hxxps://ametekcdn[.]azureedge[.]net/mediafiles/project/oneweb/oneweb/egs/downloads/pdf/anwendungsberichte/anwendungsberichte-6-col/kunststoff/anwendungsbericht_weisser_griesshaber/anwendungsberichtweier%20%20griehaberyaskawa_de-de_1[.]pdf?revision[:]618bbb28-39ad-4e6b-9763-bac675165ea2&_cldee=PXWgZbRl_Q3aI4hHBfPfqK0AKEh_wbzIrVraY47IxnhQRUffOyZ760ycGnoqn_DCwbiOQjhNTC-FVz-5Qmbl3A&recipientid=contact-b02f26f35d3dec118c61000d3addf71c-4c5d6101038f4e02a92ae57a60d2ff54&utm_source=ClickDimensions&utm_medium=email&utm_campaign=Newsletter%202026%20%2F%20EGS&esid=19ebdd80-3587-f111-ab0f-0022489c22e3%22%7D%EF%BF%BD%EF%BF%BD%60%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD3%EF%BF%BDL%EF%BF%BDw

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ametekcdn.azureedge.net/mediafiles/project/oneweb/oneweb/egs/downloads/pdf/anwendungsberichte/anwendungsberichte-6-col/kunststoff/anwendungsbericht_weisser_griesshaber/anwendungsberichtweier%20%20griehaberyaskawa_de-de_1.pdf?revision:618bbb28-39ad-4e6b-9763-bac675165ea2&_cldee=PXWgZbRl_Q3aI4hHBfPfqK0AKEh_wbzIrVraY47IxnhQRUffOyZ760ycGnoqn_DCwbiOQjhNTC-FVz-5Qmbl3A&recipientid=contact-b02f26f35d3dec118c61000d3addf71c-4c5d6101038f4e02a92ae57a60d2ff54&utm_source=ClickDimensions&utm_medium=email&utm_campaign=Newsletter%202026%20%2F%20EGS&esid=19ebdd80-3587-f111-ab0f-0022489c22e3%22%7D%EF%BF%BD%EF%BF%BD%60%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD3%EF%BF%BDL%EF%BF%BDw
Sample260724-mac3dsck2s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4344	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293617278546984"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{CDDC84F4-D648-4D11-9221-AC6C63AB1C9E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2444	3780	msedge.exe	86
PID 3780 wrote to memory of 4344	3780	msedge.exe	87
PID 3780 wrote to memory of 3928	3780	msedge.exe	88
PID 3780 wrote to memory of 3928	3780	msedge.exe	88
PID 3780 wrote to memory of 3928	3780	msedge.exe	88
PID 3780 wrote to memory of 3636	3780	msedge.exe	89
PID 3780 wrote to memory of 3636	3780	msedge.exe	89
PID 3780 wrote to memory of 4540	3780	msedge.exe	91
PID 3780 wrote to memory of 2708	3780	msedge.exe	92
PID 3780 wrote to memory of 4540	3780	msedge.exe	91
PID 3780 wrote to memory of 4540	3780	msedge.exe	91
PID 3780 wrote to memory of 2708	3780	msedge.exe	92
PID 3780 wrote to memory of 2708	3780	msedge.exe	92
PID 3780 wrote to memory of 4436	3780	msedge.exe	93
PID 3780 wrote to memory of 1508	3780	msedge.exe	94
PID 3780 wrote to memory of 4436	3780	msedge.exe	93
PID 3780 wrote to memory of 4436	3780	msedge.exe	93
PID 3780 wrote to memory of 1508	3780	msedge.exe	94
PID 3780 wrote to memory of 1508	3780	msedge.exe	94
PID 3780 wrote to memory of 4944	3780	msedge.exe	98
PID 3780 wrote to memory of 1896	3780	msedge.exe	99
PID 3780 wrote to memory of 4944	3780	msedge.exe	98
PID 3780 wrote to memory of 1896	3780	msedge.exe	99
PID 3780 wrote to memory of 4580	3780	msedge.exe	101
PID 3780 wrote to memory of 740	3780	msedge.exe	103
PID 3780 wrote to memory of 740	3780	msedge.exe	103
PID 3780 wrote to memory of 740	3780	msedge.exe	103
PID 3780 wrote to memory of 2940	3780	msedge.exe	105
PID 3780 wrote to memory of 2940	3780	msedge.exe	105
PID 3780 wrote to memory of 2940	3780	msedge.exe	105
PID 3780 wrote to memory of 1608	3780	msedge.exe	106
PID 3780 wrote to memory of 1608	3780	msedge.exe	106
PID 3780 wrote to memory of 1608	3780	msedge.exe	106
PID 3780 wrote to memory of 4340	3780	msedge.exe	107
PID 3780 wrote to memory of 4340	3780	msedge.exe	107
PID 3780 wrote to memory of 4340	3780	msedge.exe	107
PID 3780 wrote to memory of 1096	3780	msedge.exe	115
PID 3780 wrote to memory of 4076	3780	msedge.exe	116
PID 3780 wrote to memory of 2304	3780	msedge.exe	117
PID 3780 wrote to memory of 960	3780	msedge.exe	122
PID 3780 wrote to memory of 960	3780	msedge.exe	122
PID 3780 wrote to memory of 3684	3780	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ametekcdn.azureedge.net/mediafiles/project/oneweb/oneweb/egs/downloads/pdf/anwendungsberichte/anwendungsberichte-6-col/kunststoff/anwendungsbericht_weisser_griesshaber/anwendungsberichtweier%20%20griehaberyaskawa_de-de_1.pdf?revision:618bbb28-39ad-4e6b-9763-bac675165ea2&_cldee=PXWgZbRl_Q3aI4hHBfPfqK0AKEh_wbzIrVraY47IxnhQRUffOyZ760ycGnoqn_DCwbiOQjhNTC-FVz-5Qmbl3A&recipientid=contact-b02f26f35d3dec118c61000d3addf71c-4c5d6101038f4e02a92ae57a60d2ff54&utm_source=ClickDimensions&utm_medium=email&utm_campaign=Newsletter%202026%20%2F%20EGS&esid=19ebdd80-3587-f111-ab0f-0022489c22e3%22%7D%EF%BF%BD%EF%BF%BD%60%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD3%EF%BF%BDL%EF%BF%BDw
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd9b02c188,0x7ffd9b02c194,0x7ffd9b02c1a0
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,2136591531513905265,2412869430032973195,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13924684156015155414,4350219496973963884,262144 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,3526548882863566007,3324271783095564190,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13570139685373854860,10666166259392436642,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14937888551724595231,18268156378717390289,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4620487277985941852,7809206969973569562,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,7409564639593947982,2868883694030755063,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5401655437403462215,3153242974412189247,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4128936184983268214,4965648467479437571,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13209916513704333044,16841487075925035170,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13209916513704333044,16841487075925035170,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3888,i,7549075495097205439,6494266817681863660,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3824,i,6699633146052961623,762465254288058090,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6196,i,4132471761040938855,4147326778817594618,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6484,i,386207272051463334,1560224773480567449,2097152 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,2733310882414887351,3325545204865506091,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,18070280744872736870,16824346875791716738,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,1640735757651630565,15753105331313717755,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,5976502912586734953,6656324027469815205,524288 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,16307274052180049000,7528693852196296520,262144 --field-trial-handle=2272,i,9929187373549294089,16672191791160627933,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd0247a0ffadc4a5488700e627d7f98063bf1a233746860e9d876d5c7410e528
MD5 d44a97b46a64d92a3be41644c2f5f390
SHA1 8d49fa77016a0aa94f642a7d4ef82b9c6618b7bb
SHA512 000e3d3003404320350a8f136dbb5226a81e9699c655cbc35b3756331eb1928b3d68e15ed1bf46b9cc8b7eebdfe27d607bc32acfdcd2d31629b04c78fed43b1e
TLSH
T11361603E101109B1F3A142B353C249C5BCB1F7FBFA63FD46E159ADB91B06B41CA19188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3348eec3e6aabf09d1dc88d4ad4e0ac15303a037350c2d7e9a0206fbf1e578b3
MD5 73cc82e53573f7e876995837bf859860
SHA1 4be398cd26b4f41a7632fcc70f8b8c981956c522
SHA512 7e0b3a459a7087563965e3739c7f9deaf16bdab4f47e941231f0fa2775b2fd2bb29c51edf92da307e1c368679b45bc748ab9c56122e67fc22b4e9a6db9e91b55
TLSH
T10071407A005005B1FB6141B363C16AC478B1F3FAFA63FE26A1595E794B02B81C649984
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 845B
SHA256 d566a5ecc57c7216abb5f6d261309fd312be59692d8f2e24aad541ebfb73a8ad
MD5 fa6e3cfe170d5900cebef0d072a59b4d
SHA1 4b4d72190debbf4f2c947483eba3ed6ade356ccd
SHA512 3a754488d56733a5a4e8dcbac7df1988d29495fed071d09f6e69dffa335c0cab9abd08af6ee20765c14eae389aeb11fb84b2d91d280fc1630799677c72e928f7
TLSH
T1B701AFF783E081AEC91146F05A14AE1BCE2D0542831C3C158AD4FF1BC3E3165E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 89453efbfba33c75a673dbbf9b526a3289f53fd41e6843514cd74002d4a553e8
MD5 14dffad6021c6e64390da9bc3584604c
SHA1 1e2bfeddbb5848dfbe0176ebdd24e8724a14d2f7
SHA512 53034530840e58300aef02bfd50e2144187de96a3c2d3e4990899123d11275beab7db3d635b82d9c987f48dfa2249988ecbf29ac16e17980fe28c495068911a5
SSDEEP 192:sxZhQUn9lkw/fVsMJ0alCodpJHW6+WNGYzclHs+ZIgrJ:sxZJn9uw/fVsMJ0OJHbGEa9
TLSH
T17432C7526E38A47B8CC7D219BB16BB53E6F95072A5D40E58F6FC960C04E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d81b84f16f5cc439b70944ca0349b8a2e37abc3a954ac9b4e0052c13ce317b7
MD5 fc20ae13d9acc8e88372baaec903cbdd
SHA1 4a01e9b2798239013ea32178d4a522b776445dc2
SHA512 bed2707cf48de826cb3c04a449dfdc352710bb7712dc4d0620f89fc1e9d704b9032c85c622f56b4177d2646580b3446ca53dd31fd33dc61cd00aca5df36d34d2
SSDEEP 192:sxZhQUn9lkw/fVsoj0wlCodposHW6+WN30j/YztlTOwns+ZIg5AJ:sxZJn9uw/fVsoj0IBHbg/KOvaa
TLSH
T10232B656AE68A57B9CC7D219BA16BB13E6F91072E5940E44E6FC870C04E6BCE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 608ecce55c0bd28079a8e2a9a3c948e2beca1dc8ec281c70abcc908bf03d3c78
MD5 109d19c671cd4566fd79c7e068769b3f
SHA1 799cd5a5715dc7ca31768f67a1a8315b9fc44f5c
SHA512 114382133a5e773e79d2827f276413fa168aff417bbc8781ac09ca72dc524c0cb0df61e1f367665169e1cc881b6bae3643ef463d03a5abb97f5b3e8b74c7f9e6
SSDEEP 192:sxZhQUn9lkw/fVsoJ0alCodpJHW6+WNGYzclHs+ZIg5qJ:sxZJn9uw/fVsoJ0OJHbGEaA
TLSH
T1A032C6566E38A47B8CC7D219BB16BB53E6F95072A5940E48E6FC960C04E6BDD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ce1a218958597d6556c9073444ba8122023b035007b2a550ec23afcb5020bca1
MD5 3309a261064cfbefe0218c9e7db95f90
SHA1 387c0a630fcc8d2aaf50ec9a44b97af84e4ce315
SHA512 3129e0ef9b9ce619175c94e64b261ad08e8629b6c8e352fd57460b0bd8ceb598caceb760210041f5b919c2dfb2f9e2f4c1193d099c038d95234db42476e79bef
SSDEEP 768:nvk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBgroyQYe:nvk7u70WvqiEau1jai5LA3Brae
TLSH
T103C2E93B740CCB7E4F801E9DAC566F977E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 513bc2c0198e45ec733b030a7fdedb5c82e6fddb4d4945b58e4dcf75e056c92b
MD5 0f1f845951dee7486e646d99a4ebead4
SHA1 2319ee0bca748d3e1bdc620cc27043153569e7a5
SHA512 5798dc7efeb425ac7afbb379d5dae711bb0aa18e34beed856a15ea20deeacd0a6400ae64607f0f53e5384c4bf90448af1badf54f2ed9190b13651eb7d3fc0ca0
SSDEEP 96:KIbCKc3/WKQouWF8BVr/7gfH6z99gKV19jgxN9qDLIAKpT:sSdWF8BVr/72H6B9J19juN9qDMT
TLSH
T1DD919355303B424238BE6888929586368F8271973895B46F3FB840B25E67E178FFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

834f6127-8d75-491b-8229-7045072bd997.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\834f6127-8d75-491b-8229-7045072bd997.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4d8349db1db77a41092145300c8ab95e8614df4d9ecf60f36f93a2d6a84f2fe8
MD5 579fb700121e27075c25cbd99e240937
SHA1 2460a7bdf0b2b2a0615753d67bcbfe87f15d2f2a
SHA512 35c9077377afc288f13274e92ed545c12efd2700fe170980cca5a1f5f37a108ed029975d0c59915bfc4065037af12c0a67792676be98cbf22f6fb26666af4137
SSDEEP 192:2LsNPUSoQQJhBb9FQmiU1HkC44aGBPKrs+FdGGm1pFE8/dNrqcRXgm:csNPU7XJ/bVqCHEddm1Q8/Tf
TLSH
T10F421A36AC74AC764DA2F185F54A36036FB451A7D6C42F54A6ECAB0C01EF6AC231781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a8a5ce30a5139758f97b4b99bd6f4fe51dbe406bfc8a65abf57649e7fa0b9c1d
MD5 6be23b537454e6c824936b36506bf6f7
SHA1 4a8bffe31a52c0336dfa3802964f0e95847b74f5
SHA512 facdf6f82daa40e8253816c5ed29c0a68a25e6e3d8260fbcff29e8d0aac6175ed069b88bcf2382159ec9ba63949d4922d0a0614f58cf2abc05c78934272b3073
SSDEEP 192:uCQLsNPURFQQQJhBb9FQmiU1HkC44aGBPKrs+FdGGm1pFE8/dNrqcRXgm:RmsNPUcXJ/bVqCHEddm1Q8/Tf
TLSH
T1E2521A36AC749C764DA2F185F54A36036FF451A7E6C42F54A6ECAB0C01DF7AC230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6cb5fba4eecc2069a31003ca295ab32ef134ca6c18becf8a5974dbab8f55e3f8
MD5 850015ed3828e18bcc07a85b03ebbedd
SHA1 7810fc14bbaa605cf7542f5b59cab60f355babe9
SHA512 d7d06dd563f1dc40c93a41bd07db1411491e7212183eaeadfcb0eddac571e445426e226ebfaa72f8805663af8c026568a55a0a0308cbc889d91684c84696a050
SSDEEP 384:RTZcIhsNPUkXJ/bVqCHEddm1Q8/TOObjI9G6w7ZK:RLhSJ/DkmQ8/T29Mk
TLSH
T1F7929F35AC749D378AB6E152F48636131FF4917BE3C81F44B6ECEB0C05EA6AC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7fbe649ec62a70e9329280b18f0c3ab1e5f1ef17413bec1b8c94f3e0db650f6b
MD5 4b5652be5ee32c6f2b03e19e6a5c74e6
SHA1 f1502c786dd2242c26b5403abc35d4255850cb4b
SHA512 2ebc0f766326bd07f44dda8f7f734ae945ecd762ceef9c8433a992fdb7310a43b1f449c277bc4dca556e7197b111e9dcd40c06cc9fe457c7605ac1d505bb7730
SSDEEP 384:ziiFiZcIgzsNE8TUNTUlIlkXJ/bVHCHEddm1Q8sTOObjI9G6w7ZK:zpFQ8hwg8J/8kmQ8sT29Mk
TLSH
T1F2D239F248E78936D9AE9743B77D2E125EBCC167F6845A44B3D89A0CCC961BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61d3bdf3858d4b761ad308f1514b6c92034234af6b9b84a1bc4329f443875965
MD5 ffbd80916e0b0ab680a6690684e04f64
SHA1 fe4b5ad4eb52e202bbbba3826b74527a3b712b68
SHA512 a8ca671a421c5aedd2e3d454b9fd28311ca6fd4f2445f9675d1aa91829909d67a79d78e809cdc3e3b62119973af694c78bb07aa265285511a7311623ba85cebe
SSDEEP 192:MONE64BAQmiUyx1oW5GBPKrs+FdGGm1/aDvV9U6:MONE6eAKWWDddm183U6
TLSH
T1A702FA34AC786C7B9EB2AE45F48737175FE8113BE6915B44EAE81B1C00D775C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7cffd5949f2e45376715921bd834443f33a69c5900c6c58406f701fc3d156b13
MD5 84dac635231a4530b735d1abbb42ca8e
SHA1 d6dddc3b6de94667d29c30b960456bad6484df72
SHA512 bfa29806a36af1924c4faa1072d789f9d907f148e5a3b232f35d121d278db077fcbcefc264866a4801e001ee990d5b711bb52a9faae0f0bc0652f20868bd299e
SSDEEP 192:ZON164B2QmiUyyo15GBPKrs+FdGGm1pFE8nWwrqcU6:ZON16eSc1Dddm1Q8TTU6
TLSH
T12F121B35AC74AC2B5EA2B541F48736035EE5522BEB856F44F6DC2B1C01EF7AC230681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b8106970bf5bc65711fc5414ec05bb07596def64748c4140ef575ab0207fa6a5
MD5 9496da83503f45c54fafe8edc8b7e989
SHA1 65c1d8980467b66cb3f81c4df639b1b9418be3a2
SHA512 c786b42f5eee59dac20c8a4a5599315b2b82dc6d596e2f4880a425957c88835d12b1527b1e64d6f158ff3fc99caef57808ed98ef237513ac425107046cbd1329
TLSH
T1F541295CE6F91148B3B76E56AFF6A86E487A79332E06916E10110E4F0B62F40C961733
MD5 SHA1 SHA512 TLSH

Submit Download