hxxps://aitab[.]eu[.]cc/it

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aitab.eu.cc/it
Sample260907-pre97avth1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332580182471764"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{6A06226D-20DE-4780-9544-B4357CB6ADE7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
992	msedge.exe
992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1448	4600	msedge.exe	85
PID 4600 wrote to memory of 4588	4600	msedge.exe	87
PID 4600 wrote to memory of 3740	4600	msedge.exe	89
PID 4600 wrote to memory of 3740	4600	msedge.exe	89
PID 4600 wrote to memory of 2716	4600	msedge.exe	88
PID 4600 wrote to memory of 2716	4600	msedge.exe	88
PID 4600 wrote to memory of 2716	4600	msedge.exe	88
PID 4600 wrote to memory of 3380	4600	msedge.exe	90
PID 4600 wrote to memory of 3380	4600	msedge.exe	90
PID 4600 wrote to memory of 3380	4600	msedge.exe	90
PID 4600 wrote to memory of 4968	4600	msedge.exe	91
PID 4600 wrote to memory of 4968	4600	msedge.exe	91
PID 4600 wrote to memory of 4968	4600	msedge.exe	91
PID 4600 wrote to memory of 1364	4600	msedge.exe	92
PID 4600 wrote to memory of 4564	4600	msedge.exe	93
PID 4600 wrote to memory of 1364	4600	msedge.exe	92
PID 4600 wrote to memory of 1364	4600	msedge.exe	92
PID 4600 wrote to memory of 4564	4600	msedge.exe	93
PID 4600 wrote to memory of 4564	4600	msedge.exe	93
PID 4600 wrote to memory of 4796	4600	msedge.exe	96
PID 4600 wrote to memory of 4796	4600	msedge.exe	96
PID 4600 wrote to memory of 4796	4600	msedge.exe	96
PID 4600 wrote to memory of 2924	4600	msedge.exe	99
PID 4600 wrote to memory of 2924	4600	msedge.exe	99
PID 4600 wrote to memory of 2924	4600	msedge.exe	99
PID 4600 wrote to memory of 5088	4600	msedge.exe	100
PID 4600 wrote to memory of 5088	4600	msedge.exe	100
PID 4600 wrote to memory of 3256	4600	msedge.exe	101
PID 4600 wrote to memory of 3256	4600	msedge.exe	101
PID 4600 wrote to memory of 3800	4600	msedge.exe	103
PID 4600 wrote to memory of 3300	4600	msedge.exe	104
PID 4600 wrote to memory of 3300	4600	msedge.exe	104
PID 4600 wrote to memory of 3300	4600	msedge.exe	104
PID 4600 wrote to memory of 752	4600	msedge.exe	107
PID 4600 wrote to memory of 2072	4600	msedge.exe	108
PID 4600 wrote to memory of 3144	4600	msedge.exe	109
PID 4600 wrote to memory of 4968	4600	msedge.exe	110
PID 4600 wrote to memory of 4968	4600	msedge.exe	110
PID 4600 wrote to memory of 4968	4600	msedge.exe	110
PID 4600 wrote to memory of 5008	4600	msedge.exe	118
PID 4600 wrote to memory of 5008	4600	msedge.exe	118
PID 4600 wrote to memory of 1052	4600	msedge.exe	119
PID 4600 wrote to memory of 1052	4600	msedge.exe	119
PID 4600 wrote to memory of 1052	4600	msedge.exe	119
PID 4600 wrote to memory of 992	4600	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aitab.eu.cc/it
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff95576c188,0x7ff95576c194,0x7ff95576c1a0
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,13263668260568498142,12753747021597429378,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,16116451838759797212,17397112950408619627,262144 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,615303932920794330,14952565975523218822,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1498234606674232216,1135047545912036136,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17537993836337125462,15941290016293588027,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,2030860688576281038,10831332098855223406,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,14800059332320123585,14558837572786235981,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,11628471316409041054,15044358086740453951,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5048,i,13165024907872152555,11333120887901735976,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,5729399476772549318,4891590851304223013,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16143908228709012392,11128250848634176748,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17155299096713805677,16374116065106409524,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17155299096713805677,16374116065106409524,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6284,i,4315916754404744220,7947374347117903353,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,9707515439075350011,4668025265701621520,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,6253693423227513721,10647414195527153787,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,10166535706598449802,17891128401230874526,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2820,i,11028761458185412167,18334369778679061291,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15556043911605926387,14872399658171996417,524288 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3932,i,10806403789533942468,11525844036645730991,2097152 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5660,i,14003775687498330228,8242960410325074665,262144 --field-trial-handle=2752,i,38070087490879524,13412428507246030904,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bdd393c5077bdd9e53f82536351efdde90bd9518935a59c0c33dfbdb68fd7c6a
MD5 190ef782f9f8fae0a08745571468b1db
SHA1 73b4d64289a3c7dc0e6e2c8980804157d6bf797c
SHA512 4bdd7e348addf5bf26b2f55ecf839f617744f28f2f698a39908965b846a4c9954915b99677576c7e4be10dcb619f843ef4f34950ce84714a0780395537429f72
TLSH
T11A71626507523451F3DE3131A2D202CD7BF38C85095FDF3746236BF92B267218579818
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585faf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585faf.TMP
Size 3KB
SHA256 59151ba46d602d6546593dace021d4a0f71f278323753c4407e183c1f1399646
MD5 245f0ef8577fe9baf8c88e6c6ac963b9
SHA1 e363b3f6cdd3dc8f0dfdaa490459611ce87a43db
SHA512 91fea0328a5c6a70e6e3cd41bf6c0c3d5cec063474c580424b4ee3508eafdd9acf71b11a6c17d0b1f81a420289947f336e459414ec66d67e158608ea060b09fd
TLSH
T16871526547523451F3DE3131A2D206CD7BF38C85199FDF3746232BF92B267218979818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 040623b31046e0f86e2b6514c0cb47e880f1283394b8c8e481eb94c1bba62316
MD5 92cba1863d38bd1ce955a01bdb17f543
SHA1 1120b80bdf73a669267ccd836d9114919b835037
SHA512 cc93b8b8409f7e7ce3e5f681e59c1996a369f8d1ba873bc5a79d46ee4a8328a083a8d0f05541d7cebfeaeba33cdb90242968dc7e8e0022aafc6b85e469a644ba
TLSH
T1ED0168B3C3E4956E8A0052F06A18AE1BCE6D0506431CBC5A85D4AE2B93E2465D40189B
MD5 SHA1 SHA512 TLSH

Submit Download

d91e4886-a30e-443d-a693-8cd7933fcb1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d91e4886-a30e-443d-a693-8cd7933fcb1e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bd7c65d1dcbd354ed463861001d17234389f2de666ecad57e553264c3ee5ead0
MD5 cc879ee99d9a3e44f1332f4ef5d09b71
SHA1 6ec365860b13a2dd4561ff7ac0bc54105c57e012
SHA512 68e5c2b5f3ed5ade581852c786a9bf6376f6ded451605755092a47673559584565945512c70c92f798b68fcc03eb3ae1532160ef9a1233d56d03131b4bbdaff5
SSDEEP 192:sxZCRnyM/jK1Ml8MkG/fxs6SCIEQGIdpVKHW6+WNGYHjZdiMIgrJ:sxZCzMG/fxsDoUsHbGy9
TLSH
T17942D7126A346977CCCBD209FA55BF53D6F94573A2900E44A9FCCA1C04E6AED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 092d543322067f24e421154e4ff2638f99d7b9cfe6b553941da8307433222591
MD5 00a090f258875af711fdedd975f31170
SHA1 ae9dac60faf2bbe0e24dd5f5f5ffeb7cb5889e9f
SHA512 c2518f741dc3fb451223818196ca24e683a8a40449fd6a6e187c9824045862186e0f4935553e6cea677e0924e126e6d40a5e6139cb8e08d1cd2dfa794853c328
SSDEEP 192:sxZCRnyM/jK1Ml8UQtkG/fxsLSCrEQGIdpfKHW6+WNGYH60yiMIg5TJ:sxZCzqGG/fxs2/UyHbGlD
TLSH
T18852C616AA346977CCDBD20DBA45BF53D6F54473A2900E44A9FCCA1C04E6AED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ab50546f5f065c8597319c65800f89b6556879bba33da4812014e35a14e3832d
MD5 b197b1a8ebeedce80fc1355341e722d1
SHA1 f2daab5037fa05997b31a17679cb9761da70f6ac
SHA512 29ad1090d8b141e97fd2f40308337965da9a5e36be099ba96d5aad2b60cd367029afae2895a60d3940f27a1b7dd88e486f24141da3ba3a0f3cf92242ef05f7eb
SSDEEP 768:JYUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RqroVs00q:JYUZYTMWvg0Pou1ja7eLZmRBerq
TLSH
T112D20B3B280CCB7E4F844E5DEC266F963DD801CB5A984D5447EA884C03C76EF112B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 19de25734042d5d177e0da8d0e03f314e67a44ffba4d6cfba5a36d838842f61d
MD5 fa7e223412c5f18bb45a0eb40271d717
SHA1 3c57ca786d8148c118364e61a5e58e89d1d34b16
SHA512 82c64a8a25e2da0415ef8a18c80d3ca6145186518fe41db021d3aa3beacff5d4751ac2c8709ddaf14bfc8fd60ef66673a5f78a7965a5da972a7158d7bf11b14d
SSDEEP 96:KA1eK2AANKK2IKiSIK/KcGMKvqK2jWKcgo:E0RXs315
TLSH
T185D1182270FA62423C7E6B08876497568E41F593301DE86B3B6C65B54E26E209CFFCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fb24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fb24.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 b36f47e321d1f19fe175dca212047612fe52d14c01ccbd2e2ed7652b037e1e13
MD5 7b686d6b68ebd644f13c6992d1f6b4f9
SHA1 4783a3d2030f68fa87726ddd356659a6c644168f
SHA512 3850ee76151b70bce2e548dbe975512993c4e5d2973ec251554cf2ebf306a408b074836793ba0ae91dd39dd7bdb34a388ea0ea85687d315908e63c1cbb8c6e8c
SSDEEP 384:vsNMCSZYRyzX5od+ROwVMM07O6R2FeoWh7UE:v0GOwOEMM07TRlJ
TLSH
T1E2624C36A878AC335EE3D545F44B32179FF850A7DB852F8491EC1F1C048A69C231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 12b3c4bccf51fb9d1827ce8556a1f91b11a40d4126770469149472087e522b65
MD5 952e67621f1dfa933a72d02d6fa3f749
SHA1 d0868cfd0f43ea2954436171d1ba607dff8d2aab
SHA512 bde8bb8cba8fd2cf2ca6f153f5ff24dcf1c53470ccce0bb2858b4b99058209c101a003bde970e29bc8b7449d807b7a038254e5a9e26a725cf64be0978cc0802b
SSDEEP 384:QZcIhsNM/ZYRyzX5od+ROwVMM07O6R2FeoWh7U0oq:uh0GOwOEMM07TRlNl
TLSH
T1F7827D33AC78AC725DE7E185F84B32075FF89067DB856F8091EC6F1D049AA98131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 eac50ac1f0351a5adf492e2858ab0a0d2364ac489bb34d6fbbd1b7e493db60b3
MD5 6df436617f070be34c97872607c713d7
SHA1 34dc24d9f6a91ff9689d4f435c01f4b75f294c16
SHA512 1c9cdfb4462a179f0486644a8d442c5f6cdee9e038dceb9b1cf9916427e96e2326951d2b76715c9416df297f880b73bf0ad409b5aee9ede87672ccabada519b0
SSDEEP 384:liFiZcIssNE8TUNTUlIlqZYRyzX5od+ROwVMs07O6R2FeoWh7U0oq:sFQsRwglGOwOEMs07TRlNl
TLSH
T167A27D335CA8DD77AEF6DA85F94A32078EF540A7DA85AA80E2DC6F1D00975DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5bf2a41d343a8b6ccb228d65267d0aa855f26488f32e1d5a3dfbf203a19cdbe6
MD5 950823c6ea804c88e0f844f122986732
SHA1 9ee81ad37a15171ca968241a1d9e15124607898d
SHA512 6ddb208d2b3d2f4053e7c14bdf56cf13f21114f38420ba77e90d6ffa2312f2cd11cc8e24040f8912958006c217a7dc00bc866842aeba83a8f501e73ade74f20c
SSDEEP 192:yON261VWQmiUyBMgGX5Obd+jtOwaojD/a63w4U6:yON26WTgGX5od+ROwVyd4U6
TLSH
T13C02FA36A92C6CB7CEF2AE49B58737135FA92067E9542F84D6F81B1C00D769C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2ac765f9a9e43f856b7fbc5fb64c3755ff08cebe48b738b93290b802bd7bf313
MD5 272177650965a50f49c87ece48199923
SHA1 e6f5d5f1b24ad6c27d4605abbf85ba3ad75567a8
SHA512 8bef6c465a18d5d7c14b4772d40f99879b8c19a53eba6fc9f0f8960e88b751263ed3eecc06f8fe0177066fda283f8d33291892e38f7fc186789c68000c40832a
SSDEEP 384:FZcIhsNMqZYRyzX5od+ROwVMM07O6R2FeoWh7U0oq:9hfGOwOEMM07TRlNl
TLSH
T1F9827E326878AC725DF7E185F94B32075FF89067DB896F8091EC6F1D049AA9C231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0473a87119eadc311f9ffc70e375bc779a876c719c04b8dc62a0b5cc5dc789d6
MD5 232cbe7e6a00c3cadbe1b52312f698c3
SHA1 fc75b85cd8bd89799c17ee0f404b67f461a83cf5
SHA512 9b2a962d2681f434486c8ce061819995248b52d3cf2f07eaf981599bd4dc147668a7a84a20b3b47192db4ccc9431d7623e8ad8eb45e5d786439725c308478353
SSDEEP 192:9ONqW61sWQmiUy6MuGX5Obd+jtOwaoj4EcjJCnqkU6:9ONt6pKuGX5od+ROwVMp0U6
TLSH
T14C121A32B868AC779ED2A585F48732178FA55167EB457FC091EC2A1C01DB6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c012f2e-e7e2-41af-8f46-bb5589c0cd6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c012f2e-e7e2-41af-8f46-bb5589c0cd6b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2f5eb0b59b8835a13d9b5790281286140bbb080f0b0dccf2905e0c6d43f6b169
MD5 112de527a8090b543e7b7a408b098eb3
SHA1 e87d3217bc7fe97055c252989d8f3a768155318f
SHA512 7a906c6f8d119898ad47d2e54f9857ead5b75c36e033047994384ff63f9536e48365dbaf3efa73ce38a97d6286b9fdc247114fa7269ac7b3127ff0edcdc6c45e
TLSH
T19041D858B6F91148B7B77E16AFF6A96D487EB8772E06D49E10010E4F0A62B00CD71737
MD5 SHA1 SHA512 TLSH

Submit Download