfcf58231cb87c7e73fd9cf
- SSDEEP 192:sxRKRPb2/fv+sewfi/2VzoA8p4T/g6+WNIYZ7PxsEGwIgDlyJ:sxRKp2/fGsewfiO4i/5ItMBO
- TLSH T17942A816A968993B9CC7D21DBB557F53E2F95032A1D41E48ABFC9B0C05EB6CD220740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 23KB
- SHA256 5bffe4575619e4f68bd3411f1f92542e6ccce6232645b4349fd0062472048d73
- MD5 2164d0d373013dfb831d3e977f15b0e6
- SHA1 6295107fa92a6d7be397fd534c2173f91ea976fc
- SHA512 5f641d63d94079414a6df47b78ba47243e9c0605f7870ac304734d46b7337526c79351adffa9f03ab2e48207a6c2609a9be75ea1271413ccbecd0268dda2c6c2
- SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6QroOpM:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vx
- TLSH T1D5B2DA2B604DCB7F9FC01A9DAC196FD67D9802C797588D8047FE990C03C77EA912A4DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 271B
- SHA256 61dc1eb0b2c00eec21737f26b4f579d0f996150ae8ed0d9d7a6939b7baba27af
- MD5 aca047ad3aec43dfd72e29a150461921
- SHA1 28032ac72ebf3f9b12b9c34f49dfbef78a824cea
- SHA512 4bf074473ee0c055e3728a183f1718a2d10d04c3445b1bb8be73df36c20e1f6c5507c85b78f85df5b90f86df1cf4a33b1679d171206d7944c49a811e64bb4091
- TLSH T1DBD02BFB28E94464FD6F83E6603684B141027D904B49DC4E512C428714917253437C65
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 9f23cb6b53e20dd3f941237488b70cc35aa0558ac95c2e260679b06b7d6a5645
- MD5 6440b6246ec2902799bb86e15e0e5042
- SHA1 3d24c0623685c2912af82560adcc315b71f42164
- SHA512 eb813a547488c3c41251c0e2d8872000f39813f20105fa0bf9a6991486c223867f282a6482197ed2d159f08d99633720e56035d99d8a8f681cc50382039f4d25
- SSDEEP 24:KSioyEioKiojioPPioESioVioxiog1ioNio8DiozI4ioPiogKXioThPioJiog1R4:KE+I/K/asjydXI9KA04MYIzKtasjyS
- TLSH T10391CD61763A4211387E695981B5C67BC6C6B0737018A43BBBE810B56F27F024DFE8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c7f26edd-e236-468a-a2bc-7a4cb467f7d6.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 36KB
- SHA256 1b7a9e72ce1d5a057e73cceb48f42ba6483bd98c7f85f528b2a0b743ece23c2b
- MD5 f0a017ccfec72a334d25e42a9040ba73
- SHA1 d7c86bbc2c787fbbe275f8cda5b09a9936e86a8f
- SHA512 55d3175ae2d53c69b3213b2403d6de86bfbd735deb25142ee19203c910dd98f9f230e81c89da30ee6952ae351707541032b32600446355553c52e6d957d1acb3
- SSDEEP 768:3rv+4UNbd/3ELF9UqUL7LhhAam6aQMGdjWca4Ghf9qWM:3bsbx3EfajmaME6pqr
- TLSH T111F2BF32686CD9739DB39595F21B3683BEB0526385C80E84D9E92B0D47DB4DE230BD17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 a5258912ad79acd6cf9b380908329d7743e0df263db169d2e29ad26cb47b353e
- MD5 69482c7e9da48884dfd780162c83f82f
- SHA1 08a675d1e2ed6d8494cc0cb805e309148213d1bb
- SHA512 e590c4f63ce16d4779d546c60bb4b15822fee492826687a413c158d6e1856c526cc0cd54de6c9ad710cc4ca048c08d12ff0906bafe59f88ee9e6593d76a31627
- SSDEEP 768:fj+9F3FLT9UqUL7LhhAam6aQMGdjWca4Ghf9qdq:S9F3FdajmaME6pqQ
- TLSH T161E29E325C6998739CA696D9F31B3687BEF0526384C81E84C9EC6F0D07DB58E2307D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 36KB
- SHA256 9bf61d79d50bc57d07b50cb3ffbe015f40cda449a731f23a1fa6d30899db9fd5
- MD5 c548861b66964e504b3b899baa6eb35c
- SHA1 8202c7e4dc3c2f147924706f1836b0a4f5caf338
- SHA512 a75fd7201c27912c880c8cd17955ec2dd83850c7445413fd291aaad89004f1b1650b60682eea5af870f0d7771ff8e7d13331c1a6980006693253c23adfec3ff1
- SSDEEP 768:7rv+4UNbd/3ELT9UqUL7LhhAam6aQMGdjWca4Ghf9qWM:7bsbx3EdajmaME6pqr
- TLSH T19403AE32686CD9739DA39595F21B3683BEB0526385C80E84D9E96B0D07DB4CE330BD1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 e2317e2f49849498f58346b43268fd37479922a31fcb96968add4476369d74ff
- MD5 2064e1edbed5c8a6714a2ac5ec059bde
- SHA1 b180c7eae45350c3cf005fa2c92b2faec612ef8b
- SHA512 c94fa3fdca895a2d94fb75e7c5bea78dbbe45b46e23001c4e6cb6426ff209e2ebcfdb8c4becdc74c01f7c124e9359cc53fc910ad6b25a1a0a6425541e30602e4
- SSDEEP 768:4Frj+9A3jwgBLT9UqUL7LYAam6aQMGdjWca4Ghf9qdq:Z9A3Hd5maME6pqQ
- TLSH T14BE28E335C58C977ADA78AD5F71A3687AEF042A3C8C46D84DADC6E0D06D718D2307D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 193d068faca6e1422ccdc8b80f56c64dc24f82bb3507fabf113eb093a2efd3bb
- MD5 ba10d519ab2d52f9daba2e7a713eebae
- SHA1 bcf12ed9360b3d136bc0f7e4074f5585ab85fabe
- SHA512 79f5c98423fc034106809a72e0411fd9e52566da17c3c2d018ecb5bf87fda4026fa7a508a4f55b6a0bad47ec3ae2e72b9e8174d01aab8a5460ffefa7491f0a31
- SSDEEP 768:/rv+4UNbdq3A/+qULcAAam6aQMGdjWca4GhfBRPeU/:/bsbc3aZKmaME6ppH
- TLSH T1C1F2BE31A86C9973DDB79A99F21B6787BEF021A384D40E84C9D85B0D43974CE2307D27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
- Size 479B
- SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
- MD5 60aeec055cd3bd04b686b14115275140
- SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
- SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
- TLSH T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\77e739df-057b-4b24-8e7f-e7a61e62acca.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512