hxxps://flachshuilar-gugge[.]de/wp-includes/theme-compat/csihgft/zcqdybp/ukfhybe/bak/index[.]html

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://flachshuilar-gugge.de/wp-includes/theme-compat/csihgft/zcqdybp/ukfhybe/bak/index.html
Sample260817-e1cwbatanc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314142533546001"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{32B6774E-4D20-47E4-B216-18D790E7FFBD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
212	msedge.exe
212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4456	3320	msedge.exe	86
PID 3320 wrote to memory of 3652	3320	msedge.exe	87
PID 3320 wrote to memory of 2692	3320	msedge.exe	88
PID 3320 wrote to memory of 3652	3320	msedge.exe	87
PID 3320 wrote to memory of 3652	3320	msedge.exe	87
PID 3320 wrote to memory of 1736	3320	msedge.exe	89
PID 3320 wrote to memory of 1736	3320	msedge.exe	89
PID 3320 wrote to memory of 1492	3320	msedge.exe	92
PID 3320 wrote to memory of 1860	3320	msedge.exe	91
PID 3320 wrote to memory of 1492	3320	msedge.exe	92
PID 3320 wrote to memory of 1492	3320	msedge.exe	92
PID 3320 wrote to memory of 1860	3320	msedge.exe	91
PID 3320 wrote to memory of 1860	3320	msedge.exe	91
PID 3320 wrote to memory of 2612	3320	msedge.exe	93
PID 3320 wrote to memory of 2612	3320	msedge.exe	93
PID 3320 wrote to memory of 2612	3320	msedge.exe	93
PID 3320 wrote to memory of 1884	3320	msedge.exe	94
PID 3320 wrote to memory of 1884	3320	msedge.exe	94
PID 3320 wrote to memory of 1884	3320	msedge.exe	94
PID 3320 wrote to memory of 3720	3320	msedge.exe	98
PID 3320 wrote to memory of 3720	3320	msedge.exe	98
PID 3320 wrote to memory of 3720	3320	msedge.exe	98
PID 3320 wrote to memory of 5080	3320	msedge.exe	99
PID 3320 wrote to memory of 1692	3320	msedge.exe	100
PID 3320 wrote to memory of 5080	3320	msedge.exe	99
PID 3320 wrote to memory of 1692	3320	msedge.exe	100
PID 3320 wrote to memory of 3596	3320	msedge.exe	101
PID 3320 wrote to memory of 3596	3320	msedge.exe	101
PID 3320 wrote to memory of 3596	3320	msedge.exe	101
PID 3320 wrote to memory of 4436	3320	msedge.exe	103
PID 3320 wrote to memory of 1116	3320	msedge.exe	105
PID 3320 wrote to memory of 1116	3320	msedge.exe	105
PID 3320 wrote to memory of 1116	3320	msedge.exe	105
PID 3320 wrote to memory of 2440	3320	msedge.exe	109
PID 3320 wrote to memory of 2260	3320	msedge.exe	110
PID 3320 wrote to memory of 2508	3320	msedge.exe	111
PID 3320 wrote to memory of 2284	3320	msedge.exe	112
PID 3320 wrote to memory of 2284	3320	msedge.exe	112
PID 3320 wrote to memory of 2284	3320	msedge.exe	112
PID 3320 wrote to memory of 1112	3320	msedge.exe	114
PID 3320 wrote to memory of 1112	3320	msedge.exe	114
PID 3320 wrote to memory of 3432	3320	msedge.exe	115
PID 3320 wrote to memory of 3432	3320	msedge.exe	115
PID 3320 wrote to memory of 3432	3320	msedge.exe	115
PID 3320 wrote to memory of 3564	3320	msedge.exe	124
PID 3320 wrote to memory of 3564	3320	msedge.exe	124
PID 3320 wrote to memory of 3564	3320	msedge.exe	124
PID 3320 wrote to memory of 4600	3320	msedge.exe	125
PID 3320 wrote to memory of 4600	3320	msedge.exe	125
PID 3320 wrote to memory of 4600	3320	msedge.exe	125
PID 3320 wrote to memory of 968	3320	msedge.exe	126
PID 3320 wrote to memory of 968	3320	msedge.exe	126
PID 3320 wrote to memory of 968	3320	msedge.exe	126
PID 3320 wrote to memory of 212	3320	msedge.exe	127
PID 3320 wrote to memory of 2192	3320	msedge.exe	128
PID 3320 wrote to memory of 2192	3320	msedge.exe	128
PID 3320 wrote to memory of 2192	3320	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://flachshuilar-gugge.de/wp-includes/theme-compat/csihgft/zcqdybp/ukfhybe/bak/index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcb753c188,0x7ffcb753c194,0x7ffcb753c1a0
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,6849846278252491078,6606351402370968480,262144 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,5429988264367183857,14209408401380268867,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,1349263838583639287,18077936287427758407,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3773496370123490229,18351982349788027257,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8029380074359263259,12971201139582747018,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,12363509698225070092,15932019216711722792,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10042827933990092700,12994539546156631192,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5144,i,4977678999815590869,17156209473281375108,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15371885180650536686,453501998918983478,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,1297466350241215717,3235958085209696212,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5536,i,11731423773700726301,456449936831466843,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8309773193837592119,7750038270609520217,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8309773193837592119,7750038270609520217,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5236,i,1050854924476314413,7740653174440794622,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,5223874857902585138,11223373634339533382,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17581349917563740930,15824371223394150110,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,1360322675828986598,11499354060281256765,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2948,i,5644153457616060586,11051245663764025648,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9634273621817846862,1151589583937626806,524288 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5204,i,5398216247346904811,18195675911430599823,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3644,i,9875920393221658962,7921552344587795911,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6368,i,8065921687993185213,4996016732737032304,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6348,i,7350338690544070028,16390121926247832840,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,10175656658205362735,2869356177406752763,262144 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3608,i,14490226322193051272,14986929883310273411,2097152 --field-trial-handle=2288,i,17102949163386465146,6103916831732880672,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7d9a7f271c1daaed73ba0da2ce58c09f9f26d9391084c57572dd3a587cc02cff
MD5 ec65b3fbc0ecafff47e2bc9eec1c78d7
SHA1 44f19c8ceb63150c809101251a938a6ebeb00107
SHA512 b873feec660aa2c0d39fe6812ed2253c00956db5f30f7311cc2a03c313be3d7be4470630c5e1f18382dd170dd2829886851c17efc19cb9ebc095999e0fc27a38
TLSH
T14461E5BE0582EDF6E3D13A3190C03A8738F191E8FD63FD5D02E348B5640AB118A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588cda.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588cda.TMP
Size 3KB
SHA256 f3d604f80ce49dc37d7debcb667a4a407c7c5429c2b0712daeb99a69a7fe4e4a
MD5 d81d4a86f1542c855f9fa26b668e80de
SHA1 6526c0ac56ed750ecc02011c3466961ca72d21b4
SHA512 67832d6049402b88dfd1857cd2d4bbcb85c453726063e8b70255c4d0107e5a6be18bba611be2750413f5bdd6239e3de132588c0b52d93746ade77f44b6c55e05
TLSH
T16161C3BE0586EDF6E3D13A3190C03A8738F190E8F823FD5D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0dd90d7a59103dfddf16b6323e48e568955a84f222817028e5ed60f88f293632
MD5 56b36ced2ffa73e178ca4556d0dfc286
SHA1 db73236b6cb2e8d1475c3da41dd2c0c274fff770
SHA512 3508030c03f586936e8345d4c2f245df249e52a9fc245c74e48147dd206090b939a0058a71b47641c801f8879d88a6ef40e42c516104bd953665bd15879fd693
TLSH
T101115BB3C3D5856E894116F05A24AE1BDE2D0606832C7C19C9D4EF6BD3E3475E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8ec7f74484196df18b3e5cd2adbccc8def0b51adfa75db6337f9c5f26a07997f
MD5 1156401a52106bfcad342c5105443e8d
SHA1 57816fa20e8799c3b7daeaf0549432ed6e3cecd9
SHA512 537c0341d20e94bd70371959094657ba0a3b6b9b4b46ae4b7508b01b87ba5e77c54777d108b044b0ff145ed091d9118d9890ddc04ff16bae1911bd01bc6a024b
SSDEEP 192:sxZdMR6yM/jK1Ml8Mkk/f5sS6qheIdpgsHW6+WNGY9IK4NoIgrJ:sxZdMQMk/f5svqdZHbG29
TLSH
T1EA42E802AB346977CCDBD309FA457F53D6F9057292904E44AAFCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9650ae6144735446a79a33b322a373e2f46d1d3c47960235ff9e472ba460771d
MD5 2d8d1973eb9400b657dc11c8a83ef89b
SHA1 680145a5992edf69a7f4d7a58345b978ece16a8f
SHA512 7081a52bd9d08352e49eb83a38345c23adbccc0dca66521d79781bfe1497113d3ed58ac76481e4febc73d6ae475737b03d4b5b96bcaa0a999078db7be074b4b5
SSDEEP 192:sxZdMR6yM/jK1Ml8UQVkk/f5sz6fheIdpmMHW6+WNGY9INbNoIg54J:sxZdMQqek/f5sOfdnHbGk+
TLSH
T18552E916AA346977CCDBE309FA457F53D6F4457292904E44AAFCCA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 54f293231bd9b3674e724f708e4468caa29610988773cf835ef864467a67a1e0
MD5 71545dafe09a0a8a18d5483120c792c5
SHA1 f4315254f1b1f241a0fa01f4ca0d6e81f61fce91
SHA512 24f52c5988820e3cc85124d407657f960f480d8c7b91cc7c24d8621dc7714414be4782faf74d607718f51939391f5fbcc34d35b7f2be42ee3ac64b688d829e4d
SSDEEP 768:Vicv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNeroyg6ls:Vicv21wWvu+Z+u1jaeFLeRN1yVs
TLSH
T1A8D2FA2B280CCB7E4F841E9CED2A6F966ED801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2a8912bd8dfccb09f595c53c8b0d3c935201de54eec1418f0d9e78fc3c898e07
MD5 3f2d86b4e94ce1e4d9482fb32c3a2e49
SHA1 3e965fda2d41d741ae5f3467820931da5c8e4d2c
SHA512 3bcbab52a905378c569b3a44e0392b659e9585959add949ed7959cd41a6e31b8d631d200bfa9e0093200e6652007fd0f3277ceed1cb33438596d2fa1e566f29c
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaiiDIEi4IZJ0R0zcZKbwzyZfKypC:mTfHiiDIEi4IH0R4cewzy5KypsIqiabl
TLSH
T1CA91B601347A52C23C7F294C936A86765E4272637508E6BF7FB801A24E67E126CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 672d6c62060fce027128b82536f7567e32a4197f48ea95a64c751d51a5c5226b
MD5 162959467c82b00bf1b60aac4be6e163
SHA1 bd8c9f4ac5e6bad55d21be2ac141a5c38a8faad8
SHA512 bdf762270f6cb03d2349d4404f6812c3a49479d457b2c1115b61aa233afc5b19dbf3152f5dd719d0d3cbb7e7202c4c6db0c779218a73adcac47553e1bb1251c8
SSDEEP 384:4ZcIhsN9erA9fziTqJe+CXOmep3JroH5OOPrXLpe8C/V:Ghi9jQvO9p3hoH5Oi9Pq
TLSH
T16D928E3169786C676DF6EA81F54726138FFC9163F2C52B84D5DCEF0C01DB658130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 78d4c29bd4f87616b2a9396437f275c4f51bc187d5364ea79bf1280d75b08ad9
MD5 fa35b971fd9fea32117f3565ceacba1d
SHA1 177e48e44fe5db2dd82c049a5dc3c296c0304279
SHA512 23674bf939d6f941cd6259e7e9fc4d0faac5c50ec8ff07f43b94fcd238ec095138b3e059298ee9ef97439483f289d8dae9c42e364bee87d426ebd8c337d12244
SSDEEP 384:pZcIvsN95rA9fziTqJe+CXOmep3JrnH5OOPrXLpe8C/V:hv59jQvO9p3hnH5Oi9Pq
TLSH
T1EB928D31A9786C676DF6EA81F5462A138FFC8163E2C56F84D5ECEF0C01DB658130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 904226e27f4959af2000cbb0a2615c5b529d782caa0d7bcf556d611a6c59253e
MD5 7f9c4c0d4344a40a1bd0f87a58093980
SHA1 6d0f2aef7928ae04998a3d794a698f8fd20c59d6
SHA512 eaa2981ee59c2ae2db74463073f310d16bc155299e9c9e0cecd4b1ff3e8d93ed01bc778759ec93a90cd75c499b10af8f4c011ff1e08985e2db7968c2d814af83
SSDEEP 192:JONO6v+YLNQmiUylPZh+CG6Om9oEusglU6:JONO6vz/UZh+CXOme6cU6
TLSH
T18D02E939BD281C6B9FF26E45F5873B275FA8217BE9952F80D9E81F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b5ade6e32b85354a99e58b3157e2f7e101c9e8467a79df39de5fa8bb70118ea4
MD5 578271b323fd5fe6ed60d993f993ad15
SHA1 c198579b649549322fb82896b689a1e1a888368d
SHA512 7c51d85a0898bd168ef8b680f12e080e6a4fcd89c72a84b572e10fc89809a782510c4e21c5c12a193a46cff4f09c7e9e5f454c9128d19b8af1ec1340c5eca947
SSDEEP 384:CZcIhsN95rA9fziTqJe+CXOmep3JroH5OOPrXLpe8C/V:wh59jQvO9p3hoH5Oi9Pq
TLSH
T137928D31A9786C676DF6EA81F5463A138FFC9163F2C52B84D5ECEF0C01DB658130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d40ca673f1e32c99018d69a978643f6e8aa14ae830a58b8ad4b1b19069e8d68
MD5 42fa5f8ebc83692ede9d5b8ff2a29f52
SHA1 be7c9e308346f24b48b21ac7f4ad51d2fef9e2a4
SHA512 1b1f2bba216d9ad8fb43d64f6984af08a5a169e2745461dd9f92f61621d3a52454c4a5488ddd417a8de970c05e304c48c559e0a6d1f1d34503802b4846dc08da
SSDEEP 192:fRON46v+YL9aQmiUyePrh+CG6Om9opwSJrHDCHHbqWU6:JON46vzsNrh+CXOmep3JrwH5U6
TLSH
T183123C3579385C7B5EE26581F48736139FA85127EA4A7FC1D5DC3E0C02EF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57e3914e-4fdc-4826-ac66-464ba2cf71af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\57e3914e-4fdc-4826-ac66-464ba2cf71af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 17b7a1ed3f4bc196aa494bd923fc8d6600985ccf5b7b1edf9ef76b11e89307df
MD5 2c3edf3f7b547fc35c94d97c5ffe7473
SHA1 95ff898848a83aa61b46df893643f1b4b57d10cf
SHA512 3f5259fdf32029f33c9341a7f4e9473dcf352f659e206d148f711f51bc64f1374d8940cff6a6a016ac8e6fb6ef37e7c56031dc1e38f7887cd69d195b5da51380
TLSH
T143410758BBFA1148B3B76E5A9BF6A86D447AB8372E46D49D10010E4F0A72F00C972737
MD5 SHA1 SHA512 TLSH

Submit Download