hxxp://t[.]digital[.]diesel[.]com/r/?id=hcd4fe1e0,22dec6bb,14086e95&p1=public-resource-4896531063069088[.]s3[.]ap-south-1[.]amazonaws[.]com/jcho

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://t.digital.diesel.com/r/?id=hcd4fe1e0,22dec6bb,14086e95&p1=public-resource-4896531063069088.s3.ap-south-1.amazonaws.com/jcho
Sample261014-rpshvaes21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{A127ACE2-DDFA-4DE4-9EFA-A63599DD5469}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 4776	5532	msedge.exe	86
PID 5532 wrote to memory of 964	5532	msedge.exe	87
PID 5532 wrote to memory of 3064	5532	msedge.exe	89
PID 5532 wrote to memory of 3064	5532	msedge.exe	89
PID 5532 wrote to memory of 2828	5532	msedge.exe	91
PID 5532 wrote to memory of 2828	5532	msedge.exe	91
PID 5532 wrote to memory of 2828	5532	msedge.exe	91
PID 5532 wrote to memory of 5276	5532	msedge.exe	88
PID 5532 wrote to memory of 5276	5532	msedge.exe	88
PID 5532 wrote to memory of 5276	5532	msedge.exe	88
PID 5532 wrote to memory of 1720	5532	msedge.exe	90
PID 5532 wrote to memory of 1720	5532	msedge.exe	90
PID 5532 wrote to memory of 1720	5532	msedge.exe	90
PID 5532 wrote to memory of 6060	5532	msedge.exe	95
PID 5532 wrote to memory of 6060	5532	msedge.exe	95
PID 5532 wrote to memory of 6060	5532	msedge.exe	95
PID 5532 wrote to memory of 2504	5532	msedge.exe	96
PID 5532 wrote to memory of 2504	5532	msedge.exe	96
PID 5532 wrote to memory of 2504	5532	msedge.exe	96
PID 5532 wrote to memory of 1028	5532	msedge.exe	106
PID 5532 wrote to memory of 1028	5532	msedge.exe	106
PID 5532 wrote to memory of 1028	5532	msedge.exe	106
PID 5532 wrote to memory of 5232	5532	msedge.exe	107
PID 5532 wrote to memory of 5232	5532	msedge.exe	107
PID 5532 wrote to memory of 5232	5532	msedge.exe	107
PID 5532 wrote to memory of 1152	5532	msedge.exe	108
PID 5532 wrote to memory of 1152	5532	msedge.exe	108
PID 5532 wrote to memory of 5748	5532	msedge.exe	109
PID 5532 wrote to memory of 5748	5532	msedge.exe	109
PID 5532 wrote to memory of 4976	5532	msedge.exe	111
PID 5532 wrote to memory of 2776	5532	msedge.exe	115
PID 5532 wrote to memory of 2776	5532	msedge.exe	115
PID 5532 wrote to memory of 2776	5532	msedge.exe	115
PID 5532 wrote to memory of 4684	5532	msedge.exe	117
PID 5532 wrote to memory of 6044	5532	msedge.exe	118
PID 5532 wrote to memory of 4624	5532	msedge.exe	119
PID 5532 wrote to memory of 2712	5532	msedge.exe	121
PID 5532 wrote to memory of 2712	5532	msedge.exe	121
PID 5532 wrote to memory of 5400	5532	msedge.exe	122
PID 5532 wrote to memory of 5400	5532	msedge.exe	122
PID 5532 wrote to memory of 5400	5532	msedge.exe	122
PID 5532 wrote to memory of 5856	5532	msedge.exe	123
PID 5532 wrote to memory of 5856	5532	msedge.exe	123
PID 5532 wrote to memory of 4216	5532	msedge.exe	124
PID 5532 wrote to memory of 1044	5532	msedge.exe	125
PID 5532 wrote to memory of 1044	5532	msedge.exe	125
PID 5532 wrote to memory of 1044	5532	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.digital.diesel.com/r/?id=hcd4fe1e0,22dec6bb,14086e95&p1=public-resource-4896531063069088.s3.ap-south-1.amazonaws.com/jcho
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffddd09c188,0x7ffddd09c194,0x7ffddd09c1a0
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,7812400828270574497,1417300169852722813,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:3
  2⤵
  - System Time Discovery
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,18167819472389500667,4673617694594740386,262144 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:2
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,1857401804018685761,682813422586681965,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3212,i,15032855351460669103,17755595902420740778,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3224,i,13113512478754065400,1788448398128048341,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,3376399224117612715,7413416034171155889,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5088,i,12973678610050709389,1229993694670946273,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3592,i,14588019659036889240,1859135806450080794,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4976,i,16238705759199773811,16370908833865066039,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1809222186304175600,11265351514441352572,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,15184125193031390586,14147520759143155677,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5935660131130215479,145408140682147542,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5935660131130215479,145408140682147542,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3244,i,457860748252633004,13306900885171122698,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,6099542725603912797,2463775301856423854,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,13381964468794867993,14934732194009030135,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,6219693094938647825,3197867762368913567,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,3996749412434071745,6475397605865785526,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6244,i,15423793776865570631,16838743126842270141,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,6965328234307566714,16042766126052128322,524288 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,13452301899683834961,7537901687827094326,262144 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4772,i,3685766376952161096,6245620757815185717,2097152 --field-trial-handle=2920,i,4931922971501592215,5759103167810369051,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13429137-960b-442b-87ee-f8390188f547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13429137-960b-442b-87ee-f8390188f547.tmp
Size 26KB
SHA256 0eaa407eab4ef6c4894e1d89055332ad4cf36092fed6d931b12ba88cc76d8f09
MD5 968c17458ae34b3adc40f1f31d43b23c
SHA1 1f6a5aa09b204c299e78c043cb96c4893ed9cb23
SHA512 2d3d5ec5592c694484490b1dabb51baf4e9900a7d5b806bfaf8dc4412a5abfceea3914117faf08a22498cb0fdd4def3d4ade56d407d53182355e10995194f0dd
SSDEEP 384:n/iFzQkUSvTsNR8TUNTUlI4HaKM/Ha1/w2fiBCWrBP9Y5+UGi75PJAxJKChzgL/2:KFdTkwg9C4BCgBPIrGi75PkJKCqL6
TLSH
T18CC23A72E898DEBBEDE64B95B30A3643EEE05223D58C5AD4D9C92D2C00C71DD534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47602e31-d633-4ed2-a618-e8d7abadbeea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47602e31-d633-4ed2-a618-e8d7abadbeea.tmp
Size 25KB
SHA256 34c5fb79c358e8155e01b56d252dbfbd25556451f825e2e62c14621edadc3c96
MD5 0c50429d116d5f644e150ce1276e24b9
SHA1 96ba480b7d3465ac8d32391c808e4196df1bff30
SHA512 4226d59d1bab7c2804778b6d846abf7a8f7dd4e0e3fcc82d774be902de80ba5b47d52fdf667744869443ef57279cf7d9532ec08207c5755d24e30694d8be2a28
SSDEEP 384:nYiFiZcI63sN/8TUNTUlIm2aKMiB4w2fiBCWrBP9RFlsa+VY68gL/7IzuoA:jFQ63qwgcGnBCgBPvFlhgpP
TLSH
T1C6C23A36EC98D9BBE8E64FD6BB4A3603EEF4026395DC5AD4D9D81D1C108359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4814c1a7-f750-45ec-98a7-a55207fb5a28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4814c1a7-f750-45ec-98a7-a55207fb5a28.tmp
Size 26KB
SHA256 03d1fd744136472216b9635dec9172dc66603afc7729b2ceb99bff2d6fd29106
MD5 4903c29a984134a4744481d58ac99a5c
SHA1 4f813243ed049bd2da2f13b3d4e21a4df87da80f
SHA512 87ba810d183ae992e3a0881e09056fa5d35e8a3addbec1d86b93b7083775d08cb5e9c2ce4834a8d189398d61dff33b053b5e4e7e579bc14b30fb90f5426a226d
SSDEEP 384:nSiFzQkUSvTsNR8TUNTUlI4HaKM/ka1/w2fiBCWrBP9Y5+UGi75PJAxJKChzgL/2:ZFdTkwg9P4BCgBPIrGi75PkJKCqL6
TLSH
T12FC23972E898EEBBEDE64B95B30A3643EEE05223D58C5AD4D9C92D2C00C71DD534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

120208ef-7a75-474a-86c2-1fd9c6184d0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\120208ef-7a75-474a-86c2-1fd9c6184d0b.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d79a02c-5580-49ac-9943-18f133485423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d79a02c-5580-49ac-9943-18f133485423.tmp
Size 11KB
SHA256 b729e48801600b80e0b4e3782e1864caa256cf91feb2c6fd58cc22e16342a614
MD5 b645ffe187690d856afeaae50da620cd
SHA1 3fd1dd90b278db03bff329d8f168145e5151da9d
SHA512 bfb78d34dde9a223dc4050fb52165ac6fbba2866fdfa68450192a37d1a9f02dc0c36ff994aa8608caf11c77fd5cc6779816055528b0d95e92840b62049c12283
SSDEEP 192:sxZxReks/f5sdaQZLx8mzodpJyHdU6+WNoIm/YoU2S89IgjtFjJ:sxZxTs/f5sQO6dkHb+/fSijtFV
TLSH
T1D742E955AD28A93B9CC7D21DFA55BF53D3F91032A0D10E48AAFC9A2C15E76CD620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73624b75-d69f-4f4c-ab87-85674664f103.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73624b75-d69f-4f4c-ab87-85674664f103.tmp
Size 12KB
SHA256 2de8dab8f7b027c6b7458248a1dc099299e228e3668ead339561ce799c0d64cb
MD5 9606d16ea03e9b982f9f4b6ea99ce074
SHA1 b48c1852580c483e6b640044d56fdc444e656922
SHA512 3ce751f34301cf607768487470c9151a5db5491c96736a55edab0d2dcde58132d532e6aa74146d750a8067ed051a1417604e671e045f2ce3267d960070263ad8
SSDEEP 192:sxZxReks/f5sjQZLx8mzodpdhyHdU6+WNoIm/YooLYS8rIg5ctFjJ:sxZxTs/f5sjO6dGHb+/jSeutFV
TLSH
T10442FA55AD28AA3B9CC7D21DFA55BF53E3F91032A0C10E44A6FC9A2C05E76CD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91d231a9-52d3-4cb0-b272-e858e292cf02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91d231a9-52d3-4cb0-b272-e858e292cf02.tmp
Size 12KB
SHA256 aa2ecedc941ca2d81e1a200748c9501dd3dc772da8ed4ead433a41eec787fe75
MD5 8382e7bea066be2aad925cbdd0e14487
SHA1 dca6d8ab98d5aac5076fb744f9d6ac4f2d116556
SHA512 4db527a4d52c841a5bfd97bdd30bf2ba1257ec53f3eca9619e6e2d2d46b6bf11d7ab3b6bf50a9f185f36dbd050d0f41572ece01f262a15e41adab159db875659
SSDEEP 192:sxZxReks/f5staQZLx8mzodpdhyHdU6+WNoIm/YopL2S89Ig5ctFjJ:sxZxTs/f5sgO6dGHb+/OSiutFV
TLSH
T16042E956AD28A93B9CC7D21DFA55BF53D3F91032A0D10E84A6FC9A2C15E76CD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 573b8d49765b702758264a0678f80ef5f19f34c7e9ef55ae6897dcad062ba5be
MD5 9fb7396fdaa8cee01df16024b67d9a0d
SHA1 674c6f5ad25627e7c02d03ad50849907b107e9c5
SHA512 823fd4bf58def40b6922e0ea2da1c76f48d05ea45a4d9fbb38b9e6e6091ba7fe42ec102b07bd0e261552b82b95858a3ee9d28de4bebccc813e97dd5404e60b1c
TLSH
T1E6E07DC444C8C2BFA30874470269574CDBA0361FD2C0AD8F3705C5C5724E240B7C2694
MD5 SHA1 SHA512 TLSH

Submit Download

a9004bdb-cf40-4c60-8cfb-e7b6565a0a4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a9004bdb-cf40-4c60-8cfb-e7b6565a0a4f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

08159468-c9ea-47d7-8fba-70110f55415a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\08159468-c9ea-47d7-8fba-70110f55415a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

8a982db6-5fa0-4974-bf22-7909dc42dd5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a982db6-5fa0-4974-bf22-7909dc42dd5a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d47e6823-75d1-4f65-957d-c1912b5c0a9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d47e6823-75d1-4f65-957d-c1912b5c0a9b.tmp
Size 1KB
SHA256 2d45a14752e7364c04117b8b8cff22d1d1e21cc0aeab334056ccf673b342c803
MD5 b8c6e2b86c398d2c5658b5df05fe584b
SHA1 87b02a6ad98f14862ddbd63d5138f1f41641913c
SHA512 fdc8a32e03f05283255e601f07a88f6a1e7cd2e11236f24ff2499f06ec7ec9ddfa85240ec0de91f41703b86ec5542075a201c60341f78201a0178a4049f5905b
TLSH
T19631A1F383F4856E8A0196F0AA18AE2BCF2D0515431C7D9A84E4AF2BD3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 89b385b60758d22e0939b672076e48bc348c93c64d5ccd2239cac8458b355dd6
MD5 301372c8bae2937db905b574a8bf4253
SHA1 697d17fe159f0806f76654e443dcce57b20309ba
SHA512 3ef15c20530feed2cc34a88c9e07bd4fef3cb53ddfe70fc5a026cf0fbba7458be05f70114668d9e5d9aef590862ebd59b07b9a62a0cb2b1f15cafcfe9d6ce36d
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgC:ST/2dXOJhJlpfnpp3tNXVrN3GVLodg
TLSH
T12FB2211571BB421039FE291891B68B2E064271B33119E67B7FBD40B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b5504be5-2e0a-473a-b169-99bd6c18a432.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5504be5-2e0a-473a-b169-99bd6c18a432.tmp
Size 414B
SHA256 bace2515949d50f0a04cd0390909539ba7dc8c23871efd7cc2f38ecea299f7e2
MD5 205b304b95eee6819ecc516d6f796b8a
SHA1 947b39cf3791cf7c50b1cdd77640bf775258aefb
SHA512 aacc06c96214f9b09fe37c7c980fda8fae1ee6974f6ab9af28811ac44eb0879965cd58d3eef40e190efb7786060dfa81f0b4926c0f89be91a6a45258e3a07b18
TLSH
T1ECE02BABC816EC3B18FD0B7D50940645F710232B2A51994F3B3D81188FB06364585D6C
MD5 SHA1 SHA512 TLSH

Submit Download

d9f7c69e-6611-4233-ba19-073b31f510d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9f7c69e-6611-4233-ba19-073b31f510d2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a955bd52-3f1a-4c72-93a5-ccb4e15d7944.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a955bd52-3f1a-4c72-93a5-ccb4e15d7944.tmp
Size 26KB
SHA256 c946b301c3160b21e436b2aff88616d6cf658b8b47b11ae5e4e76103708085fb
MD5 5af45a6870d5c271659e8deedc3d2efa
SHA1 432db1cf14655c2b2778662fc99493efd25d3028
SHA512 83617fd4a253ae8b7632071c9f449f01252348c626aa560e392cfd53946593f0f12d812bae1f0c91a1bc5277110e6367738e34ecf236bca68710fc53205163a6
SSDEEP 384:n6iFiZcI63sN98TUNTUlIm2aKMW7Kcw2fiBCWrBP9Y5+Uwi75sa+VY68gL/7IzuP:xFQ630wgcL7BCgBPIrwi75hgpP
TLSH
T1AFC23972EC98D9BBECE64BD5B74A3603DEF4426395CC9AD4D9D82D1C00975AD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bda312cf-3ffe-4f2a-b179-494edeed3e5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bda312cf-3ffe-4f2a-b179-494edeed3e5d.tmp
Size 25KB
SHA256 b7d68f6f2ab67c2ce7e8f348f23bb3c04d13753020df370cf5dafe03d34eaa35
MD5 e997a1598fca5e750f579fa3b6570923
SHA1 4c86443252e3252f4ec8c2215b457f9156fe258a
SHA512 654f8178124799a80fcba00d9ea3ba8f267d320ac2116cd4749b4ec70e2b427bd70edbeecfa355713f4b854360ee9b4cb96dadbc09bbd4b95bb1478089aeb03d
SSDEEP 384:n/iFiZcI63sNR8TUNTUlI4/aKM/Ha1/w2fiBCWrBP9Y5+UGi75Fr3gL/7Izho1:KFQ63kwgTC4BCgBPIrGi75ra
TLSH
T1B9B23972EC94CABBECE64BD9B74A3603DEF44223958C9AD4D9D92D1C00975ED430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb1af2d5-8628-4f10-8cbd-dd9ce67548a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb1af2d5-8628-4f10-8cbd-dd9ce67548a1.tmp
Size 26KB
SHA256 307551e6084346bd7e5e63237c9b44b66ce1f62d6e9d006653d176057364d481
MD5 7fac4ad775f3c9d84efb3f0cf5c498f3
SHA1 7e8ed9d1b5bcaf36fe6c86e433e5b504c0edb518
SHA512 fc67745e6ef6bc504bd7d9a9af0477e2d89099d6ef7a89305d84f30729dcb0244eaeada034839c2da2510cd2174c5b5a88ae687ca260864a0c5ce67f96f64228
SSDEEP 384:n4iFzQkUSvrUsNR8TUNTUlI4HaKM/ka1/w2fiBCWrBP9Y5+Uhm75PJAxJKChzgL+:DFdIkwg9P4BCgBPIrhm75PkJKCqL6
TLSH
T10AC24B72E894EEBBEDE64B95B30A3643EEE05223D58C5AD4D9C92D2C00C71DD534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cbe1692d39de0f47efebbe213eeea2fa16403eb56a280760e5bb2d42656bdba3
MD5 793510852f68142a5d59175921f61a3d
SHA1 078a7599b806c80b88c95acd4d21d1adb024e6a6
SHA512 627680a7f3df689ccd840c42b67cbcbc0a5021790de5eb1b92dadc9f72580fef7ac1f806d4a60110ff04e4398ad49bd1d0dece3923618f45eee5db5915f2b34e
TLSH
T1D441195CA6F91158B3B3AE5A9BF6A86D487EB8772F06C45D10110D4E0A22B40D8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4976-222-0x0000023980000000-0x0000023981000000-memory.dmp

Download