hxxps://textbin[.]net/01wu65yuv7

Analysis

user interaction
yes
max time kernel
24s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://textbin.net/01wu65yuv7
Sample260822-e6542seb67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318468629159500"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{3DB89ACB-C2E1-48D3-AD8A-3F31751BF35E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{CE85CFE4-5CF1-4674-9E56-719AE2BD8FDD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4300	4212	msedge.exe	84
PID 4212 wrote to memory of 4628	4212	msedge.exe	85
PID 4212 wrote to memory of 1204	4212	msedge.exe	86
PID 4212 wrote to memory of 1204	4212	msedge.exe	86
PID 4212 wrote to memory of 1204	4212	msedge.exe	86
PID 4212 wrote to memory of 3392	4212	msedge.exe	88
PID 4212 wrote to memory of 3392	4212	msedge.exe	88
PID 4212 wrote to memory of 984	4212	msedge.exe	89
PID 4212 wrote to memory of 628	4212	msedge.exe	90
PID 4212 wrote to memory of 984	4212	msedge.exe	89
PID 4212 wrote to memory of 984	4212	msedge.exe	89
PID 4212 wrote to memory of 628	4212	msedge.exe	90
PID 4212 wrote to memory of 628	4212	msedge.exe	90
PID 4212 wrote to memory of 2596	4212	msedge.exe	91
PID 4212 wrote to memory of 2596	4212	msedge.exe	91
PID 4212 wrote to memory of 2596	4212	msedge.exe	91
PID 4212 wrote to memory of 1520	4212	msedge.exe	92
PID 4212 wrote to memory of 1520	4212	msedge.exe	92
PID 4212 wrote to memory of 1520	4212	msedge.exe	92
PID 4212 wrote to memory of 3980	4212	msedge.exe	97
PID 4212 wrote to memory of 3980	4212	msedge.exe	97
PID 4212 wrote to memory of 3276	4212	msedge.exe	98
PID 4212 wrote to memory of 3276	4212	msedge.exe	98
PID 4212 wrote to memory of 2680	4212	msedge.exe	102
PID 4212 wrote to memory of 2060	4212	msedge.exe	105
PID 4212 wrote to memory of 2060	4212	msedge.exe	105
PID 4212 wrote to memory of 2060	4212	msedge.exe	105
PID 4212 wrote to memory of 3308	4212	msedge.exe	108
PID 4212 wrote to memory of 3308	4212	msedge.exe	108
PID 4212 wrote to memory of 3308	4212	msedge.exe	108
PID 4212 wrote to memory of 5080	4212	msedge.exe	109
PID 4212 wrote to memory of 4108	4212	msedge.exe	110
PID 4212 wrote to memory of 4108	4212	msedge.exe	110
PID 4212 wrote to memory of 4876	4212	msedge.exe	111
PID 4212 wrote to memory of 4876	4212	msedge.exe	111
PID 4212 wrote to memory of 4876	4212	msedge.exe	111
PID 4212 wrote to memory of 4216	4212	msedge.exe	115
PID 4212 wrote to memory of 4216	4212	msedge.exe	115
PID 4212 wrote to memory of 4216	4212	msedge.exe	115
PID 4212 wrote to memory of 1852	4212	msedge.exe	116
PID 4212 wrote to memory of 1852	4212	msedge.exe	116
PID 4212 wrote to memory of 1852	4212	msedge.exe	116
PID 4212 wrote to memory of 5208	4212	msedge.exe	117
PID 4212 wrote to memory of 5208	4212	msedge.exe	117
PID 4212 wrote to memory of 5208	4212	msedge.exe	117
PID 4212 wrote to memory of 6028	4212	msedge.exe	119
PID 4212 wrote to memory of 6028	4212	msedge.exe	119
PID 4212 wrote to memory of 6028	4212	msedge.exe	119
PID 4212 wrote to memory of 5456	4212	msedge.exe	121
PID 4212 wrote to memory of 5456	4212	msedge.exe	121
PID 4212 wrote to memory of 5456	4212	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://textbin.net/01wu65yuv7
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,17218564905220801836,15405244147868328048,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,17325031027099140131,14390971619580960343,262144 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,10557457507107075962,15811260108388473588,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,17999973379917025116,10263161904379238422,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16571369536884292656,15120652235352854468,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4330254219487560403,2056867797419185126,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,4287395538419287960,8406258676145334702,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,14753830173689317370,6638050849428582662,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,16888105070461566880,9263452127588189069,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,14809263604630986372,17066879144278279077,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,14809263604630986372,17066879144278279077,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6188,i,7893970184925715495,13757796482075125999,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6516,i,11614648097009074242,11333049644216602581,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,7200565897331762848,4202468490701269783,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,3078769173890620641,6042050625546300513,524288 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6408,i,16038365633806549037,11396035785927877387,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3488,i,13464233486258421072,12756466661574584080,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6368,i,8870733702609241742,12947858367485090010,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6576,i,14206007635455135724,9701729151103469015,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6748,i,3429320539563036307,11606335966439891912,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5096,i,1193973044857675363,1263224206637620920,2097152 --field-trial-handle=2172,i,14966419006591755143,5891601781595146131,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f7645e515b0b4f695de90735e552622f7ce6f1c1a3a56484ed2bc0028c44641d
MD5 85dcbaf06af48cc371e82dec7714b80c
SHA1 6c6aec56805968a47bf993bd3de21001933919aa
SHA512 7a4bfc32ce6ce6554c16186c045652652911a4b23247f765bc069ffbebc3e8aadd24dbc6761b122c641b79c43a4b9476ef6e84351f742fa92ad1a29932cdc770
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T1A9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 64KB
SHA256 021fe3ae8df5af116b10b67e9994d17d1ea14dd48750a011a2e39d10c3dc6834
MD5 d417921495804b6d6c95cf7c967fa8ee
SHA1 6d5a01fe7a61b129075b07d5fc3ca39ff69d304a
SHA512 2107ff214e68a1a1550257c389cdefb405b57d4fd72c7072b55ad0b0a8e7b46c6a3a13eb8e46369556cca1b85d5d7c6d6821a54cf1e50a6d579941adeba68c0b
SSDEEP 1536:WCMloLi1VaMZ+iWonE0h+pxezy7pUVGObkpBuEnFiIlqU3tWCXfjq/:W9lj1VWE5c00pUCpzFiIvtf6
TLSH
T14D53023F41E1373C8427A84D6FFA2CA7640D8D809A9B7726741A73D99869CD1D543837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1a2af5f2c6f4436f840ab360a712ef4a9027015e66b03f1a7c168e2a804aa3f9
MD5 ff4bd8fbeefa853c654d10530738b119
SHA1 4ced046fe5edb61f870899f4616ddb6275d48c49
SHA512 4fee29e237954d410b95c92b184b85ca15d0332d3c668389a1b5db68c0e7f5f756db838d67b1628e4409a79ea6e304676cabeebbb0fd7d591afb96c4d1765b32
SSDEEP 192:sxZoRlyM/jK1Ml8Mko/fCsPsEAIdpkclbOActiHW6+WNLFm4ZQ3/YIM0eZIgrJ:sxZoFMo/fCsP3Bk6HbLK/U9
TLSH
T10E52E8526A346977CDDBD219F901BB57E2F8146392964E44AEFCC91C04EABEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8aa77a38cfaa2131a1de4a5f917ef5271406030973ae90897b71ca0d1734e26d
MD5 5f27ade5a41f6cd4d446c0d349de7bcf
SHA1 dfe73ff719e8d12f823f730434c2f12f17370b26
SHA512 faef85c56126abe9130ad482dd762122a9f120d32629e838bed26373da4ed4554ae51355dd9beb09560f9363fa66e387cfa0fdac66f05f20bed723a2febb77fc
SSDEEP 192:sxZoRlyM/jK1Ml8Mko/fCs5sEwIdpkclbOActiHW6+WNLFm4ZQ3/YIM0eZIg5QJ:sxZoXMo/fCs53Rk6HbLK/Uq
TLSH
T14762E8526A346977CDDBD209F941BB53E2F8146392960E44AEFCC91C04EABEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b898105afdfda17482f7b53bee5073abb251961ed0579304cf1fc0b9c22d8bcd
MD5 36f66485dceca37a855b35141ee7680e
SHA1 77f517895e2c3d62c549a0afdfe358fc83b703e5
SHA512 990f4d8a05f1226a86a413e5abd7d2d9c29392cbe04311adbfb212fc83f094912193b0ca7fc70e194f1684b8184c36d7a3234807e6eb621d4bca075cd14b1118
SSDEEP 768:A2sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Trol2h:A2sqxXlWvJD6Tu1ja54LAs9gla
TLSH
T1A2D21B3B694CC77E4F840E6CEC26AFD66ED801CB66988D5447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa18bd24db654db32a314be09aefe0d9d51931ee5ed5d96007ea5c567efbee2c
MD5 043d6aeac0883d6a9cd56e7c504d9e06
SHA1 2f1c42a93c45235d9d4ec4253f4e42028b4113b3
SHA512 543d22f952d60a7c56aa7a790aa6bc20cbd39a32b83f511f9bee228d70e3ffa60b5c2821e522b8d0cbcb5d49447fe8cb4670a6d6404c77b6d42c457a88bc9728
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMko3:KYbaKYIKvdCKegCeHuKMkY
TLSH
T1E291021A357A0212387D2968B266D93B5F423A63701CE46F3FB850660BA7E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1bec0a99a568c79d782d75a9ff015352c40a5355b9104da4b8091c23a72a1343
MD5 b98d04e9b8e1072b09acb69f584675d0
SHA1 0361e52bb46da3e6c852e33c00dd677a14795171
SHA512 7a13eaca189e834cbf8916c8cce062bea8365bfd3fdde0613d462a425bb1abba75c4f19219e69a6b44071179288605c89faa562e53a89bfb75a28b9c82760d7e
SSDEEP 384:UZcIhsN2C01brqUjVRNmd2OYolpivx+awo8:ShNYUBHmRNpi5lw3
TLSH
T182827D315C345C775AB6A545F84B35076FB890379ACE2A4095ED9F1C00EEAE8131792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45221d5714cd58e4410fc16e0158606bfe9235e4b7fae20fc80170ab4ba7f0e2
MD5 499e4d27fb127c7dfc64cde1c7f0b67b
SHA1 a13708c70190808663ff3c267d3e17e8586a287c
SHA512 3bd28d6f578322d50824a1cb5bcb5cd31c4edf01f45bbf107db9b3ff0b8b3173a369799eba666b6ea209d1fd664df861a3e3cbd2d7595ab651f56f7ea7911690
SSDEEP 192:tON06JkRtQmiUy0YW+RN5+Fd107sh3VRHJU6:tON06UrIW+RNmd28jJU6
TLSH
T1D002C935AC382CBB9FF26D0AB58B37175FA4117BBA952B84DAE81F0C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2dd06333064a9535fc4252a7cf7ffdc442f9a2012899b9251fbd87cb102ff065
MD5 f41aae4e563d24c8da2a5e4cd57814ff
SHA1 7b3f1bb8bc3b9264f07e0bc5fe7b3f58f5a08e68
SHA512 208462e497f1cbc58d63ca8668f92249a1578e77ce9f1860e636d6c0ac3526b03028d3a0b63cbb14cc7482934709ce8e427d3d6b216173fe36072d63707baa74
SSDEEP 192:KON/6JkROQmiUyKYx+RN5+Fd107ptpefPwoULVcvqDyU6:KON/6UK0x+RNmd2OYobpU6
TLSH
T11F12FA3568286C6B5FE27945F48B35175FA89127EE8E3B8095EC5E0C01DF5AC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5d1b9adbdd6a1aa3b139e33a716eb9f84e17c4325caba0a186af7d174ff115fe
MD5 119d3d3c05673b56035d2b418450828a
SHA1 170c0cb1f5a8ec4a9de87bee570902a849ce9dec
SHA512 67af1cca271a3ad6f78571bbf3b66ed8cbf3b3d3dbc7daad8dd8d934dd8e1ff72072cb665bb6eb0aa74e420133741dcbad2cb321cc87e7bdd30a9a41700664de
TLSH
T152414A58B6F92048B3B76E5A9BF6A86D48BF79372F0BD45E10010E4F0663B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads