hxxps://memorable[.]id/rsvp/2b5ae52c888e004e

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://memorable.id/rsvp/2b5ae52c888e004e
Sample260803-saq7xatthy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3668	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302425471390288"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{55E2A68F-98B3-4E7F-81AE-0FAEB3F716D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3340	3300	msedge.exe	85
PID 3300 wrote to memory of 3668	3300	msedge.exe	86
PID 3300 wrote to memory of 2128	3300	msedge.exe	87
PID 3300 wrote to memory of 2128	3300	msedge.exe	87
PID 3300 wrote to memory of 2128	3300	msedge.exe	87
PID 3300 wrote to memory of 2372	3300	msedge.exe	88
PID 3300 wrote to memory of 2372	3300	msedge.exe	88
PID 3300 wrote to memory of 3816	3300	msedge.exe	89
PID 3300 wrote to memory of 4928	3300	msedge.exe	90
PID 3300 wrote to memory of 3816	3300	msedge.exe	89
PID 3300 wrote to memory of 3816	3300	msedge.exe	89
PID 3300 wrote to memory of 4928	3300	msedge.exe	90
PID 3300 wrote to memory of 4928	3300	msedge.exe	90
PID 3300 wrote to memory of 2748	3300	msedge.exe	91
PID 3300 wrote to memory of 2748	3300	msedge.exe	91
PID 3300 wrote to memory of 2748	3300	msedge.exe	91
PID 3300 wrote to memory of 3688	3300	msedge.exe	92
PID 3300 wrote to memory of 3688	3300	msedge.exe	92
PID 3300 wrote to memory of 3688	3300	msedge.exe	92
PID 3300 wrote to memory of 3640	3300	msedge.exe	97
PID 3300 wrote to memory of 4236	3300	msedge.exe	98
PID 3300 wrote to memory of 3640	3300	msedge.exe	97
PID 3300 wrote to memory of 4236	3300	msedge.exe	98
PID 3300 wrote to memory of 2792	3300	msedge.exe	100
PID 3300 wrote to memory of 4252	3300	msedge.exe	113
PID 3300 wrote to memory of 4168	3300	msedge.exe	114
PID 3300 wrote to memory of 3888	3300	msedge.exe	115
PID 3300 wrote to memory of 2936	3300	msedge.exe	120
PID 3300 wrote to memory of 2936	3300	msedge.exe	120
PID 3300 wrote to memory of 4432	3300	msedge.exe	124
PID 3300 wrote to memory of 4432	3300	msedge.exe	124
PID 3300 wrote to memory of 4432	3300	msedge.exe	124
PID 3300 wrote to memory of 432	3300	msedge.exe	125
PID 3300 wrote to memory of 432	3300	msedge.exe	125
PID 3300 wrote to memory of 432	3300	msedge.exe	125
PID 3300 wrote to memory of 2220	3300	msedge.exe	127
PID 3300 wrote to memory of 2220	3300	msedge.exe	127
PID 3300 wrote to memory of 2220	3300	msedge.exe	127
PID 3300 wrote to memory of 1728	3300	msedge.exe	130
PID 3300 wrote to memory of 1068	3300	msedge.exe	132
PID 3300 wrote to memory of 1068	3300	msedge.exe	132
PID 3300 wrote to memory of 1068	3300	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://memorable.id/rsvp/2b5ae52c888e004e
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff8ea0ac188,0x7ff8ea0ac194,0x7ff8ea0ac1a0
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11682222723249922485,16648168934684570422,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,3579104968101825449,1995265998647923038,262144 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,2358727286079235989,17390678677308202793,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6804694682644959008,4378647583860962343,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2234269354394263623,12265023536325109158,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,18017052805373789815,8865885651500945820,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10498683782133654357,4564234215508792901,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15475600807178487813,7748904287666746925,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6104522814815229860,723062290195380789,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,13009170349231150171,17038663060504266780,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,13009170349231150171,17038663060504266780,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1924952034978440463,10513572008988043129,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,355030776090684161,4330511186439042870,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2953215563047328659,17054233532843097431,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,1717526827111233612,2800610514050956756,524288 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6276,i,373194490156401095,13401256519023402118,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3652,i,13796628427585404356,10939760396075088770,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4432,i,5741006214754727706,9455435192175478189,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4488,i,16229181834107587267,2874412232445233877,262144 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3492,i,1269258181406386461,9530282890508892025,2097152 --field-trial-handle=2336,i,5629922084102665517,6590756500220399831,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f8598c719facbe828030a8e72187bcacdc95a4b7be7a1e97d3d11063f6a08011
MD5 a0ed8b840d39e3943ae457e87ee12c80
SHA1 74d3a18a7dea4ab4717cdfa18c446dac550f96ed
SHA512 8db703c8e4ef7fd276aeadcd0151b77ad3c99c5f4cb4e75066fd1d2ef7a2dea701f48c2d06695ef8cbe6aceda856c4dbf3587e81ffffa4e90aa37c38c0aa062f
TLSH
T1BC611B380B5E0482E3A166B1B4E20105717182F9FB9FDE4DEF149DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb2d.TMP
Size 3KB
SHA256 3418dc5908fac08c978184e718ff65de90ccc71e1a08b2af65de26ce1d61aa4a
MD5 60dd59a037e81d1e8fe5b27bbeb9bba6
SHA1 245b76a1d7402d52fe627e25075c44dac6ae8b5a
SHA512 8943f3aa07705bae056ec71216d66abd24f80365b6a9de390d06f6e293c6abd6b856c4f665c6f48033d061e914a145da92a53ad01ac869da6fa839f360d65bff
TLSH
T18C613B380B5E0482E36116B1F4E20104707082F9FBCFDE4EEF148DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 73b80e91d719b5f73cded2fad622bae4ad313facdb6fb6f13282ab294c15965c
MD5 32fb7324adc4facfde2de91bccda4bf1
SHA1 bea73fe4bae22988dc27ec0db1228b3cc40a5b1b
SHA512 007af89df9b64c800dc2ec9c1b71aabf0390d869b1e835fc4d0d28e294b1c819a4523cea97750045b448f695b8fa88a22530763222f779d6990d0b25b69f349e
TLSH
T1BE117DB3C3E5866E890516F0AA24EE1BCE2D0606421C7C2989D4FF2B93E3075D50295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1cc477e813d1db04018b034425cb2deda166ef210546db4b4f5023c227b856f7
MD5 92ce520764d1d8921f1bca68f00ce54d
SHA1 d22bcd543cee9a4fed7cd12eda4705f1927a03f8
SHA512 0fef387cd30c028cd7bfeb6d4d2fa5696a29643b8982bedf1686b53b1a2790532e061ea0df152d14d2665e15c0b73074a7568ca5ccd3e4a1f1a249f48c363599
SSDEEP 192:sxZ1RyyM/jK1Ml8UQ3kV/fSs64xJkbIdpSOHW6+WNGY9ISCMQIg5ZJ:sxZ1Eq0V/fSs64xJttHbG99
TLSH
T19552F816AA34A977CCDBD30DFA41BF53D6F4447292940E54A9FCDA1C00E6AED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 28566e9b9aa3856d25f4b71b77cd108e987fee4e6d14c4252f0092bc347ce820
MD5 835225f47bd2a6a28765b8c0f412b954
SHA1 980521f210eb1be3edd001a110d4b9fb67870da1
SHA512 2f9a912cf6d9977f9c63ae370d13557a3bbc58e06eeafafa6c498635903388dc724c937b065ed2b41d369362631bea6baeb80a6b34b3389622a4c57ef5211213
SSDEEP 192:sxZ1RyyM/jK1Ml8MkV/fSsp4nJZbIdpJHW6+WNGY9IorMQIgrJ:sxZ1EMV/fSsp4nJOJHbG69
TLSH
T16542F8126B34A977CCDBD309FA55BF43D6F8047292940E54A9FCDA1C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c4686e558f3a65c6bc6f69e582fa59a4f448ac9e4a64dbcbf657571a279b81df
MD5 da1b41963b569d2c4560763e0ba23693
SHA1 898651e2c62e1701b96da092589bb84d5808228e
SHA512 9becff54eb41832c12d2c7f163d97bf763ac88f06e538ba27d8521af465c8c0e6f5c2f153b782fb0e706c65028054c1ab6324d5b6bee6c2de517d9d342ea60e4
SSDEEP 768:6zcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN9roWg6NA:6zcv21wWvu+Z+u1jaeFLeRN2WdA
TLSH
T147D20A2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 99d8b13d23c32240e6604119cb211ef80336afce61ea20c567f6a5733cedf66c
MD5 1f972baece52d4c85499da88f186f751
SHA1 606fc63be5e7a5849065d1650a84a775097cfacc
SHA512 acf8e8912f6226ffac1b543af9ae8e6d989717f3ce38f4ab722f20034ce802058c31c86ae19231b1b9798eafc7114fcf31461872c99896dcefd976109249c85a
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDW6A4KpWuvwFkA+KOgqCbz44gKA14mgUI4D:mT8fx7
TLSH
T1A4917101317F06812C3F684EB2A689260F4231637459A56FBBA904E35E67E5A1DFECCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5956a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5956a2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 75c3f23de518252b53daa7e202837f13a195bf122bc93590c43b47a1861782ee
MD5 322d12fdc7f1efb774f38e48e049e95c
SHA1 2bd3a224e5d0ac6d34ae3e9a1e43b3214ee58b84
SHA512 fd351294a642bbf622beaa2ab148a1f2a04b9af13b62355ff2d8db8733d85ac0f6cecb9a437924a70350ce5146192e5403fa4ef3b3ae64014cda4163a888f6c1
SSDEEP 384:0MsNc3ul5zimAeue+CBd0esvs6HlytEDq1HKDG:0Myl5cCJxsvsoy6DqZj
TLSH
T1F5725C3598B41C374EA7A255F44B39139FB44063DAD93F94A6ED6F1C02DF2E8230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d1442c8f658bb9e3df059e964a2e03c6b4f7de99ffbbdcbdc1b2725724d09ca
MD5 35cefe74c356f15a4028ced9bf65cd78
SHA1 eb7a74b742ab710f9baf4610307230a6a36f0aff
SHA512 a5bcf1bd36e0d6c299f986c2f0caed8b5abcd0452a2c2dfce3fce8332504f01f41b0fb86ecc2069402b2b64f561ea0df54350cbb4408e8b100e1f2b5e5120ef2
SSDEEP 384:01ZcIhsNcWDul5zimAeue+CBd0esvs6HlytEDq1HKDI:0Nhnl5cCJxsvsoy6DqZD
TLSH
T13A928D3198742C375AABB215F48739175FF88063EBD93F94A5EDAF2C01EB1A4130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 859f05f2525c5cfcde4e9e14342ac33d2a900ef6f5bc4facb082f98c451f01a6
MD5 0da10cbad60eba99aaa166ba6ce79ede
SHA1 f692585af4c9667423769f60ccf64ec1e3dd5ece
SHA512 0907fa3932b7d2d7a79607b4b7028a18dfd41dac1a467f16a9438321ecdc0aa6d1c14b44a92857caa79e1634b3868d5730d8323736e3d3238694d45dd47140e0
SSDEEP 384:iJiFiZcIwzsNU8TUNTUlIlpDul5zimAeue+CBd0esSs6HlytEDq1HKDI:igFQsdwgml5cCJxsSsoy6DqZD
TLSH
T116A26D3288A4593B9EBAAB45F84A35139EF44063DAD97EA0B2DDAF1C01DB1D8130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a17502b44df54f6083e7e64b573bf1f658d78c8d327e8f51f35b55a1c2276e31
MD5 5165ea282b943e28f0417934e116231c
SHA1 cab69a7625fc1b632140bfb0fe76fe9eaa5e7055
SHA512 26e9fd646663288562efc9e584e640890a71e25ff4bccb29e1292445a66af1e8a8be7a32e3c1b9fdca33ff1d5e0bcbae058bd7163c72b6c4dffc179128409280
SSDEEP 192:JONa6v+YLNQmiUykXZh+CGD+FdeP9ospusn2AU6:JONa6vz/tZh+CBd0esJ2AU6
TLSH
T1F902EA35AC382C6B9FF2AE46F4873A175FA81177E9953F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b4ebb00523d8e7d461989f95ca22848fd641194123dbbcdb68e639083b05ecb3
MD5 798e74f081bacd8fece612ec2fcd31c4
SHA1 118cd6639744e6bb65393f72151dff880130a0ca
SHA512 06735b7695274075e683cd5bb450744f70577be824f14ac74fe4e10a16c0ba11577fd0e75e3860ee79c2ee5eabaae7352ce916912c7b6bbaff6e04e7d856a713
SSDEEP 192:fONd6v+YLxQmiUyMXxh+CGD+FdeP9osNOeBqCHGqJyU6:fONd6vzrXxh+CBd0esBsU6
TLSH
T1C5121935AC786C6B5FE2A545F48735139FA49133EA8A3F90E5EC2F1C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cd3d8dce526fc322143937497bf430790251887bd594b520dea473928fc8c8cf
MD5 fc7b97a659c7c79a22e3a3f0d67f5c46
SHA1 87382580451b9ef8a6574ed36e92ae4e332815e0
SHA512 03ee01b18031afe0c7f5efc6eb3b2d12aae5b084a51a8c6461908d54da6700a2ceb58b4e9cd9380cb837cb8c302e5610fe2d9526809ef2417c762d0eb873ce7c
SSDEEP 384:K1ZcIhsNcpDul5zimAeue+CBd0esvs6HlytEDq1HKDI:KNhAl5cCJxsvsoy6DqZD
TLSH
T1BC928D3198741C375AABB215F48739175EF88063EBDD2F94A1EDAF1C01EB6A4130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d97f562-a5f9-4f6d-b018-dd7500f3f415.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d97f562-a5f9-4f6d-b018-dd7500f3f415.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ed664915621d07a2750301e761be42d4d6000d3176a8de6fd0dc1a0d96d51d96
MD5 0cf0ab62b59a1af755e9d3f82d215f77
SHA1 ee899d65400bce4811f8c9dbc19d5826cee9f6a1
SHA512 2c72ee3fbd51e04c4eb22ad5c12211c046e52f86f4bae4f387061c7e80605f82380f6740f6e36ac061ba2f37ba0d09501bd2f6bb6734942fe5b997db0f6c63f6
TLSH
T11941E358BAE91148B3B77E5AABFAA86D487FB9373E07845D10010E4F0662A40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download