hxxps://cstors[.]sogei[.]it/invitations/?share=5a0a2767dcf2eacb9361&dl=0

Analysis

user interaction
yes
max time kernel
269s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cstors.sogei.it/invitations/?share=5a0a2767dcf2eacb9361&dl=0
Sample260910-rak58ax1fx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335223725345084"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{880314A4-BA01-4036-A174-27C8126ED407}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
532	msedge.exe
532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3340	5000	msedge.exe	84
PID 5000 wrote to memory of 1188	5000	msedge.exe	85
PID 5000 wrote to memory of 3248	5000	msedge.exe	86
PID 5000 wrote to memory of 3248	5000	msedge.exe	86
PID 5000 wrote to memory of 3248	5000	msedge.exe	86
PID 5000 wrote to memory of 4216	5000	msedge.exe	87
PID 5000 wrote to memory of 4216	5000	msedge.exe	87
PID 5000 wrote to memory of 4856	5000	msedge.exe	88
PID 5000 wrote to memory of 3604	5000	msedge.exe	89
PID 5000 wrote to memory of 4856	5000	msedge.exe	88
PID 5000 wrote to memory of 4856	5000	msedge.exe	88
PID 5000 wrote to memory of 3604	5000	msedge.exe	89
PID 5000 wrote to memory of 3604	5000	msedge.exe	89
PID 5000 wrote to memory of 1428	5000	msedge.exe	90
PID 5000 wrote to memory of 1428	5000	msedge.exe	90
PID 5000 wrote to memory of 1428	5000	msedge.exe	90
PID 5000 wrote to memory of 3196	5000	msedge.exe	91
PID 5000 wrote to memory of 3196	5000	msedge.exe	91
PID 5000 wrote to memory of 3196	5000	msedge.exe	91
PID 5000 wrote to memory of 4992	5000	msedge.exe	97
PID 5000 wrote to memory of 500	5000	msedge.exe	98
PID 5000 wrote to memory of 4992	5000	msedge.exe	97
PID 5000 wrote to memory of 500	5000	msedge.exe	98
PID 5000 wrote to memory of 1076	5000	msedge.exe	100
PID 5000 wrote to memory of 3344	5000	msedge.exe	108
PID 5000 wrote to memory of 4980	5000	msedge.exe	109
PID 5000 wrote to memory of 1704	5000	msedge.exe	110
PID 5000 wrote to memory of 4292	5000	msedge.exe	116
PID 5000 wrote to memory of 4292	5000	msedge.exe	116
PID 5000 wrote to memory of 532	5000	msedge.exe	118
PID 5000 wrote to memory of 4756	5000	msedge.exe	119
PID 5000 wrote to memory of 3956	5000	msedge.exe	120
PID 5000 wrote to memory of 4756	5000	msedge.exe	119
PID 5000 wrote to memory of 3956	5000	msedge.exe	120
PID 5000 wrote to memory of 1592	5000	msedge.exe	121
PID 5000 wrote to memory of 1592	5000	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cstors.sogei.it/invitations/?share=5a0a2767dcf2eacb9361&dl=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffbc05ac188,0x7ffbc05ac194,0x7ffbc05ac1a0
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11077126507974859844,10753145969704747467,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16622824031375124522,3900494223933154972,262144 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,12946990710482844427,2461125263723058005,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,11023773531910962543,13459171716327339232,2097152 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,4131509391064589369,12016423003956444818,2097152 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,11809283140396517692,9140820307765125361,2097152 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,9755671246466701534,2196487218020348693,2097152 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,6795873703374546276,16675154791886942267,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,13969527335117345795,10448239288471555277,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,5749699255077581760,4090829779239285567,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,5749699255077581760,4090829779239285567,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,205326153614677984,692096447553598251,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,13902702546579797409,8835651206860036352,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,7190164215835926079,8644214796243417503,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16556986479267894244,9612588411061664401,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,6056409762446608664,5636843121126706919,262144 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,16943686869470585910,10755331244581522717,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,5115008334905732228,279524961222440688,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=652 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,1846653174672098185,1673907338035481987,524288 --field-trial-handle=2308,i,17967252337500983077,8684425875670574179,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47392bda-b9bc-4121-81e0-ee94edc972c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47392bda-b9bc-4121-81e0-ee94edc972c6.tmp
Size 15KB
SHA256 4806e0b269f5ace3ae9534d44fe864a20b6acb0edb0ae5ae1bc4caab2ebdb40f
MD5 f5bd71f28f1be9cabe2be5aefeb72707
SHA1 ffa332de11824c93d5f8b3d4de37c6d2c02d1e60
SHA512 c6aba281e0acdbb28cfbd70fa89bc0d912cc8dae11aee084469ee6ae2711194c57ee6ced8f39dca3187df4a6a99c694e5495d56e714d5642eac7d5d056c7231c
SSDEEP 192:uX7m+xasuheOwQxMGsNWeoZXQdIdrnLM7U3UQmiU1wbBB4MTW0+FdLuhpFd3EZXT:kIZcIhsNW/hrnY72kMBu1dyZdUeVauw
TLSH
T15B625A715C786C77A9E3F145F48A32039FF49167EAC86A40A5EDAF1D01DA6A8130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 09ee75ec9db207a32545984beec997b9a0ca9816e6b8d87c7ea7af8add3b1df8
MD5 22f8e3c5f6559d1e8739d84e1fc88d32
SHA1 d223b1ceb1a8ffabc2727909aa34ac2e2da99b09
SHA512 99b59fa4032e15ad328aa08d56db0ebd6986228649ea3896702b4cdfc6cbe365c5ed8f4402b932f7f04fa88dd9c4a2f3ddd9333bbf214d76dcdeec9641e88ad4
TLSH
T1B8815E740D491051FF200A33D0E50636FC71A6EFF15FAE1A2B5E9275EA0734A128C157
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588bef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588bef.TMP
Size 3KB
SHA256 33214a4acc13bb7dc175dd16fa8180678798b0fab29d311013239421dda8f676
MD5 6d54e5dac07c73e1023e8f889147d009
SHA1 528f9031483638394ab6fc9b5e7c1baa27b1b0ab
SHA512 bb914137fe3009fef75f3c64fdaaf1e8771a0dd6ea7095f7f7ae85e3f34df9a0452cc65c70fb4f53f76984517c2a380299fbfcab784ea6e8e89c81aca0c899df
TLSH
T17A7127340E0900A1FF200A33D4D50239BCB2AAEFF61E2E66234D66B5EA0234A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 600B
SHA256 f019ec9c28e483914758f7e95e3f736380fbf0579469fb5a94de41bd46b165b4
MD5 f583c2d6255802c18c5194fbe6204d7a
SHA1 6d06e6e71bdb3e8c6bd08bec7bd45ac31a4c9173
SHA512 0ac884db0179efef85f57d5d14b3a38aa56f49788bf517d85eaa8aaf6c6d0c859bd19fdaa2c636671ddff0a0fb9dd53b74930c192d9567a74063d902a6a7962a
TLSH
T190F028F787B0956E8A1192F09918AF1BCE6D0503835C7D5A85E4AE2B93F3468E101D9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e917171d943595cf24ad319ad0aea1f3e00b3f2f87ca7dcf0903e7ec4b4285c2
MD5 960aa32a346c563599838384d98fc39a
SHA1 cd614c22056752f0e66866c91e9c7f7e61db2cc8
SHA512 bc52a9db28efde6d3a805641c0d8c026ebd649e8f26e7e9714a02313aa39ea40d32bfc93e2db369d2c5f55a45e01f357ad54a02773b2979499a5cb465a829084
SSDEEP 192:sxZa/yM/jK1Ml8UQYWZ/fRsIj6VbIdpRjHW6+WNipGXYvzWfhqZIg5fJ:sxZa7qzZ/fRsIjxdHbNXZ43
TLSH
T13A52D615AA346A77CCDBD209B945BF53D6F5557292900E44A9FCCE1C04E7AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d9ea2ee281417c98029ce649e0728989cade27961bc955ad87a853c0501e3c54
MD5 68da28bf2ba3731c7a529ff9541dc6bc
SHA1 db3287d39d9ab081cbd7718ce0c4c26510fed80d
SHA512 cd8ab7acb743f3a94b71fc50864d52e12747ef38998ed1b3d561f1640eb33e808f678fb271f3c01223c1b8849b050d40040ed9e3a80d104cd4b7c0891f16f2c6
SSDEEP 192:sxZa/yM/jK1Ml8MWZ/fRs26VbIdpHjHW6+WNi1O/YvMIqqZIgrJ:sxZa7uZ/fRs2xDHbj/T49
TLSH
T17842E6056A346977CCCBD20DF955BF53D6F95572A2900E44A9FCCA1C04E6AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6c17e90894750e848ef92e07071430f39c5c045bb140336442227d0960fd43c6
MD5 d408c9884f6db879c86af7daa820a08c
SHA1 2c2546efaf5648842d6f041e4772ed863fda62fe
SHA512 1126aff96d1176d376da16a8cfb7757fedb8988c8c089187102409d1cf5de819e57344255512e84673f14983e1445450f93973ba671c8f875f973beb5095f140
SSDEEP 768:0+seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppjro2l:0+seJ3xWvhfynu1jaVcL88pQ4
TLSH
T14DD2FA2B280CCB7E4F844E5DEC2A6F966EE801CB57984D5487FA884C02C76EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 01b07dbf532997a48177ad6b6192f40d0a4f0411004097c2729e90128fb5728e
MD5 1ede871ddafc4b2045b1cc55a3889542
SHA1 e20ea1fc6ce4331b848339216a8f4da4dc8fba9d
SHA512 9a5bae03ae02635b85c22c95324b8ff4b739f729a976f35dbb111b35d68e15c1f8627b7a9ae4c3725fa26573fa90315518bd4a30afef0566872260a0b6a0fc3c
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiwfzvzyzDzfzhzdzpzcz:KYH+KggmiAgK1KyODKKkU2yesKLicz
TLSH
T160C19612713F02023C7F395CB2AA97379E4135A33558A8AF7BB800655E6AE116DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa8ad6e8-bdcd-421f-8f0f-35bedc5b0e05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fa8ad6e8-bdcd-421f-8f0f-35bedc5b0e05.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 32073f05ce7d626e71cbb4d431c8126555c7ab090e706a96895b13c3217195e6
MD5 7a009d4957cd6ada6141c1352bbd7b07
SHA1 477c7fd2dd43338c604a7670bf37522e9c7a7f65
SHA512 c9d3dbd047d7168999e56f07d64aeab042d0a511372239a3fe41841b7325d435a7094bad17ee2fad8b0419acbba80bd5c7eff9cba97474b835102cc01a020ef0
SSDEEP 192:u3m+xasuheOwQxMGsNWpoZXQdIdrnLM7U3UQmiU1wbBB4MTW0+FdLuhpFd3EZX8+:/ZcIhsNW6hrnY72kMBu1dyZdUeVauw
TLSH
T193625B715C786C77A9E3F145F48A33039FF49167EAC86A40A5EDAF1D01DA6A8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a2561063afbb49ee8a65bf83a1133f21e4ce4658926e58e38e1c870391b07e9d
MD5 442808249865b2f7f4347ff5cd6a9db7
SHA1 e3c46528fb1155f67eadc4abd70a74a15310679a
SHA512 35a27a0eb3542a18a28d41473e26d1579bfaf4eaf379099fff11b8ae171c91b7c9c4344f637f4cdede4c413d132acf1b3e3f6977c0c690dc7e905c51a0b8fc90
SSDEEP 384:8XiFiZcIXsNW8TUNTUlIl/hrnY72kvBu1dyZdU+Vauw:xFQXrwg3YpqkU+kuw
TLSH
T106B219F248D7983AE9AE9747E77D2E038EBCC067B5849950B3D85A0DCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 120a30439f0f9f18330472bb66570862fc491cdc7942d713f29550e1ebf40d1f
MD5 562cfc8ef350bf8969050e6631b67a8d
SHA1 45269f4af868d95f138a996655e59364c6831b33
SHA512 e3c06dbf2f0c846722b3f4de7202475d2afa74f8e0786f2cefa6e79a56e2b98999345022a9c818537b04df298477c61d690262b07097f34985b69ffc59be06de
SSDEEP 192:zONn6vMFPQmiUy3+MhTW0+FdLuhpFd3EZt80IfrqYaU/u:zONn6UFR3MudyZdUMVaU/u
TLSH
T1FA120B756C686C67AE93B545F08A32175FF4816BEAC86F50EAEC2F1C01DA6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 195b952c6a53d8a1d2f0fd19ae0f9df48242b6df8cfef7f87a4a8540526a8bcf
MD5 4388db78a3e040183a62436e42b89052
SHA1 f9c183b0438109b062681c1ec976973a40b65710
SHA512 5e2a3fd0ab9512a38dd3e02c1cdcf889cf7e8d5d3f53a11f28b147e259b112e6d04d3d204188ec070926f5da824593426c40e592bb52f1c5ea4709090c4b12e1
SSDEEP 192:lON06vMtPQmiUyF+ThTW0+FdLuc847rbLU/u:lON06UtRnTudy+HLU/u
TLSH
T15E020935AC786C6BEAA3AD45F48A27175FF4507BAAD05B50EAEC2F1D00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03f6e0ee79257441655de0c990a09a312a80b2fc5da3d9a13f442024c030d833
MD5 545ec260c9a2f8d694ac7e6bd070bb0f
SHA1 b66335291bf2457ca9ff0c2325b6329b320b2139
SHA512 18fd1d798a1c5bdc9e3049927559f0d1c832b9dd683844cc4b75b578a066ef77837342f876feb43408ffa40e24ca10a62145407a714a1af19efb76bb13fcb482
TLSH
T14141F858A6FA1148F3B36F56ABF6A86D447FB8772F0BD59D10110E4E0A23A45C871733
MD5 SHA1 SHA512 TLSH

Submit Download