71c5febe87bf7c3091f3b95fe134253c170c59c72e277f7249b231d8fd1ace3b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SJTweaks Controller Macro cracked by mochii/SJTweaks Controller Macro cracked by mochii/SJTweaks Con.html
Size 698KB
Sample260727-dewkvsgl2z
SHA256 71c5febe87bf7c3091f3b95fe134253c170c59c72e277f7249b231d8fd1ace3b
MD5 6571995d5d81170f8860255925eb2b97
SHA1 9be8c224d5ae05424e42e9b5bbd75d14034c4de7
SHA512 3e7036fdc265e15e9a5ab527f4c2e62840d65f0fd210d1e495e97941ab2c920515d2bc63d1b31fae4b9e8f9eb321fde38e4ab1532c3b0b7491216a11df26b283
SSDEEP 6144:dSpgO25LcoDGITFavGC7/qbsgD4ekZHtwx0/w1/HtY32HU84Bl0VqOTP:dSpgO254o/svGIFVuW4/+3MU84BoqOTP
TLSH
T105E4751393C86C61200BAFA6771DFEE9F914977C7424088BF48D7E64DBA5902EAE1770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295951564845923"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{E0AEF456-A550-4F0C-BAEE-26A41AF5FDAA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
540	msedge.exe
540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4756	1608	msedge.exe	80
PID 1608 wrote to memory of 492	1608	msedge.exe	81
PID 1608 wrote to memory of 4636	1608	msedge.exe	82
PID 1608 wrote to memory of 4636	1608	msedge.exe	82
PID 1608 wrote to memory of 4636	1608	msedge.exe	82
PID 1608 wrote to memory of 1160	1608	msedge.exe	84
PID 1608 wrote to memory of 1160	1608	msedge.exe	84
PID 1608 wrote to memory of 4752	1608	msedge.exe	85
PID 1608 wrote to memory of 4752	1608	msedge.exe	85
PID 1608 wrote to memory of 4752	1608	msedge.exe	85
PID 1608 wrote to memory of 1564	1608	msedge.exe	86
PID 1608 wrote to memory of 1564	1608	msedge.exe	86
PID 1608 wrote to memory of 1564	1608	msedge.exe	86
PID 1608 wrote to memory of 3348	1608	msedge.exe	87
PID 1608 wrote to memory of 2928	1608	msedge.exe	88
PID 1608 wrote to memory of 4616	1608	msedge.exe	89
PID 1608 wrote to memory of 3348	1608	msedge.exe	87
PID 1608 wrote to memory of 3348	1608	msedge.exe	87
PID 1608 wrote to memory of 2928	1608	msedge.exe	88
PID 1608 wrote to memory of 5012	1608	msedge.exe	90
PID 1608 wrote to memory of 2928	1608	msedge.exe	88
PID 1608 wrote to memory of 4616	1608	msedge.exe	89
PID 1608 wrote to memory of 4616	1608	msedge.exe	89
PID 1608 wrote to memory of 5012	1608	msedge.exe	90
PID 1608 wrote to memory of 5012	1608	msedge.exe	90
PID 1608 wrote to memory of 1968	1608	msedge.exe	92
PID 1608 wrote to memory of 1968	1608	msedge.exe	92
PID 1608 wrote to memory of 1400	1608	msedge.exe	94
PID 1608 wrote to memory of 4768	1608	msedge.exe	95
PID 1608 wrote to memory of 1400	1608	msedge.exe	94
PID 1608 wrote to memory of 4768	1608	msedge.exe	95
PID 1608 wrote to memory of 2660	1608	msedge.exe	97
PID 1608 wrote to memory of 2388	1608	msedge.exe	98
PID 2660 wrote to memory of 1684	2660	msedge.exe	99
PID 1608 wrote to memory of 2020	1608	msedge.exe	100
PID 1608 wrote to memory of 2708	1608	msedge.exe	101
PID 1608 wrote to memory of 3712	1608	msedge.exe	102
PID 1608 wrote to memory of 4456	1608	msedge.exe	103
PID 1608 wrote to memory of 4456	1608	msedge.exe	103
PID 1608 wrote to memory of 540	1608	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SJTweaks Controller Macro cracked by mochii\SJTweaks Controller Macro cracked by mochii\SJTweaks Con.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffde7d9c188,0x7ffde7d9c194,0x7ffde7d9c1a0
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,10492910867450132579,15260595401718063008,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,16383621299347774818,14506989719115400055,262144 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,439518272273483755,4749650944995682932,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,13992256491643613354,17717796019248251330,2097152 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,17212442120288397928,13048160105701650257,2097152 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,10935195994050097825,6045928065546025283,2097152 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8773583050328707442,14982390820681734681,2097152 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4224,i,9480890150904418119,16454217808890252670,2097152 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,12007922508500951354,7083623459055166096,2097152 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,15321645409967405915,14686345907816656206,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:12
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,10163153806741668128,8399088640091376257,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,1346546703198902134,16097399093123115626,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,10336379564043228136,3804358691285836310,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,15858652891160594862,6230168031729562348,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,10336379564043228136,3804358691285836310,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,16139590826292680499,7381213246353612337,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,418451788668875946,4353000963431336142,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8000924846940136962,1996319758398288418,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13195278566279946618,8898082726963471380,524288 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6860,i,3037967913433417246,10292751879609874784,262144 --field-trial-handle=2192,i,17204692790960149194,4448121941792798953,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1b87229f99cc53c652c227dd7b0e674fd1a7f3d2071ecbd7e96d14caf01789e
MD5 12fe7e86ea55bcbc14173d158228b533
SHA1 4d08fab080251fc755b72705a654e4971294953c
SHA512 5f7f520a3c5a907c7487d7831cea4efeb50450367f23409af02c5269a3fd34cd57d86191174e7c2c1b103980b98f431afe701795717921d9887b0f9bcbc45b3e
TLSH
T199D02B7111090041C40D0032107386054303FF010A0578433C6134252D10C09834E094
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5a37b3d49f1fe944691912c48ee696a126ace1b684c03adb03377e70bb3ce9c9
MD5 a2b750b71de04030b8af81c16dc7dc4c
SHA1 9addd888f64b9bf6821994865c5be5aa17799289
SHA512 853d41e90035a912c0cbdefeace8dcebef919b7feb532ba539992112738bc7a4ab7c792822e0ef96d7a419440901f4091e3c33601fd4cdc6fda181eebfe12579
TLSH
T17441C85003623D8FD3E20231A0E12FF63E3E80A50827EF6AD69F8DF71A29761D51644A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 98a882f290587db492054bb79242d4e6e97a93ff0e7284cea61ecc8a912ea238
MD5 091addd45c1d90c0e8cd8878849ac127
SHA1 4ec845d73f5e551549c493dbb15e3cb3bce4dd48
SHA512 59623d9649bbb71267190f7e64f8acd114d6945d76760e13b5adf60f9870ce2419098affa6e4b19d20232cd8309db03e056b81f391f9a5fcaddede2ae41c7606
TLSH
T14431BBB7C3D5866E880156F0AB24AE2BCE1D050782283C568DE4EF5FA3E2071E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6feedb4007535554e0920a1e58013e48cf3eb6f10873e15418cd2a7020d62fd5
MD5 dee7d2826d98133a470d1328219a6ded
SHA1 7f033bd3cd1538e6f17924538542fc788920ba2e
SHA512 ed09a8836805a58cfc8b29ebb5fe97c27fbac472192ebb79864d8b61af8af469cd42f97a2bb5769ff66d20c3141deaad3cb330ec7a80b7f03a989f27fc4c3ba3
SSDEEP 192:sxZVR9yM/jK1Ml8UQCFo/fCsN/pHTIdpEr/W6+WNGY01OrbjIg5tJ:sxZVTqIo/fCsN/pHMu/bG5yF
TLSH
T1AC52D616AA34597BDCDBD209BA517F53D6F81472D2900E44AAFCCA0C04E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f91df6c6af4d2157063c4073e99e883b6ad941328355fa3d4757f6f49b6b4aa
MD5 1651fef1a836b4dabc5e16edc4ad6356
SHA1 92f89094da8f52cf305b5991d393eb52a2b71522
SHA512 5b7aaf370b512c40377e1f7220364c1054ff1325a44506f716081a2c858170cfbabd0e9212ad82a09d487da3daf6c2c0e42d72dcfb91ef1b5b92f717c71e7432
SSDEEP 192:sxZVR9yM/jK1Ml8MFo/fCszppTIdpyr/W6+WNGY01685jIgrJ:sxZVTdo/fCszppMo/bG579
TLSH
T17242D5166A34997BCCDBD209BA55BF53D6F91472D2900E44A9FCCA0C04E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 3a7575a037c16a6ab07793b0bd2404d617dd829c2dc8e8735dd8a5d92538b114
MD5 e5fb3bdf8857757f61ce18c9b55f797d
SHA1 796469ddc05eff9055aa28162f88079d2e4ea2db
SHA512 53bdb72e54b945f9dfc8e815947005c8dac067ad12a6ba4e2350080aaaaeb409b70578d3788ce4a3b223a1d3dd4e92d6f2aaf4aaf19b6ad735256bcf252d75bd
SSDEEP 768:kF4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4s:kuu+68si2y1WRmlzQqju1jaKDILpZ8UN
TLSH
T1C9E22A3B280CCB7E4F844E5CEC26AF966ED802CB56684D5447FE494C03C77EB522A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 304f80c3737d8bdd8f630d5f0e123a2bc7e25e1927590ce83ff761eed07f92eb
MD5 4f093eeb316189f04cd1d9c4e6894772
SHA1 5701461cd3430e4b9278e93629ddb67bb3b49c98
SHA512 6f997b069589c5c3c53a7da24a8a3f683fb3a1be877ff3f48af4cee613400d568a021b2a28fe93117f4f56900749358396055eb76f7cb18de7b516bac3590b43
SSDEEP 48:KIERCmUWqvtC/mIOevK/+XYvz8/cnyakyxeIPKTi4by9BIhKCc0x:Ko1OK2MKCeUKTi+2BKKCcm
TLSH
T17891AA86B5BA06113DBD250893D297176A42B3633198E43B3BE811B74E67E506CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595579.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595579.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a114e32b0a1db55762d93511f78a96113a4dda34ba2e26f7ac73eb36975d354e
MD5 0774549a2c6d9d2931d0e006d85274ae
SHA1 c5f454bccafc387cac562c375d92878fcd96090a
SHA512 b2088f379a51e47df13fd4ad77dbe56b7776ee571c42522ef0d000289f2b2e05dd3989919ee6a31d1481df8f9cafcf5a4816b7fb034788ac601a1b3d31b46f99
SSDEEP 384:OiFhZcIH8Nm8TUNTUlIllX2g6Prbr3b+A387ntXWIHWOObjI9G6w7/:lFpHHwgH9+nrpaWIHW29M/
TLSH
T135B25C33AC68D97FAEE79A45F49A31138EF4417BD6D86B84E2DC9B0C009759C031AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 14f2f4f317fd232d1e5fa6344ad61f9c7918606b1877a8b9e34a2401587b7322
MD5 542c51e9f6d0f92f304398688125ea44
SHA1 a51b889ad7469f4edebbe9d01c7f716db5681356
SHA512 9812456c9fb91163c7b0057fd59243bdce73dd64d4181399af1783359f1c6e301d94b007ddd998ac1d4ada572017cfaf153aeaff6cfe6b4b6f3ccef7c38a1124
SSDEEP 384:DZcIP8NmKX2g6Prbr3b+A387ntXWBHWOObjI9G6w7/:bPU9+nrpaWBHW29M/
TLSH
T106926E33AC789D7B6AE3E515B48635135EF8817BD7C82F84D1ECAF0C05976AC431A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cceb70874d0c6ed9be2eb65c5cedd29df9418813c7eff0b7f2a0de15cae17856
MD5 bbd3cc09fc7305f59689c10eba04094d
SHA1 c5e0d7abb637072853f6dc5775c09be77e163bcc
SHA512 f86c54841ce9c3929ca9143855d01df76e5038317a74731c90756aa2d335d2bea707b152ef613fbbc3c8be4ecc7eb3adabf994c143742c18b2a55038534e8524
SSDEEP 192:nRGNZ6yMQmiUykJmI31Y3b+jcvjzorrvfRRCMnDPU6:RGNZ6xrH1Y3b+A387ndTU6
TLSH
T18202D936A9786C7B9FF3AE45B98737139FE4106BE6952F80D6E81F0C00D765C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 aa47e889ee4d192e9fea196bff537b4e234f9619be59ab4a37919e5e703d52bf
MD5 d9bdd829b9878fe2fc52a402757cf4d5
SHA1 cdc59e376137bba8e6cb98b07d7af2a3842535fe
SHA512 e7be71d1d95eb04103b4742e8b72d79440f1e92ddd226b7e1a2ed63caa2550d6333d050abe84b524cff477d705563416db6bf1c33e74c874f195875d2674c8ff
SSDEEP 384:WZcIP8Nm+X2g6Prbr3b+A387ntXWBHWOObjI9G6w7/:EPU9+nrpaWBHW29M/
TLSH
T139927E33AC789D7B6AE3E505B49635135EF8817BD7C82F84D1ECAF0C05976AC431A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4fa496ba8c1ecf7718e9657c9828f357d49a69b0be3f2cbedaedd107abef15f
MD5 8257363789f368174f82089dadd0ecea
SHA1 18efd6369a41b472c674485b0d9eadc11e6e6500
SHA512 ddcd9d8159ded1c9cee2623d5a793b2de21cb26b4b7cf562d8105714c4e1637e10776eb884218673117a084104d056b5bee966f856bb819ec09764b3084dd7ce
SSDEEP 192:KGN/6yPQmiUyP0I35Y3b+jcvjzorrvfRRtXWXq4M1qI25U6:KGN/68I5Y3b+A387ntXWqHWU6
TLSH
T16912F933B868AC7B5EE3A945B48731035EE4412BEB857F80D6EC2B1C00DF65C531E86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5caa4da08e31dd3f937b1c0c623474ca7ed32604e85684c0d9df7886a4fe8f37
MD5 e829db72d4d974d9f39519d3abb57cd6
SHA1 6f1bfd52a369b2e27d3561b42c5571b4b79e12a8
SHA512 633ec1c9380b7c7b93a4b4ad99950a2f1ab04715c1fda9f1de17fb1f995d782d865fc43909fdae11c7ac0a6b1d45b9dcca66e7ba198dec02d26b69d951100730
SSDEEP 384:5ZcIP8NmlX2g6Prbr3b+A387ntXWBHWOObjI9G6w7/:RP/9+nrpaWBHW29M/
TLSH
T185927E33AC749D7B6AE3E505B49635135EF8817BD7C82F84D1ECAF0C05976AC431A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6bda00d-6b8b-41b3-9269-f67dec3cb9c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6bda00d-6b8b-41b3-9269-f67dec3cb9c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download