hxxps://www[.]bing[.]com/search?qs=SC&pq=B%c3%b6tcher&sk=CSYN1SC1OS1&sc=13-7&q=b%C3%B6ttcher+online+shop&cvid=07067b540e124c3ab8ada117ef9a5b21&gs_lcrp=EgRlZGdlKgYIAxAAGEAyBggAEEUYOTIGCAEQRRg7MgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBggJEAAYQDIICAoQ6QcY_FXSAQgzOTUwajBqN6gCCLACAQ&FORM=ANAB01&adppc=EDGEINJP&PC=LCTS

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.bing.com/search?qs=SC&pq=B%c3%b6tcher&sk=CSYN1SC1OS1&sc=13-7&q=b%C3%B6ttcher+online+shop&cvid=07067b540e124c3ab8ada117ef9a5b21&gs_lcrp=EgRlZGdlKgYIAxAAGEAyBggAEEUYOTIGCAEQRRg7MgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBggJEAAYQDIICAoQ6QcY_FXSAQgzOTUwajBqN6gCCLACAQ&FORM=ANAB01&adppc=EDGEINJP&PC=LCTS
Sample260925-mljpbazthz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348059953893130"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{648CDB30-E006-4BE5-A1A8-D61CEC5CEA4F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5140	msedge.exe
5140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2648	3780	msedge.exe	88
PID 3780 wrote to memory of 1764	3780	msedge.exe	89
PID 3780 wrote to memory of 3608	3780	msedge.exe	90
PID 3780 wrote to memory of 3608	3780	msedge.exe	90
PID 3780 wrote to memory of 3608	3780	msedge.exe	90
PID 3780 wrote to memory of 3576	3780	msedge.exe	92
PID 3780 wrote to memory of 3576	3780	msedge.exe	92
PID 3780 wrote to memory of 1844	3780	msedge.exe	93
PID 3780 wrote to memory of 1444	3780	msedge.exe	94
PID 3780 wrote to memory of 1444	3780	msedge.exe	94
PID 3780 wrote to memory of 1444	3780	msedge.exe	94
PID 3780 wrote to memory of 1844	3780	msedge.exe	93
PID 3780 wrote to memory of 1844	3780	msedge.exe	93
PID 3780 wrote to memory of 1316	3780	msedge.exe	95
PID 3780 wrote to memory of 3132	3780	msedge.exe	96
PID 3780 wrote to memory of 1316	3780	msedge.exe	95
PID 3780 wrote to memory of 1316	3780	msedge.exe	95
PID 3780 wrote to memory of 3132	3780	msedge.exe	96
PID 3780 wrote to memory of 3132	3780	msedge.exe	96
PID 3780 wrote to memory of 4028	3780	msedge.exe	100
PID 3780 wrote to memory of 4028	3780	msedge.exe	100
PID 3780 wrote to memory of 3060	3780	msedge.exe	101
PID 3780 wrote to memory of 3060	3780	msedge.exe	101
PID 3780 wrote to memory of 1320	3780	msedge.exe	103
PID 3780 wrote to memory of 1320	3780	msedge.exe	103
PID 3780 wrote to memory of 1320	3780	msedge.exe	103
PID 3780 wrote to memory of 2280	3780	msedge.exe	105
PID 3780 wrote to memory of 5796	3780	msedge.exe	115
PID 3780 wrote to memory of 5804	3780	msedge.exe	116
PID 3780 wrote to memory of 5812	3780	msedge.exe	117
PID 3780 wrote to memory of 4040	3780	msedge.exe	127
PID 3780 wrote to memory of 4040	3780	msedge.exe	127
PID 3780 wrote to memory of 180	3780	msedge.exe	128
PID 3780 wrote to memory of 180	3780	msedge.exe	128
PID 3780 wrote to memory of 5140	3780	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.bing.com/search?qs=SC&pq=B%c3%b6tcher&sk=CSYN1SC1OS1&sc=13-7&q=b%C3%B6ttcher+online+shop&cvid=07067b540e124c3ab8ada117ef9a5b21&gs_lcrp=EgRlZGdlKgYIAxAAGEAyBggAEEUYOTIGCAEQRRg7MgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBggJEAAYQDIICAoQ6QcY_FXSAQgzOTUwajBqN6gCCLACAQ&FORM=ANAB01&adppc=EDGEINJP&PC=LCTS
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc7cc1c188,0x7ffc7cc1c194,0x7ffc7cc1c1a0
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,12324122635484044910,12032067050275458638,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10544940540059891082,4408676888156105154,262144 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,13816890256825435916,4398486250776610499,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9416105164655196620,1419420535652854043,2097152 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8839383308193713425,8515209555090598370,2097152 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,15450184053092303266,18421879394767030358,2097152 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,12810788086815875321,2015126328326562349,2097152 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,18061691009182205908,6203215009447197642,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,53167595153564017,8073040829397080063,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5796,i,4458744954443343407,6273497258226477857,2097152 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4362893802079426864,7834899057437660132,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4362893802079426864,7834899057437660132,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,4688673149830157108,5870045680782348941,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,5979613510513362724,25209731912860950,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,16769740208563672810,16646216242829966210,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10259391552424219293,2454614402737411960,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,10097279984742417749,11797993532685192856,524288 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,4574275352235498505,4866855596221382183,262144 --field-trial-handle=2232,i,14691232596317717427,1303232068119075993,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6bfacb80e36157309f5b337e8656b3e37ee7f6c89e0077a75f9db599c5659e10
MD5 4b74ed6c89e5c75ce759e2da1acfb128
SHA1 6d2fe6ac21502f25edc0aef4d0e8916acfa3c03f
SHA512 6ace0c8ee1db90f1e05fdf23ddfb5cd243f4e22d501560613c4c8f0953595cbfc8f03354d6ce96c5e88369a165ed3fe36f6bc4cfdbfef590e5b730a442b6d869
SSDEEP 96:v56issBjr1htKmYFDssbm8tdDunQFcPIQZtSYpA:oidjrtYFg1QFcPCeA
TLSH
T19DA15F4052D288EAFB6874BCECD91D83B530E45F08931F421566DD3EB9367706DCB858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6f2ee62a3470ec7d9d4c08a2d0caaac216ad20cc964bf8ee78b32449dcdd7a07
MD5 e0cf665cae3868d60d4d827fe14a9fa1
SHA1 7459d65fd64888c51e4ef7f2b9cfd998804db91b
SHA512 e1c415e295b6d9aa1c065105bc6b317daccd8422bdfada574b7459067b29bf1ee8c5190d0c91822b3cd55d7c98dd5e02f2f34c179f2bb0d390be96c76f92c213
TLSH
T1C641CEF7C3E9865EC81516F09A287E2BCE1C0946831C3D1AC5D4EF5B93F6471E182A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 da525f79ac7d1b46ce88114b56a74bdc262232d1f90c9462ac808f89db3a074d
MD5 b2e47a549786b6e13eee7dafb2ddf3cc
SHA1 77094b346b5306db3c93f10d2fb85b7a1259c1fe
SHA512 42bd5530f2e40b13bef4c3dfd1304a1481beeabfaa6718d020e4181d3ac96cfa3e3a7101fcca3cf0ac9e3cfa213bed9dad939eac1d7d217d805dede1d550300c
SSDEEP 192:sxZVRcucBz8/fKsopdpT1tHW6+WNiU8/Yg4oHIgrZIxmTEd2/:sxZVZmz8/fKsoNrHbm/llIoWy
TLSH
T13242E7526A24D577CCCBD20DBE357F52D6F910229D911D9CAAFCCA1C04EA6FD120B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0f8b711cd8e3cf4cbc3b9352484427569a558d438cebbf86f71020ba17ad80c7
MD5 347a577b1c7ad2cf09f41a99a87a8939
SHA1 f1d433282ae94dbaecb1655a49a0f4428e23632e
SHA512 c2be3eefb25b65306d52e6e4dc8d90cf6e647ee498c388106dd7e84218858f0ae7835f372d6009ac51f82ca434d0cdc73eb97c549f8a5b532f477155f44d7651
SSDEEP 192:sxZVRcucBz8/fKsVpdp91tHW6+WNiU8/Yg4oHIg5xSZIxmTEd2/:sxZVZmz8/fKsVNZHbm/JyIoWy
TLSH
T1DD52D7566A24D977CCCBD50DBE357F52D6F910229C910E9CAAFCCA1C04EA6FD120782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a6438f400e4cb0e7208f14b42e8297ce9190c0b3502eb68285c6130b28217f8
MD5 741773622f0059da9e1f6bf14104d5da
SHA1 724f4e7cf320eb87103582679bc9a29be55cd168
SHA512 325c880b4e1f5300b44050623860b3b70dc1d596d2e229a5913ff5f4deac568e100854fea577145f40e49d377074f35bb2c68370ce0d3e09047c3712af4fd473
SSDEEP 192:sxZVRcucBz8/fKs3pdpT1tHW6+WNiU8/Yg4oHIg5xgZIxmTEd2/:sxZVZmz8/fKs3NrHbm/lsIoWy
TLSH
T18152E6566A24D577CCCBD20DBE357F52D6F910229C920D9CAAFCCA1C04EA6FD120782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 427648ebd1c739d9a970cecf4eeb711dbb26ccf870e38bb94cb89d6c7945f7e9
MD5 c96081000e376191aeb1b058629390ec
SHA1 699ca7ed6cf9f9a3bb909772a3a33f74d8b43690
SHA512 b3dc8f9f9d362143db0aa246037b43c3fa67ad6cd1d1179206221f71c922bb283b34985b9112b6fe3b7001704a2a5fa64f1a4770e14a4ebf2c217f636f10396f
SSDEEP 192:sxZVRcucBz8/fKsVpdpT1tHW6+WNiU8/YgOoHIg5xSZIxmTEd2/:sxZVZmz8/fKsVNrHbm/TyIoWy
TLSH
T13152D7566A24D977CCCBD50DBE357F52D6F910229C920D9CAAFCCA1C04EA6FD120782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 014d5edbf99dbd9eea25d068a12a53c61ecf3d2a3c18161a69dca668c67e9b1f
MD5 5fb2616ec5e9e414bcbf60f789a83a71
SHA1 8d4d83d3d09b746cb61904fbda9f0396005d3d5c
SHA512 1c17b9ea2624821654fa3ef35e7338081fa8bf59d940c045d327b4fac7ef4ca7e817ced8c5040d98f51790746c850c95be54e6c5aa94c4a5e03ec1a2ad53c69b
SSDEEP 768:PQichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzirovWx:PQichfPWvPZplu1jan+LKgz5Ox
TLSH
T104C2F93F640CCB7E4FC01A9DDD5A6F967EA802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bcbef93c05593cd4c5e3300783497d89e317897bce0550c3ee3359c9f49c814
MD5 0b8c68e3c57d696883f54759a2e07651
SHA1 14be76debccac948279555d6551f0960d90f8d05
SHA512 c8767c354006d0522cbda14e5e2f2954cd849734f8fa803fe3dfb2d573d6552b0548ad5b6d3d0f16ee269a5b554cc5d9db88e3e5ba902efbbbb4d01d96609e9c
SSDEEP 96:KU0AKtuuKWEKLCnEVAkSqaWcqzd6kWKCz6+WuMEbuEHN:yHPmEVAkSqa3qzkk0z6+jMEbuEHN
TLSH
T19A91550572BB1200397F249C81E1976F1E4635773598EE2BBF7C00A68D6AE541CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1118.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1118.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6c2ef68bb64012c953af5ca5ed7b884afb12a1a387fa264f049fd42044bcf2d7
MD5 9453e10e8cd77fbeaa37fdc7f71be404
SHA1 93e016d24862a1d10ab5b5548e9e75374db26424
SHA512 49f27bb5997c64787fc47e83293f6f177df5d2b0c677c2709c03f1162a1840de43fc31ef72c66b6aeaa48f41a1a0fae5dc0d8fed622e79105a07bf911693585b
SSDEEP 384:AiFiZcIozsNF8TUNTUlIldS52+unBGYX5EFcZJ8+StgOIwZOynol:bFQUYwgmZuBGYuFcn8hXsGK
TLSH
T1E7C22AF648F7887AD8EE5743A77D2D034EBCD027B584A650B399561CCC961BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 60883e00c9d0b701b47f696600771e7bc89c2858f8089331241fdd4e467c4f41
MD5 abc17c608396d5868925c88c4d6cf398
SHA1 e305b0161b437139c78038c121f77bc61755e4d5
SHA512 4d8bd8282ffedbc9d184d5bd235135b1f0b1997d592a8bfa61c8b75f6175eb95e7d602885bce2abfc04fb185b58c6aedd85e6ea8fc11cc31628833aea9e262c9
SSDEEP 384:MZcIhsN7dS52+CnBGYX5EFcZf8+StgOIwZOynol:ahdZCBGYuFcJ8hXsGK
TLSH
T16C828E7A58B89C7B5CEBA145F54B36034FF89027EBC8AB9095ED5B1D00DA198130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 67f3c599f4ad82b1b2c1258ba7aeadd9ee656d9bfb47d2dda4cec1af223cb33c
MD5 ccc1b6a4228e81239c9311967d8a5279
SHA1 d8ec4e76b335195c1dd1125e809750edf3a8dd53
SHA512 2cad0a3496469692b0175bf27a52730974acf248705f4d6fffec8d4d059d2497d2e90a05df600a2ea8d7624a25feaef4017ffd94d0bd198a4c6ae5811aa9c5d8
SSDEEP 384:fZcIhsN7gS52+CnBGYX5EFcZf8+StgOIwZOynol:3h+ZCBGYuFcJ8hXsGK
TLSH
T155828F7698B89C7B5CF79145F54B36034FF89027EBC8AB5095ED2B1D00DA198130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 78fd81611358d9cadd644b4950869ed280f3559650702c75eab125da4fa4407d
MD5 e5e9d1b569be05619564e87457b02b48
SHA1 a741b1d6e174f58e68ab3028cf488133bc216941
SHA512 5b33b2bc76443d9214890f7d6e679174cafb626ae1eefdc5f247673835bd2111f35ce97d538f8e535de059c35516715329784635b62da02440b33a9b700dcbe7
SSDEEP 192:LJONu6Dph/qQmiUyQkwVwGYX59ezkCERtZakII8+U/5hU6:lONu61Y1XVwGYX5EFcZr8+SU6
TLSH
T1C6120A39A8B8AC7B1DD3A955F48B35135EE8512BEB84BF40C5DC1A1C01DF69C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 697d162ae1e5677a9331734c3b720bda0fac59c968f7d807c5038bd305d2ef3e
MD5 ba3bfd69d5168deaabdd9df468268496
SHA1 78293432918a4eac6648527eb18f3932286ed156
SHA512 f1fb1441463292d4351659bc0f8047eb73d8dd2e1a9f982347e49fd9e138add204a26448156e79e65c3597c603a7ae534f3adbba1c7fcf3d2d23a7f406185a5f
SSDEEP 192:LJON06DphmqQmiUyWwq8wGYX59ezkCERnkk78V0MU6:lON0619GRwGYX5EFW8WMU6
TLSH
T15202D839E8787CBB4DE3AE45B54B26135FE8212BAA956F44D6E81E1C00D764C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1aa099b9504472c5d871d40791c4303fb735cb0f6b60b37cf4158def446a8ff5
MD5 e6f99a0414df588cf76aca621f27e3eb
SHA1 46d8b9cfd31b00f89183983d65ddaf398e9a00d9
SHA512 8ccd7131afc80a0c9865cbfd6c5e2e6ee2ebd6f38da9a667fc792a82e1f182de3040f3b55a3f8b886c5b8a69e10f71a977fe208144b47070974e6d3f1f12c590
TLSH
T144417D5DB6F91108B3B76E5A9BF6A85D447FBC332F06C09E00110D8E0A22B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download