hxxp://FEIYANGGECHANG[.]COM

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://FEIYANGGECHANG.COM
Sample260729-bbmsfasydx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297606721701406"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{9D4A05AE-5E52-4E2C-9D96-99C17CD11A10}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4880	1036	msedge.exe	86
PID 1036 wrote to memory of 5104	1036	msedge.exe	87
PID 1036 wrote to memory of 4324	1036	msedge.exe	88
PID 1036 wrote to memory of 4324	1036	msedge.exe	88
PID 1036 wrote to memory of 4324	1036	msedge.exe	88
PID 1036 wrote to memory of 5372	1036	msedge.exe	89
PID 1036 wrote to memory of 5372	1036	msedge.exe	89
PID 1036 wrote to memory of 4480	1036	msedge.exe	92
PID 1036 wrote to memory of 4480	1036	msedge.exe	92
PID 1036 wrote to memory of 4480	1036	msedge.exe	92
PID 1036 wrote to memory of 4316	1036	msedge.exe	91
PID 1036 wrote to memory of 4316	1036	msedge.exe	91
PID 1036 wrote to memory of 4316	1036	msedge.exe	91
PID 1036 wrote to memory of 1596	1036	msedge.exe	93
PID 1036 wrote to memory of 4164	1036	msedge.exe	94
PID 1036 wrote to memory of 1596	1036	msedge.exe	93
PID 1036 wrote to memory of 1596	1036	msedge.exe	93
PID 1036 wrote to memory of 4164	1036	msedge.exe	94
PID 1036 wrote to memory of 4164	1036	msedge.exe	94
PID 1036 wrote to memory of 5052	1036	msedge.exe	97
PID 1036 wrote to memory of 5052	1036	msedge.exe	97
PID 1036 wrote to memory of 5052	1036	msedge.exe	97
PID 1036 wrote to memory of 5540	1036	msedge.exe	99
PID 1036 wrote to memory of 5540	1036	msedge.exe	99
PID 1036 wrote to memory of 5540	1036	msedge.exe	99
PID 1036 wrote to memory of 4800	1036	msedge.exe	100
PID 1036 wrote to memory of 4800	1036	msedge.exe	100
PID 1036 wrote to memory of 2124	1036	msedge.exe	101
PID 1036 wrote to memory of 2124	1036	msedge.exe	101
PID 1036 wrote to memory of 4152	1036	msedge.exe	104
PID 1036 wrote to memory of 5888	1036	msedge.exe	105
PID 1036 wrote to memory of 5888	1036	msedge.exe	105
PID 1036 wrote to memory of 5888	1036	msedge.exe	105
PID 1036 wrote to memory of 5928	1036	msedge.exe	108
PID 1036 wrote to memory of 4924	1036	msedge.exe	109
PID 1036 wrote to memory of 3936	1036	msedge.exe	110
PID 1036 wrote to memory of 432	1036	msedge.exe	111
PID 1036 wrote to memory of 432	1036	msedge.exe	111
PID 1036 wrote to memory of 4876	1036	msedge.exe	112
PID 1036 wrote to memory of 4876	1036	msedge.exe	112
PID 1036 wrote to memory of 4876	1036	msedge.exe	112
PID 1036 wrote to memory of 2976	1036	msedge.exe	119
PID 1036 wrote to memory of 2976	1036	msedge.exe	119
PID 1036 wrote to memory of 3584	1036	msedge.exe	120
PID 1036 wrote to memory of 3584	1036	msedge.exe	120
PID 1036 wrote to memory of 3784	1036	msedge.exe	122
PID 1036 wrote to memory of 3784	1036	msedge.exe	122
PID 1036 wrote to memory of 3784	1036	msedge.exe	122
PID 1036 wrote to memory of 5768	1036	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://FEIYANGGECHANG.COM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff4709c188,0x7fff4709c194,0x7fff4709c1a0
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,8172363928603223377,12600428968585645213,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,13973686479693335131,13446866982752686813,262144 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,15108744390195140033,17055878487491744526,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12799064731376843336,11540544305086120673,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,4167873075808314208,893836072470995312,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,11194651308609651132,12510504453987220649,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,15124668474866058171,16926415231560891574,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3928,i,9911013370046036157,740831605697919851,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5232,i,10889992604597949971,7497850124586754738,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13753377107655720017,17687209596933987595,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,11607791605896421295,1239472431876167321,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10554107609411683172,9852176882544637271,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10554107609411683172,9852176882544637271,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6172,i,9335790502742339568,1406116034717969282,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,14961672825533111011,6360665876216256339,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,12920812015439333478,2495285158735214110,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,12147803665688402429,12240976941562710602,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,1085132672599428492,1351377532749625696,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5404,i,4025967200047171760,14789710271221981967,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16701239862374696807,9807120786684294005,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,7806506281778826433,2322279626689642313,524288 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5996,i,377330201200127206,17900714010167673498,2097152 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5476,i,2073031215915144421,10706698603464791461,262144 --field-trial-handle=2228,i,6020725493727551787,1500795980059410608,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 146B
SHA256 230d33f4234f994b834cc22328b7bd4f30e6372d05536475a59e8a659e0e633a
MD5 4702da03d26daa20d8f98ba0d29d12a6
SHA1 acb519aa72238cd07e7b725479886613268a55c6
SHA512 f922cfa07fa885ce1cedf313491d76983426b56b20dda73d45281c08f76af2915f30bbd4ba1b895d6d913ed4d5745d9a4ffe91920e63cf6ea3f5df7edb3073f1
TLSH
T1EBC02BD844C5C31BA31CE84B4268530D96D0330F8BC4650F0328C54C3083484E2D75D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9677d4b236c1f25731fafbf3fc77b729ce374a0083d7a07034b24a499d1e15fa
MD5 2ad0d9a116a10bcb47a8a0c06d8e866a
SHA1 5daf66b0d9b1c5553d247662f58c2f9aa46576a5
SHA512 8c07c40b27386d9a01c02c2b6b4031e2abff3b942bfc488ea787abfb7ff4a825134e3a3c2a153b9b40451efd91c95c9162182f7b3cd4d51a41dbcaaba0a4a719
TLSH
T19D612B1836CE007EE7538EB9E1EBD2013FF191B47A4B8E41E6C4F87DA926F314468804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593ea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593ea5.TMP
Size 3KB
SHA256 a8bceb29ed18332b59f86900a660fca4b226fadcce9add6ef84cd48cdd9452af
MD5 ed706470e5778c203a6a74ff977cac18
SHA1 facd6f4a81cded78d97241fa3949743e94a846f2
SHA512 445f48af9b3dee07a607ecc6b4e6dff64db1bd95b272e53c8bcb5b2ce75d66a32edd93aeaecad8893c634cf97ea592e06d0af130f37e795e98cae7674157b23d
TLSH
T175613C1836CE007DE7538EB9E1EBC2013FF191B47A0B9E02E6C4F87D9925F314864804
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7ca5a612c8c1a61e8514833df50c2d93656873184021a477d5eab3493f2c2396
MD5 335a691bf7d66d3a2f0e99e4ea162ff7
SHA1 c207cd1c9f3be4f68851aee0e674373968d455bc
SHA512 ed91869b423a3c0abadedeab4ab39192e01e302d232a502ecfc7db960859eba1aa03ace568999665d0db0c25bc5b3d42a50ebc58776a83cc7388b8fa7f2065b5
TLSH
T1D7115BF7C3D5856E8A4116F06A24AE1BDE2D0506831C7C1585D4EF2BD3E3075D10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5d4f8a692964ab29f0821a2404c75a36ed6e6859ddfbb77552fa6ae4a93cace8
MD5 1f4f70283eee02a752364c7c7a892286
SHA1 06eb4d0f2fc0fea5e55bd397dd888954a0fc67d7
SHA512 6ea78730f5583876205ac26c1c6859d7427792d647310b0070e417c0fa32659c5564c65c29adadbb4ed296b88fd6f83d1349340a1d60ca9c85eb5ae490a99f65
SSDEEP 192:sxZgR1k7/fcsuPWyIdpLOHhi6+WNGYwKswkIgrJ:sxZgE7/fcsgW7KH5Gz9
TLSH
T1F522B7166F28997B4CC7E219BB25BB13D6F9503291D41E58E6FC861C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e93237249e1d102498c126d5fe936e16bd98e36e80235dc4977f6eaafec6063f
MD5 115679fe1ef79828eb492ee5137ee2e7
SHA1 6bf87099d34161c20b083a5a44f43b1b179039b2
SHA512 161b39716412ce4a36b42efd5a58b0bc081cbdc4ffb604170702e745a17b34f1a6fe2916765d65dac9a736c2035030aeecef339558a2a8abd7a3a5e4aef0cd71
SSDEEP 192:sxZgR1k7/fcsaPWyIdpLOHhi6+WNGYwKswkIg5eJ:sxZgE7/fcsUW7KH5GzU
TLSH
T12022B7166F3899BB4CC7E219BB25BB13D6F9503291D41E48E6FC860C05E6ADD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 919f275f46bca2641ff9b17246d8b9d5b8642d9318cf39a0904889ab146f9092
MD5 fe39a414155439602b54d2748e0e0a7f
SHA1 fc13bf82890f82323c1a29dfc76b53a66cee50f4
SHA512 bd769e00307e67445a5e9cbff3b58ce777b2a1ff56a9981a6d4d5e574f730d991ce9dfdbed81eae7f8e02d4449aca54f30e22046346d0340b00cc76720332d45
SSDEEP 192:sxZgR1k7/fcsaP9yIdpLOHh+6+WNGYwvWwkIg50J:sxZgE7/fcsU97KHNGQ+
TLSH
T15E22B6566B2899BB4CC7E209BB25BF13D6F9503291D51E48E6FC870C05E6ADD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b8d02b493fba4146935f6cdc4840563416c08dc9c40ee4b32dccfa49d562f5c9
MD5 dcdb85a5771c4c148fa2df479ba6e7d6
SHA1 4e110cbf7ecda5ee8736f94ecb3171710d2e43a2
SHA512 c10e8d4a1ec1906485907454e505ee1c6a62afb653cd8084ebd976e05f10bbae243e4768653f2cbee04c3b9073aa7860cd577c6b812bb63dee32a3eca9066850
SSDEEP 768:vdmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DUrofqDaV:vdmjYDmWvmKyEu1jakPLZQD/CG
TLSH
T107C2EA3B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4047FA954C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59da0a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59da0a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 715a6912ef7a7a99d213c551150e0997bea848d8e1be2df168e78a64b663ddf6
MD5 6af7d3e55295b60784d4d7cb7cb38c4e
SHA1 41988afe225f5511b6e57f3546d4846c0e3914e2
SHA512 b751fa6852bc7f6eec5ef74369784c26fcfad7b5a1f31db2b3e100527841657c7e2b52571275b03dfbf13cdc5d8855c302b4f43ccbb822125daa0bf85d20a74f
SSDEEP 384:yZcIhsNsXiU17f+k82EXH+2rFWScjmw1r:AhrrIHlZW1jZ
TLSH
T1A4927C36AD789C6A99E2A546F48726238FF85163DBD45B84D5FCAF0D00D99BC130B832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b39b7883f39cd64d5e8d1f67da735774cbdb3ff4cb6a2625c3f1271adcd702db
MD5 89d7b0ce0ba1824e4946a78402d7f8dc
SHA1 a1d41ed1b18a42be197017d4a84597f6683ca308
SHA512 ecd66396171f73d9a6dafc2775a72ebdcb9be61edd55ebf847dc84881f4e94a57cce2b2b3e331df8a926083a3858faac07afda8a0fc6842778e0241b359b2bd7
SSDEEP 192:EONq6hZ0QmiUyOBpc/+jVWjzor2tn5wOZkRU6:EONq6o/pu+k82A2UU6
TLSH
T1FC02EA3969786CB78EE2AE45F48727135FE4117BEA956F84DAE81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9eea14cba6ff33b589fdef76fc64be8526cebd7178284bb4ce6facfbba95e281
MD5 6d79d920b3ec2ae52ee0f0399bdfc81a
SHA1 32ff2f2a98f5580adff25f2804668df3ff336290
SHA512 3746b52338b8828de95cc7b3014e462fdd33526c7229591d5485482db757f00e4e6a8cceabdc842a92b675c6e5ea3cece1f791f532453e9a307fa62ea414ce3c
SSDEEP 384:1ZcIhsNsCiU17f+k82EXH+2rFWScjmw1r:Nh2rIHlZW1jZ
TLSH
T14B927D366D789C6A99E2A546F48726238FF85173DBD45B84D5FCAF0D00D99BC130B832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1431b298bd85d2b12a4eb40d39259ca4d49d1c261786fe00f90c048bcf1f1680
MD5 3b5d14849a946905f779edca5715b6a2
SHA1 05f9e6a20a20977bf07dbde55106f31a6b2bb4b7
SHA512 3b527de1f7aef91101de21396486793fd54c4e653db290c6e424a2b81fc4af8715d9bf7e6c45129eaaf42eadedc5c71cae8b207329ca7c150533728d8377773d
SSDEEP 384:biFiZcIczsNk8TUNTUlIlCiU17f+k82EXH+2nFWScjmw1r:2FQg1wg0rIHlFW1jZ
TLSH
T172A25C335D68D87BAAF6AA45F44A2213CFF45173CAD5AB94E6EC9F0D00965EC130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa9644b2-381a-4819-91dd-3a2885cb749a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa9644b2-381a-4819-91dd-3a2885cb749a.tmp
Size 8KB
SHA256 d758c982ad40f0c322eb96afd945371a80ce773ac92f40da5b8753cd8d77acac
MD5 b323f02d9dcabea46db8e10631590445
SHA1 f614df77bddb9c7d6af19e8947f5b945b87b2a9f
SHA512 1d41cff846e75407ca2dac144f8c2010ebc875422c73eaa76faaa839da1703b8f8e5a561a0f0d613be3a14f698c66f1fc72080d9dd67f9510dfffc201ef8e180
SSDEEP 192:EONF6hZmQmiUyeBZc/+jVWjzor2t+XH+2q5cOq5qXU6:EONF6utZu+k82EXH+2l9WU6
TLSH
T1D012FC366968AC675DD1A655F08732138EE55127DFCA7F90D6EC1F1C00DFAAC234A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b81a9a5a-e5e0-4b2a-8943-5a70e5008417.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b81a9a5a-e5e0-4b2a-8943-5a70e5008417.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 14f0d9d1aee4d1d7e042c3a9098cd70256286789240fbae0a2095a75e0f303ed
MD5 768763938d5141c9d585116362fef1cf
SHA1 110948bad4581fc7876c2c97454856b1350e0f4c
SHA512 5c68cca37b7d175a83ed2657734ba42b6a8d56ecb8cd4711c33374149b4d9e80a0ef890d1577aeaaa7966dc27c640a6b3c16704cad178f2c1d4f4ccde83c65af
TLSH
T19C412B4966FE1148B3B76E5AAFF7A96E447BB8772E0AD06D10110E4F0623B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download