hxxps://redhorizon[.]digital/export/candidature-selezione-2026

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://redhorizon.digital/export/candidature-selezione-2026
Sample260717-ppsshafs5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287650494144317"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{1E2FA046-628F-448F-9A06-2A0F8A60C46E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 4360	4852	msedge.exe	86
PID 4852 wrote to memory of 1412	4852	msedge.exe	87
PID 4852 wrote to memory of 4360	4852	msedge.exe	86
PID 4852 wrote to memory of 4360	4852	msedge.exe	86
PID 4852 wrote to memory of 4420	4852	msedge.exe	88
PID 4852 wrote to memory of 4420	4852	msedge.exe	88
PID 4852 wrote to memory of 3468	4852	msedge.exe	90
PID 4852 wrote to memory of 3468	4852	msedge.exe	90
PID 4852 wrote to memory of 3468	4852	msedge.exe	90
PID 4852 wrote to memory of 4508	4852	msedge.exe	91
PID 4852 wrote to memory of 4508	4852	msedge.exe	91
PID 4852 wrote to memory of 4508	4852	msedge.exe	91
PID 4852 wrote to memory of 4184	4852	msedge.exe	92
PID 4852 wrote to memory of 3964	4852	msedge.exe	93
PID 4852 wrote to memory of 4184	4852	msedge.exe	92
PID 4852 wrote to memory of 4184	4852	msedge.exe	92
PID 4852 wrote to memory of 3964	4852	msedge.exe	93
PID 4852 wrote to memory of 3964	4852	msedge.exe	93
PID 4852 wrote to memory of 1704	4852	msedge.exe	104
PID 4852 wrote to memory of 2216	4852	msedge.exe	103
PID 4852 wrote to memory of 1704	4852	msedge.exe	104
PID 4852 wrote to memory of 2216	4852	msedge.exe	103
PID 4852 wrote to memory of 4472	4852	msedge.exe	106
PID 4852 wrote to memory of 2288	4852	msedge.exe	110
PID 4852 wrote to memory of 2288	4852	msedge.exe	110
PID 4852 wrote to memory of 2288	4852	msedge.exe	110
PID 4852 wrote to memory of 4708	4852	msedge.exe	114
PID 4852 wrote to memory of 4708	4852	msedge.exe	114
PID 4852 wrote to memory of 4708	4852	msedge.exe	114
PID 4852 wrote to memory of 1916	4852	msedge.exe	118
PID 4852 wrote to memory of 1916	4852	msedge.exe	118
PID 4852 wrote to memory of 1916	4852	msedge.exe	118
PID 4852 wrote to memory of 2092	4852	msedge.exe	121
PID 4852 wrote to memory of 3232	4852	msedge.exe	122
PID 4852 wrote to memory of 4824	4852	msedge.exe	123
PID 4852 wrote to memory of 4632	4852	msedge.exe	126
PID 4852 wrote to memory of 4632	4852	msedge.exe	126
PID 4852 wrote to memory of 3968	4852	msedge.exe	127
PID 4852 wrote to memory of 3968	4852	msedge.exe	127
PID 4852 wrote to memory of 3968	4852	msedge.exe	127
PID 4852 wrote to memory of 4936	4852	msedge.exe	129
PID 4852 wrote to memory of 4936	4852	msedge.exe	129
PID 4852 wrote to memory of 1016	4852	msedge.exe	130
PID 4852 wrote to memory of 2656	4852	msedge.exe	136
PID 4852 wrote to memory of 2656	4852	msedge.exe	136
PID 4852 wrote to memory of 2656	4852	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://redhorizon.digital/export/candidature-selezione-2026
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffade1fc188,0x7ffade1fc194,0x7ffade1fc1a0
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,17770507395365745906,10835627778095835150,262144 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,11275802011083522008,3772456198436238162,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,16860965701855698083,9861123401522317057,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1182715891991854338,8701602409644439158,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,2172734845109915428,15057848617554086474,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,5942371668729117341,7741864965673655143,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,11059780663442874487,5835214159797399092,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2627300920117570812,519942359957443162,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,6933058215137232292,1369256197773981900,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,18269674150664944422,11332453763182093319,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,18269674150664944422,11332453763182093319,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6356,i,15920418888544086803,5558563662786303230,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6276,i,6616022961025867778,9703313786975630879,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6256,i,2455788186589708968,15648297257685381496,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,5217062145417723844,1135073948992885566,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15963487575172761077,5849002361967517264,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,13299594907312235961,4157413806528881680,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,289465413818178718,13914766989064024882,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3560,i,5207700362675278981,1737041222123003760,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,15694711064002060616,14780189395133471032,524288 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5188,i,12141157619057645524,11371604765664474770,262144 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6452,i,7959051195151707115,12370284195155078618,2097152 --field-trial-handle=2516,i,13411375274867605918,12874793258959443636,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f5cff10756c061ae3f373620bdcfda25729299233001266db0a4b9ca17d69b05
MD5 05c10f66a0af19fe29b01ff0e585af4a
SHA1 0606678307a4e87ab6e94f18c7d24c74d02707d2
SHA512 aaf54b41068d6ea0886ba8f38b8ecd2d9cee4afc042f733a134f2825a2e25e552067db22d10d56fce937d47d3c695485473d7020c3ad131ad3efa3cd505db6f4
TLSH
T1F861C5710A9312B1EF15C63294DD025D3773C6F7FA1B6E8990809633B61231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58701a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58701a.TMP
Size 3KB
SHA256 9acb96bb242377f64477971c409ad87ee892a72edb2ecacfd9299c2658ce06c2
MD5 c44886b0a39d9f971b61c75d263dc8fa
SHA1 ccd23582a73b371a4ca739334b6cb402d2e59265
SHA512 3943176cb0742e4b014eeb142b26aa8b12f7898524650a041465324b95c330c32d0155213a0fe5c07fc6cfa8926af215c34e587e755727b32f78acf5c123033d
TLSH
T12961C5750A9312B1EF14C63294DD025D3773C6F7FA1B6E8990809A73B61231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e20c02c12df3c1200e33b7eceb3e48849898ad83baa3eeeaf15f7402f2e536f4
MD5 1b08f3e2169632b881ca5569f1a1639d
SHA1 7efec8940936c5ad2c955172975841b43ce22e23
SHA512 c2646a1914ec574fc28f23e446a1a72a307446522bae5b8687096a76761384cd6718de9051eb172db50af7790cedfa8aa2103d71ef4297500cdc3d9c93e9a625
TLSH
T1D4117DB7C7D5856E891156F06A28AF2BCE2D0506831C7C1989D4EF67D3E3475E00159B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0b1d9b0fe43d70c533119b2b0fb80ca0f845efadc92eb44639c5ee4e2aff83c0
MD5 f0183736a72cba8465d3e29c968bc2a6
SHA1 be9518d46a30f700fc5e3dfe64e0b7209ff6a16f
SHA512 76df6da6410b5a13cd12e33c4f857b496862e3e6f56edfc2ac397a23b9390af1904998b67665e5ff87ddd28e1320e8733f0602c6903cb844cb35b0aeb01d6949
SSDEEP 192:sxZtiRayM/jK1Ml8Mk9/fTsiqNGVvIdpv1HW6+WNGYvrgjiiVIgrJ:sxZtigM9/fTsbNJdHbGpH9
TLSH
T1A142EA126A346977CCCBD21DFA55BF53D6F51472A2900E44AAFCCA0C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a9ac1b75024244181cb9b3959f452b034c5f1c38a627c96bc1fcbd3dce0585dc
MD5 208ce795255e333e539e7daa408da7f9
SHA1 c0f3d170109eeb492ee2f529c1d2b544bcde7f92
SHA512 14348a97fd91b5aba6c353375f151c71e3dbdf57b39d2930129716523de520dd10c1927499bb490f2d8342e32ecafe4a16c599ced0615caea1dd7d8964157267
SSDEEP 192:sxZtiRayM/jK1Ml8UQik9/fTs5q7GVvIdpx1HW6+WNkEb/YvN7o3jiiVIg59J:sxZtigqh9/fTs47JrHbL/jHl
TLSH
T17F52EB126A386977CCDBE21DFA417F93D6F5547292900E44AAFCCB0C05E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 90fc151e62fa76429329f507b597b50f406cb9a5aff0f574b4cb0c440761ee06
MD5 fc85badb403d29ab28a21122142d779b
SHA1 f68eb2fd8b08fb24eb672090d1680f902bde3da5
SHA512 7415b90b9e6869629e41e784133cdd7616b66251d4ba4c8a717eed835ae0f39767f0ba05059c626a8c1dd6a6e87fcf3084395741f15f9bceea3894c1fbe887a5
SSDEEP 768:lFseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppGroxf:lFseJ3xWvhfynu1jaVcL88p9d
TLSH
T149D20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487FA880C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6849c291a175dfe4bef8bbac19e94b0834770b979a104e6f370f9a13df0c2631
MD5 adb3637d5cfaf7304be00a81c35a6a1b
SHA1 743a30096ffd54054a27d6efc085e42ec0b90873
SHA512 26993580b24c3fee3071662e4f9afa20a5519b4588b9c59c1da1daab202ed3660ceab405ca19eee6f01cd197822687040521b3ee21efc08102997cfda9d8d66f
SSDEEP 48:KYHIhKggkXySdIxK+cMjyZUIXK1Wc/y/afQMy8Qzz:KYH+KggmBd+K+ci6UwK1Wmuz
TLSH
T17C91694774BA02013CBE295CA2A5D5358E8171A77618B86F7FB800661F67D110FFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4747e03-7e0d-4ce5-b4fb-2b4e7dee86fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a4747e03-7e0d-4ce5-b4fb-2b4e7dee86fa.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a45fcfaf2036336346d5e9c64213ba5d721d533dfe4c14c7aab83b283287666a
MD5 d2564435aa5fef1e0d1ab08409891434
SHA1 5a9c25bf8df4380fd52932c63be41bb354f3c97b
SHA512 8f3a6570266ce55201ee57267c9a1b0d6847afde9b6e232a443172601c466e1695cde3b6431fd6966ec04ed718110ca42732aac0a809755f47ae8f20e60a5be9
SSDEEP 384:/tNn/s3n9SfsNGfmGc7I/GizFIKPlkM+Lh:/j+9UsPRIFxl7+Lh
TLSH
T142626C726C68ACAB6DA3E195F44A37035FB485AB93C02F80E5ED6F0D00CB25C1307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 77709007b1d54c9ff976f77e6e92968d6ba50cd7bf6e5cceab7c1001c4099eb6
MD5 b0ce2a57856a92816a23417ff8473c3c
SHA1 11fbf3bf71cd435da7f9e8c746be95818b8718c5
SHA512 d27d0fc8d943291ed6da1ccb0e5302e78317176fb60a9bb3865f33aeba54928d29c65f581512c4d3f1d7d7f246b6e3e0c4ef6dff190f465a5bf29b1cb97c626b
SSDEEP 384:KiF1tNn/s3n9SkzsNG8TUNTUlIlSmGc7I/GizFIKPleQ+Lh:BF1j+9Hnwg/PRIFxlR+Lh
TLSH
T19C823B735C98DD7BADB6AA94F94A33038EF441ABC6C0AA90E7DD6E0C00DB19C1307E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fd9d0de01d9f8d87ee0c3c6cb9e3d64d40d89720856c9af674a6db52c9f03386
MD5 20a9d78241dc3ae50a4ba5341abd7ebf
SHA1 07893b4b68735e4186baecddfa059a23c061ce2c
SHA512 c733fd6db6d9d204d211224e1c984e7acdae7ab2df4d8fcbc4c8c9883e698a44824feb56925dccaa419bf62be94fc71dd948b94836a4257eae936f59c431b2e0
SSDEEP 384:YtNn/s3n9SfsNGSmGc7I/GizFIKPlkM+Lh:Yj+9UHPRIFxl7+Lh
TLSH
T1D1626C726C69ACAB6DA3E595F44A37075FF485AB93C02F90E6ED6F0D00CB25C1307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f93633778f2fad13085ac5185f88b73cc4145171aa93d76e5ee2acde2ba84431
MD5 a2f5ef7aa41a0890a40cae3ef324defc
SHA1 a136d107fbb3e7af3b76e0f44262259a8cd6c3f0
SHA512 db1cb0e523693a52dd4f5cdbd0868f13a5d5ef631c49e5ce4570e1a99ffadad9f983a2accbde79d28288de3a15d9e15b81509047a9649e09f6187d427d8eae80
SSDEEP 192:lONG6vMtPQmiUyDYThTobWCIKp8473LU/u:lONG6UtRjTiFIKR7U/u
TLSH
T16A020975BC686CBB9AA3BE45F48E27171FE4516BA6D05B50EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 784bf84d81d45393b4cdd8f216ce9028c9073bc47f654effc0cdce11d8396892
MD5 6a4b912096f6e3960b7f7ce7f2c22861
SHA1 2a4b88fce78367da3dd2075dad98c10cbbced377
SHA512 314173c3f7a1547ee2a67ab7c1b500811bf58fb78da060b797a2ddc356700747bbd05dbb1d8ddc7dd9a515bf7ec7815b3e8020d648ccd25d830eda7a477275aa
SSDEEP 192:CONP6vMXPQmiUyAZY/GhTobWCIK++WyiVH80ICqD6xU/u:CONP6UXRI+iFIKPlL+U/u
TLSH
T1EE120972BC68ACAB6DA3B551F48E32131EB4826BE7C49B50EADD3F1C00DB56C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cfc1568-f2c5-4cad-9f85-108e1a358324.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3cfc1568-f2c5-4cad-9f85-108e1a358324.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef8b20f0356736c7a6fd208ed50823b4d14ef6deb940e50d0d32baa0d3b95d55
MD5 f5c6b17f4740cf50461b5f111fce519f
SHA1 5bd23b85f3276fe997d840c579376afc3abc46af
SHA512 b872c22fc0fc2ef5d840c4c86ba82825e866ab020c76e8793cf58c571d3e7509be882e271a9e31f425d5e691909e1efc6dee52a66f0457cac5d3b52ad6febe25
TLSH
T16D413C5CA6F91148B3B76E5A9BF2A86D487FB8772E0AD45E10210D4F0672B41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download