hxxps://salesloft[.]bisnow[.]com/t/120108/sc/422c179e-91ad-4749-90d3-213c4d434f64/NB2HI4DTHIXS653XO4XGE2LTNZXXOLTDN5WS6ZLWMVXHI4ZPORUGKLLOMV2GQZLSNRQW4ZDTF5XWMZTJMNSS63TFORUGK4TMMFXGI4ZNN5TGM2LDMUWXI2DFFVSHK5DDNAWW6ZTGNFRWKLLSMV3GS5TBNQWTCMBSGQZT643COJRT2MKIMY4TKVTCKJAXQLKTNJ3W64SNMR2UE4COKESTGRBFGNCCKMRUFU2FOWLQKV3EQ4CKGRUWIURXLFUTE4CXNFTSKM2EEUZUI===/GA3GGMZXMU2DAOLEHBRWEMZTGM2TQMBUGM3TMNLFMY4TCNRYMMYTGYLEMRSGKMZX/www-bisnow-com-events-the-netherlands-office-netherlands-office-the-dutch-o

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://salesloft.bisnow.com/t/120108/sc/422c179e-91ad-4749-90d3-213c4d434f64/NB2HI4DTHIXS653XO4XGE2LTNZXXOLTDN5WS6ZLWMVXHI4ZPORUGKLLOMV2GQZLSNRQW4ZDTF5XWMZTJMNSS63TFORUGK4TMMFXGI4ZNN5TGM2LDMUWXI2DFFVSHK5DDNAWW6ZTGNFRWKLLSMV3GS5TBNQWTCMBSGQZT643COJRT2MKIMY4TKVTCKJAXQLKTNJ3W64SNMR2UE4COKESTGRBFGNCCKMRUFU2FOWLQKV3EQ4CKGRUWIURXLFUTE4CXNFTSKM2EEUZUI===/GA3GGMZXMU2DAOLEHBRWEMZTGM2TQMBUGM3TMNLFMY4TCNRYMMYTGYLEMRSGKMZX/www-bisnow-com-events-the-netherlands-office-netherlands-office-the-dutch-o
Sample260731-mcaeaael2x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299667308569187"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{156A20CA-849A-401F-931A-AF333E0DB263}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1752	3036	msedge.exe	87
PID 3036 wrote to memory of 1692	3036	msedge.exe	88
PID 3036 wrote to memory of 1816	3036	msedge.exe	89
PID 3036 wrote to memory of 1816	3036	msedge.exe	89
PID 3036 wrote to memory of 1816	3036	msedge.exe	89
PID 3036 wrote to memory of 4644	3036	msedge.exe	91
PID 3036 wrote to memory of 4644	3036	msedge.exe	91
PID 3036 wrote to memory of 408	3036	msedge.exe	92
PID 3036 wrote to memory of 1996	3036	msedge.exe	93
PID 3036 wrote to memory of 408	3036	msedge.exe	92
PID 3036 wrote to memory of 408	3036	msedge.exe	92
PID 3036 wrote to memory of 1996	3036	msedge.exe	93
PID 3036 wrote to memory of 1996	3036	msedge.exe	93
PID 3036 wrote to memory of 4264	3036	msedge.exe	94
PID 3036 wrote to memory of 4264	3036	msedge.exe	94
PID 3036 wrote to memory of 4264	3036	msedge.exe	94
PID 3036 wrote to memory of 4280	3036	msedge.exe	95
PID 3036 wrote to memory of 4280	3036	msedge.exe	95
PID 3036 wrote to memory of 4280	3036	msedge.exe	95
PID 3036 wrote to memory of 680	3036	msedge.exe	98
PID 3036 wrote to memory of 3592	3036	msedge.exe	99
PID 3036 wrote to memory of 680	3036	msedge.exe	98
PID 3036 wrote to memory of 3592	3036	msedge.exe	99
PID 3036 wrote to memory of 2480	3036	msedge.exe	101
PID 3036 wrote to memory of 4740	3036	msedge.exe	103
PID 3036 wrote to memory of 4740	3036	msedge.exe	103
PID 3036 wrote to memory of 4740	3036	msedge.exe	103
PID 3036 wrote to memory of 2768	3036	msedge.exe	107
PID 3036 wrote to memory of 1180	3036	msedge.exe	108
PID 3036 wrote to memory of 3012	3036	msedge.exe	109
PID 3036 wrote to memory of 788	3036	msedge.exe	117
PID 3036 wrote to memory of 788	3036	msedge.exe	117
PID 3036 wrote to memory of 4936	3036	msedge.exe	118
PID 3036 wrote to memory of 4936	3036	msedge.exe	118
PID 3036 wrote to memory of 1944	3036	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://salesloft.bisnow.com/t/120108/sc/422c179e-91ad-4749-90d3-213c4d434f64/NB2HI4DTHIXS653XO4XGE2LTNZXXOLTDN5WS6ZLWMVXHI4ZPORUGKLLOMV2GQZLSNRQW4ZDTF5XWMZTJMNSS63TFORUGK4TMMFXGI4ZNN5TGM2LDMUWXI2DFFVSHK5DDNAWW6ZTGNFRWKLLSMV3GS5TBNQWTCMBSGQZT643COJRT2MKIMY4TKVTCKJAXQLKTNJ3W64SNMR2UE4COKESTGRBFGNCCKMRUFU2FOWLQKV3EQ4CKGRUWIURXLFUTE4CXNFTSKM2EEUZUI===/GA3GGMZXMU2DAOLEHBRWEMZTGM2TQMBUGM3TMNLFMY4TCNRYMMYTGYLEMRSGKMZX/www-bisnow-com-events-the-netherlands-office-netherlands-office-the-dutch-o
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff9a44c188,0x7fff9a44c194,0x7fff9a44c1a0
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14292418675481408508,3020359695962441519,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,3914098349490246007,4206015818165657202,262144 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2513147159162530890,3722266077531145230,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8698414720934619857,14793416780799475029,2097152 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13132368514046345825,14256063861964084495,2097152 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13273963712620817722,16980107113635845727,2097152 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,11650203311844567464,9090811515418284207,2097152 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,3023131029963335737,16293971573123337900,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5544883376599881868,14709690762802030514,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,16305776953467817137,6681019198961328189,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,16305776953467817137,6681019198961328189,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,5558862983105572266,17151370489486895284,2097152 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,9780068435392768097,7373659684045972237,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,9145747584894201176,14190681362254565295,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,9800610111170385870,10264248886398104397,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,10108486289939863095,1606793771069903506,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,4096249160190070821,14673583276600446849,524288 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6652,i,11310797034312317242,7168757181169583551,262144 --field-trial-handle=2320,i,14411399107106577419,16522274807306583064,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 eb3a2def9f4b6035941af73f13d4e0d6dabd1a81fd366178ace6a15412f5055f
MD5 892727a92ed5bb3d076e7c015f303461
SHA1 c06b37f3dbf604ea389be640479af6199627117c
SHA512 dd21d3eda95d2290b95a2fdb5d449733dc51ea5a65837f18375653e4a597ae34477d17b2c2d4b6dbb5ab366f9996fd2e1597cc7b409afac363ac88a6a4624414
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T1D6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3370a1670bb6f7c32a736ef7f695811e9f1e83ec74eab835f198005af25a0040
MD5 d4f2a20b9d773487dbe691e3c112017b
SHA1 d0f7add96c212a1802b4d73f1ff4c2693ce86368
SHA512 79f2e9ab8a139688246c860984468df25e9fc7ccf2eed63a88ead2b49d44b2fe98890da9b7636f6e63d663b27f6a2003e7502c1223623f2e85567094056e2493
SSDEEP 48:3XQh1KRn2ouxUNEKxlxU1WotF19uYHf6e72wEa6fV:XZ2ohTlxUX1h6eSr5N
TLSH
T1AF81C6B409350F61EBD2407F80FBE601317241D1FD330FBADA7091795A2FB6961269B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d8d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d8d7.TMP
Size 3KB
SHA256 d06415f59001ade8eaa43095fc521c1b3accf7fa3cb4d042452c8e04cc4ac589
MD5 733e763e9af759164ec4ea5db5608884
SHA1 955c2a62b100ca244113c1d071ccd505e40ba414
SHA512 8e66271606ff0d7d3fc418900353f043cd09f66cdf9bdd715c326209da651b4949b4f470f5ab6a20e750bbf4059ba090db04ffbf965a0f0ba403a3e7384a74c9
TLSH
T1B1614EB449310FA1FBC1807F95F3D209357086D6F8172E7AD05066785E3EF6AA11AD2D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2a557b5e8d392c34f9c728b537d54a579abbc9e29d9267c342563f30563181e7
MD5 b33cab3a6d116b4f90db540d05ace4c2
SHA1 832e6a8df916c2b508e0d40e1b3aae16d13ece3d
SHA512 f0507a4e48962b773026a73cd7bc81cada28f26795eb0eefee52ac0c2910b412942eebcacafc42272d19f774d5bc18d6924a84050196dc60a200d4201fc93268
SSDEEP 192:D4yHqHvWJpl7G5UGjrIrHrcA80tYi5fEyfrEnb5RL6T1rT:D4yHqHvepRGmGjrIrHrD80tl5fEyfrEy
TLSH
T11DD16AF78BE4866D891196F0AA15AF1FCE190624572C3D2988D4BF0793E3971F102E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 50b74a4cf26ec4630385a584b2fdb79c5c55e8e34eb5dd781916c3c804d941d2
MD5 9913bd298d2e3bd98a98961abb3042fd
SHA1 a25191d4e0a73befd35d9f5f917a0b440a4ac2e9
SHA512 db4742271b56124facec3beecead0993a6ba1480b9880d0d75d870bab44bc035591119b697a8a471109caa12c6a6bb6ece0fd3c0497ca3caaf34778f754eef47
SSDEEP 192:sxZn/yM/jK1Ml8Mk+/fns1gyawIdpenHW6+WNuJe/Y9IRBXTIgrJ:sxZn5M+/fns1zWIHbJ/X9
TLSH
T11642D7166A349977CCDBD209FA55BB53D6F90572E2900E44AAFCCA0C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 45c6075e01db32f271768b3fc28dc2871de47f1436819074b771b3aac3afdede
MD5 a03b8d993a5069f334049dcd923d673d
SHA1 92e11f8f7efd59dae0314d2123dd8a1162d5e76c
SHA512 19b1ba0f4760917c57b2d452a279dc20bcc99bf826d00908dd76033604cd3099615d9268f95d6abc3e73ff058939ab548122f83933f4f6c3222be087df68102a
SSDEEP 192:sxZn/yM/jK1Ml8Mk+/fns6gyawIdpenHW6+WNuFqXY9IFBXTIg5KJ:sxZn7M+/fns6zWIHbRXT0
TLSH
T12F52D7166A349977CCDBD209FA55BB53D6F90472E2900E44AAFCCA0C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a7c2bdfc8f339a08453d1b21b14d512e23854bcab67463b417ee44abd0d3452a
MD5 95c55028caac48a5010ba108704acf9b
SHA1 e276c99dcadd87caaf6c69ff96fd70be0223588b
SHA512 86c10dadb667cfa9f707074b8a0fab2c250c11a1cab43886a411c40b59b17e8846cae0c6ccdbc15978211173e53fe24e6fe06be70292dc05b4954b7d4e80b6ad
SSDEEP 192:sxZn/yM/jK1Ml8UQzk+/fns6YyawIdpQnHW6+WNuFqXY9If8XTIg5gJ:sxZn7qY+/fns6rWCHbRX2e
TLSH
T19252D7166A349977CCDBD209FA55BF53E6F50472E2900E44AAFCCA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c3db6d3888278cf7169d0167c77e5cf5bac7b6a7bd7b87b4e811c13b0a59a5ac
MD5 c09c63293ac4991325cba1fd4cd8413d
SHA1 e6065527db13b3f5059223bdb0fdbacc5502f713
SHA512 ad812843414c089c3a26bb9dcb8b8a709fce0c5c3a244b5cd716b99ea28939da2d86816c3f39ca259b24fca7e4b47e5bc4a850f5d3484682c6b3769507caa10f
SSDEEP 768:Jacv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN2rocg6l:Jacv21wWvu+Z+u1jaeFLeRNNc1
TLSH
T1F9D21B2B280CCB7E0F845E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 93036cb08689f0515f5b3ab174adb89db47a37fe085e8eee961267bfabd2bd09
MD5 251081da3c6479e477118d484b9366a4
SHA1 dc73596c3f7e278800b64a096d9dc0c5adf06e28
SHA512 d311e374719f9d63a55ef13b89e8f78a74938904fdb971bc4cb82b94c5bade4a8893a533a316d1a0ae1256e2f887bf1badbd366d616d6f9437a3b66fd82982f0
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKakKDqCC84KxeR:mT3PTi
TLSH
T1EA910306303B128238FD7948A752953A8F41326B7814A47F7FB900A56E2BF152EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

840f61c8-7186-4b56-9d2c-d8fab1cec112.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\840f61c8-7186-4b56-9d2c-d8fab1cec112.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ceb89a9916cc62f85b460e9d2daf17dac160ea3bf4559095d5e35b1664c25785
MD5 a230d99a7b67d6cf3a0869a6f80660f2
SHA1 35fec2d72453538b2b2e83ba16a5fc138b5dbc16
SHA512 5d1de777f7c7b4de52e6931fc2716478fb02c733fc3f36854ab477549415cebda1b1977f7d44cd08db9d51b6bbd9b8f22d9fda776b4d948635d4b76bbabd48e0
SSDEEP 192:u0LsNPVQvYw7PnW+YLeQXQmiU1q4a4e+CG3+Fdeqmpc+pSJrVfJiFqQRXgB:fsNPVmYSPWziE1Fe+C5ddJrats
TLSH
T10542293668781C6B59A2A155F44731139FF850A7DBC93F90D6ECAF0D02DF6AC230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c8ecbde8d39d8843937e28c33f536e8f207f72bd623f7134d63cc0a05697031e
MD5 693bb0f93082d44a0f85e3a9f1c8a744
SHA1 ff9e34858335382a592f240879b3d8d7e6a691cf
SHA512 1afd4205a66014de7752c5baa63bf8ac1550dc15f9aa94dc3e9c7f4dc70d9507fe02eaf76323a95e0d37a04856c2179df2e3a13020732ae2c0a59e5cd20d8230
SSDEEP 192:ukAm+xasuheOwQxMGsNPnQvYw7PnW+YLeQXQmiU1q4a4e+CG3+Fdeqmpc+pSJrVT:tZcIhsNPnmYSPWziE1Fe+C5ddJratc
TLSH
T17A726C326C741C7B59A6A545F44735138EF89073E7C92F9491ECEB0E01EBAA8230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8821cc574ec3f624b43299b2fe6ac733bafa5e902ab3a153996a49b43df98e31
MD5 155767d113a5b13b88a2e6618a696081
SHA1 acb6fa0abca8eff850d005834ac43c7b7f28381b
SHA512 9e645c411b654b83c9f92f67d0a49c3c2c2d16f56b4ae2163baf6914679b8b67f833159486e61aeecf428bec7b9aefc23fb60436b80bdfad474c8a7bbf07ad90
SSDEEP 384:TiFiZcIjzsNx8TUNTUlIlnmYSPWziEnFe+C5ddJrrtc:+FQnUwgEYiWB0hzhrtc
TLSH
T1ECB208F248E7487AD9AE5743B77E2D124EFCC063F6856A50B3989A0DCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 278988f664a772b59952cc43d735f03cb13cb6171ed3bfdea8e33a13bfaf5169
MD5 672e08ea83c15a977ea4d168c6c8ebce
SHA1 2d5e1ae28bd9f7c656f22a0564839921a07ca35b
SHA512 6e3f4049dcc3c028071ff4d4f58a5ee375bd6f6def3b87ea47757623a862841195dc8aefd962f480ff1537fe10b9743003c1528b7616930d0f97d0472e9b3cab
SSDEEP 192:JONw6v+YLNQmiUy1cZh+CG3+FdeqmpvusXOU6:JONw6vz/jZh+C5da+U6
TLSH
T1AA02E835A8782C7B9BB2AE45F48737135FE8217BEA922F84D9D81B1D01D775C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 877b3ffc2baa74213626bc3e329e8e499488913e027949bc7053c58262d744b6
MD5 89c82a623f48e3bf9a6e050b773f2192
SHA1 917f16ecb0e128fc37ea06e7c7b412ec927f2d89
SHA512 b60f10dfb0e297c2a3ccb64f40631c4251a11d275d1a51a75a1c05abb53946569f177eea96d6e0780201056a061e2c84844ddb3dcdd42ab1a15447aa7a7062ab
SSDEEP 192:0ONy6v+YLOQmiUyac3h+CG3+Fdeqmpc+pSJrGCHFqQU6:0ONy6vzue3h+C5ddJrHtU6
TLSH
T11F122A3668786C6B5EA2A545F48735139EE85137EBCA7F80D5DC6F0C02DF7AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0698d68b-4274-4488-9172-58a8d9e524a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0698d68b-4274-4488-9172-58a8d9e524a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 351a6dd9726ce60e2d50f2dd6745d581be655b04bbe80fa3fe39c3ea47aa0895
MD5 28d51fbee297651d52ea371f85efe231
SHA1 dd429f3ee1f4c711a07767183b9da554dcf5ac85
SHA512 4506ce3c8a32c9f2fdbfd37559d2d3e1fe99b49be100704647bc53e8ea4a0fe88afc7c5d9b2fe77aedc9c38826d0a9f8d986c4db1a83d3d05c1055428bd04ae9
TLSH
T10941EB58A6E91108B3B76E56AFF668AD487BB9772F0AD09E10110E4F0A72F44CD71733
MD5 SHA1 SHA512 TLSH

Submit Download