hxxps://www[.]bing[.]com/search?qs=SC&pq=b%c3%b6tcher&sk=CSYN1SC2&sc=13-7&q=b%C3%B6ttcher+online+shop&cvid=ce99a9995f744c2a954012c41ee930d8&gs_lcrp=EgRlZGdlKgYIARBFGDsyBggAEEUYOTIGCAEQRRg7MgYIAhBFGDsyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBggJEAAYQDIICAoQ6QcY_FXSAQgzNjE4ajBqN6gCALACAA&FORM=ANAB01&adppc=EDGEINJP&PC=LCTS

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.bing.com/search?qs=SC&pq=b%c3%b6tcher&sk=CSYN1SC2&sc=13-7&q=b%C3%B6ttcher+online+shop&cvid=ce99a9995f744c2a954012c41ee930d8&gs_lcrp=EgRlZGdlKgYIARBFGDsyBggAEEUYOTIGCAEQRRg7MgYIAhBFGDsyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBggJEAAYQDIICAoQ6QcY_FXSAQgzNjE4ajBqN6gCALACAA&FORM=ANAB01&adppc=EDGEINJP&PC=LCTS
Sample260925-mn75pade24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348062803570076"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{49CA8E3C-3F0F-43EA-9EC3-8FE08B79A310}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5616	msedge.exe
5616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1284	984	msedge.exe	84
PID 984 wrote to memory of 2040	984	msedge.exe	85
PID 984 wrote to memory of 4360	984	msedge.exe	86
PID 984 wrote to memory of 4360	984	msedge.exe	86
PID 984 wrote to memory of 4360	984	msedge.exe	86
PID 984 wrote to memory of 3708	984	msedge.exe	87
PID 984 wrote to memory of 3708	984	msedge.exe	87
PID 984 wrote to memory of 2360	984	msedge.exe	88
PID 984 wrote to memory of 2360	984	msedge.exe	88
PID 984 wrote to memory of 2360	984	msedge.exe	88
PID 984 wrote to memory of 2112	984	msedge.exe	89
PID 984 wrote to memory of 2112	984	msedge.exe	89
PID 984 wrote to memory of 2112	984	msedge.exe	89
PID 984 wrote to memory of 4676	984	msedge.exe	91
PID 984 wrote to memory of 4676	984	msedge.exe	91
PID 984 wrote to memory of 4676	984	msedge.exe	91
PID 984 wrote to memory of 4536	984	msedge.exe	92
PID 984 wrote to memory of 4536	984	msedge.exe	92
PID 984 wrote to memory of 4536	984	msedge.exe	92
PID 984 wrote to memory of 1892	984	msedge.exe	96
PID 984 wrote to memory of 4332	984	msedge.exe	97
PID 984 wrote to memory of 1892	984	msedge.exe	96
PID 984 wrote to memory of 4332	984	msedge.exe	97
PID 984 wrote to memory of 700	984	msedge.exe	98
PID 984 wrote to memory of 700	984	msedge.exe	98
PID 984 wrote to memory of 700	984	msedge.exe	98
PID 984 wrote to memory of 4336	984	msedge.exe	100
PID 984 wrote to memory of 5984	984	msedge.exe	117
PID 984 wrote to memory of 5984	984	msedge.exe	117
PID 984 wrote to memory of 5984	984	msedge.exe	117
PID 984 wrote to memory of 6032	984	msedge.exe	118
PID 984 wrote to memory of 6032	984	msedge.exe	118
PID 984 wrote to memory of 6032	984	msedge.exe	118
PID 984 wrote to memory of 2340	984	msedge.exe	120
PID 984 wrote to memory of 4752	984	msedge.exe	121
PID 984 wrote to memory of 4548	984	msedge.exe	122
PID 984 wrote to memory of 968	984	msedge.exe	125
PID 984 wrote to memory of 968	984	msedge.exe	125
PID 984 wrote to memory of 5028	984	msedge.exe	126
PID 984 wrote to memory of 5028	984	msedge.exe	126
PID 984 wrote to memory of 5692	984	msedge.exe	129
PID 984 wrote to memory of 5692	984	msedge.exe	129
PID 984 wrote to memory of 5616	984	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.bing.com/search?qs=SC&pq=b%c3%b6tcher&sk=CSYN1SC2&sc=13-7&q=b%C3%B6ttcher+online+shop&cvid=ce99a9995f744c2a954012c41ee930d8&gs_lcrp=EgRlZGdlKgYIARBFGDsyBggAEEUYOTIGCAEQRRg7MgYIAhBFGDsyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBggJEAAYQDIICAoQ6QcY_FXSAQgzNjE4ajBqN6gCALACAA&FORM=ANAB01&adppc=EDGEINJP&PC=LCTS
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff972c8c188,0x7ff972c8c194,0x7ff972c8c1a0
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,2079633884306182636,7671239806343304003,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6940230461704818761,14066190661617572844,262144 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,12989653960388108910,1976989112773425005,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,13777123763448449542,14460062321073464746,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1773965081786920400,11103000330699381873,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,6574641467847892055,5116003720697836435,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,1278735767721986343,1177231173113560205,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3938782982005355750,8743691252451823655,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12808856791922965193,17598346584815143786,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5948,i,17279666067504265893,5209347282797490133,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,12242216426316699923,18422713295893702849,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,12242216426316699923,18422713295893702849,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4464,i,11026865550803864788,14465625870072304781,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6480,i,13192196891643894450,12880134607835312208,2097152 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,13479838012935899745,13378655783165662968,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,12339919237556992261,11810895787135541403,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8427496847561115073,4216025042462513943,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,11059338853406183641,14567208729527084274,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13511379182486534255,6532472073446043617,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2119378038078832109,7744155879002396761,524288 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6932,i,14044346402119545336,16313639668123087899,262144 --field-trial-handle=2216,i,5255073232873832832,1785751402193836132,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4d0e5bbb864115823b70134dca855e4d0077dfad5a94574d2a16e63f0ffd03d4
MD5 0e685ea0b36fd5aff0f401fb6b4277c5
SHA1 2808b83fa58babc994333f8f30fa5b07fc79b644
SHA512 f93a39fd1784f94ce2659fdb5eadc870634bcd9bea57ea4bb92bdd32819a3ecf63af8f90852d1a390f449b5f8d8d01407402e19018304ca8cec4682b84d20cbf
TLSH
T140E020DC25CCC22D63046547827C9B0C83C4371EA6CCAE151700CDCCB40144462C7A71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f7db1c85edd89f33be30a1ebb9792a17c9310bf7f655029f153c43ae826c6fd8
MD5 a2c1e4ae326c81ea9fe2af9cf79ee8d6
SHA1 e81f5a600297732c6c6ebb236adf7ae22661ba3e
SHA512 3ea626ee383c05cb170d70f6809fc8ee308e0c71b1008d23a686478d562e4e1406cdef02265f4ae03296a77c86a211d28cbcb4514bb99d32a5104f6f67e3a20d
SSDEEP 96:yEzUxsGqah2rM2uLQVncNerMLsDA1QeTwCfK:xUyGerM+nr44DAmeER
TLSH
T14EB1DD429E4353D8FBE532B4A1D19FFAF534019F6E332F2AC596CA3264077519EE8062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59a5eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a5eb.TMP
Size 3KB
SHA256 e3c85fdb1eaf907b77b502582e94807e08084a37938f17edb23674925979dfe8
MD5 dda540c63d4e730cca640f82ee2f369c
SHA1 56291612d78726b30382de7bf3154dc6eef8b5c2
SHA512 d03174fa90c3c73d90af24abfc71df66514196964c38dfc81185a2d540fecb0bed54b317f0582fc6b66079cd0d956ccb4d2edb8c770ebb94dd5d363d8ec7bcc2
TLSH
T18A615E83D34342E9F7AA65B095E29DDB3A34909780433F3EC8C8CA79A407726DA1D077
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 76d7f858dd62cd190f98d9d6216cecd44879e055def084b3e82bca586b2924da
MD5 8c5a2895bb7318b79f4ba37bcd4c725c
SHA1 c30b01cea0da1a29e768296a9aef43e5b713c848
SHA512 eb32da58c0a62d9eaf4e7089f8921c91322c677f82cee4ad2426a147998daa40d35c56b1d5bdc674f51134c6efcbe1da66ea91bc17e2271b765e910fbcdf22c0
SSDEEP 192:D47gHIvAv0v3varfpfJf6efPeBID5OwiRmGk9iUqe3V8OY837UAEsbPdcCf7zEVF:D47gHIvAv0v3varhBCene2D5OwiRmGki
TLSH
T199228EF792E8CA6DDA2361F19E142E3ADE1D1858823C3C1EC5E46E1B97D2470D143A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c4baa152c4f31d56ba1852d03bfe1515dcb36fa3ab1ab3d5d5e446ee0efc738e
MD5 23a1904dec7dcba8f2ce8d08c2685e6f
SHA1 c36f76e18420ad0a0e4c46d3e802aede13fbb92c
SHA512 29b08f8d87b09d846de2b3b9de7c942e1b4031d99bd56f6630f8662626da8d7f73c952bd9f9edf9bd150907197c73cc302dc0d64cc6b1937a00604604d365290
SSDEEP 192:sxZiRwucBzR/fQsn46s2dpTK3HW6+WNiV6/YaTkdIgrxxmTEd2/:sxZiJmzR/fQs46sW0Hb1/GdoWy
TLSH
T1C242C6526A28E5778CCBD609AE35BF52D6F904329C911D9CAAFCCA1C04DA6FD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a86e4bc79a24a5bc86b25fd8d252f0bc385af2ff9afa3fad062916a299846dad
MD5 73838d7c974253f5e1c7dfb339140ba5
SHA1 86a4490e4ba25f60b1803fb9bd1f53ff9474c432
SHA512 efef21ed73c616174cf94e9e3ba3fadbd53f5b881cf15f5e2d393f839d6d1cffd641743cbfb633783174bdf00ecf357794a6f3b7757fa454d51ee7d05ef6c763
SSDEEP 192:sxZiRwucBzR/fQs646s2dpTK3HW6+WNiV6/YaTkdIg5qxxmTEd2/:sxZiJmzR/fQsJ6sW0Hb1/GooWy
TLSH
T17B52D6566A28E5778CCAD60DAE35BF52D6F900329C911D9CAAFCCA1C04DA6FD130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a434ddf8c9d91c6f35715453b3322935bd705fe0ada28932e668ae4e293cefa5
MD5 8b184f027b5078f2e7088e61cf04f27e
SHA1 6b9dc6b7824dedb33b9b1627195f23cdc4db4208
SHA512 74382e646e1d95c680ddf0e33e5e330e8b896cdfd9ce653bc6986696b5937e7ccbd4c1802232a48540e68d62cc8f1242876bc8c4e6a561c3fe96b10e96ae1c91
SSDEEP 192:sxZCRwucBzR/fQs644L2dps+fomP4HW6+WNifLXYapkdIg5AxxmTEd2/:sxZCJmzR/fQsJ4LWQHbSX4KoWy
TLSH
T17152E7566A24D5B78CCBD609BE35BF52D6F900229C911D9CABFCCA1C04DA6FD130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c9dedaa7bacfa6620412f28e092fd05cf90e442b245d84a7d59dc9dc6b2415cd
MD5 4e43b53d215d423da0eda206017bf7ec
SHA1 9e4dcd022ea4a4c23e9de70189815eecd975775c
SHA512 a874c374bbc19a81c82f3f7087490f6d5f15f88ecdd4d1ac3de16b3123336b95f7c02c69d186a97c935396d77fe020a32aec752c0bc5a840a8d69ff6eefc5072
SSDEEP 768:vcyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH34rovZhL:vcyQRbrWvvlpZu1jaXKLf33DvZhL
TLSH
T1CFC2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2746223fd47806334d4a5eb42540899252d8e4c4d170347a25c4d2b8b11b7a4c
MD5 d33148e7c575573f41ab8ee71d350661
SHA1 0d0fe479817ce6451a2eeec65a8d7c74de700cb9
SHA512 ba2bc79e4e5e8934b438da08e5f430666119a8ef5bf6b5d8effbccef4a2d25d9a7f7c91687cab1575c6e9259bafbe1fb5d6586cf8bdef7ce612e5898e52a25a8
TLSH
T17EA0025102640086D1041370E4870B886BB08D247705225356BC506C9C70358B662044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597da2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597da2.TMP
Size 48B
SHA256 d1bf5e8e55f09fa318f952a046c604cc14a716c9543d6d1a385f9c91d0748a81
MD5 83e4472a5e7397a0df5a1292c5c830e9
SHA1 02f0a0328247c0c1818193e0e21ede173ecd6d9f
SHA512 d59624d337e0123a7815d5932d7d15354c91dbf407f8b9e0259e4b47667e2821da2a18eae5ab4c0365e1c79b8d66bf112bce9cf56e38fc243efeb3d723094bc0
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b5ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b5ba.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e15bfcf790ba334ed5b6f6b25de1ad7fc3d0d48f4043a9fffadad72be9a39a82
MD5 fd349190ed66af1746050bcf0fed69c5
SHA1 b5e7ef43bc5d3b2234f41243bc946762e8a54273
SHA512 8aa899783244f01597ba3b4c4391c4d87b51049b6ad531745e8ec99b1a7bfb3689b64507259c6829a5425080462bbd886ad9a12d26e4a06a580a1b4f773823bc
SSDEEP 384:HZcIhsNIQpdfTp5u8ipaiNagcdf5iNcmjoa:vh+bkpUgcXGR
TLSH
T104829D326D386C7B6CE79556F44B7A134EB880A7E7CC5B80D9EC572E05EA5D40307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5274cb4105b084b1ee976fe32b02d7f61eef01611e812c3723f92c2ea42ab857
MD5 55093e718c95aea8f27b2b861cdbf161
SHA1 73723f3490b1b6eb0b0e4fd13610f2f84aa8336d
SHA512 b53b40777d12f97c4c42f21b30bcac9d8e52d1f71c26730bc655c7fe6af2e21b79c15bcf402c4d607b74e106578f35c5b9cb654083f63082db6a44c6bf108272
SSDEEP 384:TiFiZcIzzsN48TUNTUlIldpdb02p5u8ipaiNaXcdf5iNcmjoa:+FQXlwgn0kkpUXcXGR
TLSH
T145C219F259E7983AE8AE4B47A77E3E124DBCC067F6849640B7D8461DCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92130568cf47ebffef5b888d28c5748cc73a33b26d86782f06976af669eba8a7
MD5 3d30c6c33d93ab83a82056606ca6c767
SHA1 0b846057acbdfbeb1da5e825ac2caa9fa02b8254
SHA512 b16cfa4d25950a2d74dc4ae29d6c08ec19c01a348b0cc00cc5b5d2fa5f2186bbd6547fd31d96ca400d3679c9af5948db7f5a5f1ea770122735c4c66da80342a9
SSDEEP 192:SONH6iDCQmiUyujHq5u88PpPCPSqAicU6:SONH6/HHq5u8ipaNKU6
TLSH
T13B02F739AC787C7B9DE3AD15B58B7B139FE9116BE6941F84DAE81B1C00DB68C1303522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 caa51524fdeea1710681b798dcebe945ac829860e241dcddbac7c505031542cb
MD5 7db814e017345cbd110f95ca90dfd7b0
SHA1 a0d48120a68307455ddb590e921b27024ad88def
SHA512 2b0c1f4cea201c8503c399e25337535134ac54cb3b74e876df1be64e75e0078fb210746954735ef3ae1125a652bee3f707c0b1869d31332fd5c9adca31f48cd7
SSDEEP 384:XZcIhsNIdpd602p5u8ipaiNagcdf5iNcmjoa:fhs0kkpUgcXGR
TLSH
T186829D326D386C7B6CE79596F44B7A134EB880A7E7CC5B80D9EC972E05EA5940307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b8c189ba44189081b2f6e51b153e8ecb654709b98eeb796ea3487a58be221f2
MD5 2b2bebb1a680eae42fa534181f8a3316
SHA1 5b31d3f4bebd44aafdbbab06355e82d8e69930f5
SHA512 c030b4fb3e267c20cf2c8755d38e617d523ac4d0e51dd9613a32e40fc445820bdd7413bae38732484877348c8b6c0d2cd791de9d415ee4e05a7752028cd08985
SSDEEP 192:SONZ6iDPQmiUy+jBq5u88PpPCi3daNuZ+/oEU6:SONZ6wNBq5u8ipaiNaUcU6
TLSH
T12512293AB878AC7B6DD39961F44776239EA4426BE7886F80D9DC172C01EF5D81307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 61885267bff397e63a6ab28b14e05a5e2d5624facf648b1224681d72cd77da73
MD5 7e95e2756ac27ccd089bc03e2f1511e2
SHA1 b1980660d4542fd5a9ca04305dba267c6cd16a3e
SHA512 2996c2ffe82c0f4e820cea49d6dd472927e990097ca28b8182db40f3fd87f0f0394f426a974480ee71d064e40833cc4442f6ef71bb945242ca33b88514119d59
TLSH
T1EC41E698BAE91148B3B76E5AABF6A8AD487F79772F06D09D00110D4F4A36B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download