hxxps://symbian[.]co/usa

Analysis

max time kernel
82s
max time network
85s
platform
windows11-21h2_x64
resource
win11-20260513-de
resource tags

arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
05/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://symbian.co/usa
Sample260805-phbkms1yhs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304060120356539"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{625E7411-253D-4150-9151-C1EBD5C4D15E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3936	2148	msedge.exe	80
PID 2148 wrote to memory of 3576	2148	msedge.exe	82
PID 2148 wrote to memory of 3780	2148	msedge.exe	81
PID 2148 wrote to memory of 3576	2148	msedge.exe	82
PID 2148 wrote to memory of 3576	2148	msedge.exe	82
PID 2148 wrote to memory of 1288	2148	msedge.exe	83
PID 2148 wrote to memory of 1288	2148	msedge.exe	83
PID 2148 wrote to memory of 1660	2148	msedge.exe	84
PID 2148 wrote to memory of 2656	2148	msedge.exe	85
PID 2148 wrote to memory of 1660	2148	msedge.exe	84
PID 2148 wrote to memory of 1660	2148	msedge.exe	84
PID 2148 wrote to memory of 2656	2148	msedge.exe	85
PID 2148 wrote to memory of 2656	2148	msedge.exe	85
PID 2148 wrote to memory of 1436	2148	msedge.exe	87
PID 2148 wrote to memory of 1436	2148	msedge.exe	87
PID 2148 wrote to memory of 1436	2148	msedge.exe	87
PID 2148 wrote to memory of 3848	2148	msedge.exe	88
PID 2148 wrote to memory of 3848	2148	msedge.exe	88
PID 2148 wrote to memory of 3848	2148	msedge.exe	88
PID 2148 wrote to memory of 928	2148	msedge.exe	89
PID 2148 wrote to memory of 2200	2148	msedge.exe	90
PID 2148 wrote to memory of 928	2148	msedge.exe	89
PID 2148 wrote to memory of 928	2148	msedge.exe	89
PID 2148 wrote to memory of 2200	2148	msedge.exe	90
PID 2148 wrote to memory of 2200	2148	msedge.exe	90
PID 2148 wrote to memory of 3172	2148	msedge.exe	93
PID 2148 wrote to memory of 1960	2148	msedge.exe	94
PID 2148 wrote to memory of 3172	2148	msedge.exe	93
PID 2148 wrote to memory of 1960	2148	msedge.exe	94
PID 2148 wrote to memory of 1304	2148	msedge.exe	95
PID 2148 wrote to memory of 4256	2148	msedge.exe	97
PID 1304 wrote to memory of 4864	1304	msedge.exe	98
PID 2148 wrote to memory of 4528	2148	msedge.exe	99
PID 2148 wrote to memory of 4528	2148	msedge.exe	99
PID 2148 wrote to memory of 4528	2148	msedge.exe	99
PID 2148 wrote to memory of 1728	2148	msedge.exe	100
PID 2148 wrote to memory of 1728	2148	msedge.exe	100
PID 2148 wrote to memory of 1728	2148	msedge.exe	100
PID 2148 wrote to memory of 3556	2148	msedge.exe	101
PID 2148 wrote to memory of 2008	2148	msedge.exe	102
PID 2148 wrote to memory of 3808	2148	msedge.exe	103
PID 2148 wrote to memory of 2132	2148	msedge.exe	104
PID 2148 wrote to memory of 2132	2148	msedge.exe	104
PID 2148 wrote to memory of 2132	2148	msedge.exe	104
PID 2148 wrote to memory of 1560	2148	msedge.exe	105
PID 2148 wrote to memory of 1560	2148	msedge.exe	105
PID 2148 wrote to memory of 1560	2148	msedge.exe	105
PID 2148 wrote to memory of 4260	2148	msedge.exe	106
PID 2148 wrote to memory of 4260	2148	msedge.exe	106
PID 2148 wrote to memory of 4260	2148	msedge.exe	106
PID 2148 wrote to memory of 4588	2148	msedge.exe	107
PID 2148 wrote to memory of 4588	2148	msedge.exe	107
PID 2148 wrote to memory of 4588	2148	msedge.exe	107
PID 2148 wrote to memory of 1616	2148	msedge.exe	108
PID 2148 wrote to memory of 1616	2148	msedge.exe	108
PID 2148 wrote to memory of 4692	2148	msedge.exe	110
PID 2148 wrote to memory of 4692	2148	msedge.exe	110
PID 2148 wrote to memory of 4692	2148	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://symbian.co/usa
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffd5ad3c188,0x7ffd5ad3c194,0x7ffd5ad3c1a0
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,15944277223719117603,1324182202092180577,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,15425590718651209656,11196039401551385122,262144 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,2182593238807541169,6767170842759935649,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,12651816330405680518,15766048702282126141,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12941743254735112744,11348469575699559769,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,8117756509665675477,10740556429532525727,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,3820145582297300787,14340193218758896077,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4252,i,4930559143404423594,1526711702272879126,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,17539023343894897410,15949720159823595933,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,6934197195915333001,536235928453305927,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,17654499973964218424,4427624016000152379,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8065769963833224651,15982469074255848542,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14335156717380178321,11150540656578192131,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14335156717380178321,11150540656578192131,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6576,i,15212562147780899147,16725042925393805439,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6152,i,10811868783135789401,9109226615656167108,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,3236564215601820459,18164137919368696249,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,10537886008987617935,14516070588937950288,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,8566497804309166193,10384319675116930117,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5032,i,13996297684091297079,12773712962380146875,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6688,i,14057534261086172880,18117367656425481123,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5552,i,15100759801541931129,7422012659057217015,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3432,i,12251779684325461412,1795860523429750192,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,10836588605905525450,14582449256477125885,524288 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5536,i,3101420396845539344,14595930175915221421,2097152 --field-trial-handle=2268,i,16227416231541375871,8164706542981004092,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4faa589548c9701ddd26e6c6575d7208ca82ceb42ce1292ec6df2b1f6d08273e
MD5 50093bb6547d7f4de0e79150929ee0a5
SHA1 8c42336853fae5248c88d1f6be805f6bc7171725
SHA512 e1fcd5ad700c20d3106e71d986d87b873ffb3093e54c99818387de88cf048887b4edbd668cdbdbacbc5a4770fece55d5199ff7eb7ebe2ef4e62096369709f3af
TLSH
T1A271E519035713A1FFB302B16CD19908AFF1F5891A835A9863F8DCB2641F72D706D6B9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c37a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c37a.TMP
Size 3KB
SHA256 b1975471798e306616d96eccc3a34f3b1da5b12d536a45e60428dbd2ef42fb1a
MD5 27ff7cadfad3ee3e757a1e6a811b0bda
SHA1 8adf23da0073bc48d7cd51167134c18012f85335
SHA512 6a31dbdfda8bc282fbc8235d54c5f308f7ed495efa7feb600fe05de5074ea0d93cf9521ee46b1e1cae2c01e9c58c4d54202de8159b4e406e4cb35b96f35ca74b
TLSH
T14871E619035713A1FFB302B16CD18908AFF1F5891A835A9963F8DCB2641F72D706D6B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 478B
SHA256 8cbb4f4fb671c780384403d525cb6b256ae456b0d289b9908d46f0c66a95017a
MD5 fb3a69548fcd586115656015e4ba4c4e
SHA1 15190dcfe6a5cec30394f94e650f9b9bf42d0815
SHA512 9ed53f7bb5b8f930658ba603fafc05665720b6f47c2bdf59bfd4c0adfd0b6583f0f513699571f6b9a3c2e4184b6320caa5254cf477348cebe5c563ceb87e74e3
TLSH
T118F09EF383E055BE8A0052F05918AE1BCE2D0502431C7C6AC5D4BE2B83F20A8E00189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d36e9e03d9c1072f781222f95f56da53f784cba22ec2d0eb3b1171a9f19131b3
MD5 77249f00b181cc3b1bdd4948fb5fc36b
SHA1 b4601ac3326a0232cf3af3f035f26452f8aadef3
SHA512 f61cb9cace49e30dbc6e046df7896c035d17cbf4952f046534c0a65a25b75d068c721b512f318d404f703352b00e1132e2a90ec163ec0f50f39f38fba4aadc74
SSDEEP 192:sxZM/yirKOMl8MFC/fts8LOjIupM/W6+WNGY057cwzIgrJ:sxZMAdC/fts8y/M/bG5T9
TLSH
T1A042F8116F34A9778CCBD309FA15BB53D6F91562A2940E48A9FCD61C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 86898a6be51c128aeed0b8f9282a202910193aadca87bc03a5619bdea3235e25
MD5 349d397dae6b9d6bf2bdd7adbbebf2e3
SHA1 45050bd9269436bd0e6f01d4fe6cd44a71d0efc0
SHA512 662e3c7019f7965b96b9e95908df45bbf52b2c7c6d3434c648a69dab51b97f765cdd97a3de1b270b93610a2cdfc0f3a08dd69df6dc41c3199d00f015823d79f5
SSDEEP 768:ElzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hYero0w:ElzXl8pZ221WRmsYQL0u1jaKu/Lpd8hE
TLSH
T17BE20B3F244CCB7E4F844E9CEC266F966ED801CBA6984D5447FA894C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f9de1ba5f07f31edfa61e76e9f98fc539ba960fc3209223f83657dce91a32264
MD5 57e5ca9f1fe243c631e6efc463aedb5f
SHA1 60aef577c93db616c98aafd8e1dce2b0e1b43435
SHA512 dbdd9b405bb07327707e2cdfdbb41ce18edff7cd5e8f86598e454d47e332ec86d97c5864faf1a6301c9ca36c32bfb8175513cba793f78a32928e72daa1a5321e
SSDEEP 96:K8w4KB+eeRaKSQ61f451vFBfc5i2qNfKyOq7fu3/Kpu:qXFx1f451vFB05iVNHOq723/Kpu
TLSH
T10391F10674BB42623E7EAC0882D787171A4273633618E92B7B6841765E6BF241CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2b5425d954c8e04791882dbb910ce2f436b40828ddf74a888b688470e0931cd3
MD5 362d4deae309fd0a202472ff50a42dfd
SHA1 cee0c5ef22f3684f80ec3d64dbbb1ca33a6a175e
SHA512 f2c0ce6ffeabb16b41d4ca7fd59d4c32a93182d7c72daeb1b4735fd3d632ee18cbbdf1493f865244012099bfc732c1f4d1a59fcf026bf1c2c353ef347742955f
SSDEEP 384:4ZcIY8NNacUx4EktIUAK/rY8thBBeRs9JKgqijUIe:GYXxJUT/r5thBTjKgqmUIe
TLSH
T1A392AE306874AA7A9DE6E585F4863B1B8FF89067E7C46F94D0FCBB0D059A0D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 083b2d7bed90db10dd263912cea7876bde5648ba515513546ef98cef858047fc
MD5 9db7923271d64ce593165483f5130b95
SHA1 19e5969c39b53d5116b435030afc471a85d6c8b4
SHA512 7786d3cf618614c56e813e475b83b58ba72fea626b8d59854aaf38bc45ec947c662cd4ce4d0b15ce39e9d4f52b535febff852c953cdb0532e97a17182e347a31
SSDEEP 384:jZcIb8NN5cUx4EktIUAK/rYSZhBBeRs9JKgqijUIe:7bsxJUT/rNZhBTjKgqmUIe
TLSH
T131929E3068B5AA7B9CE6E585F446371B8FF89027E7C46F94D1FCBB0D058A5D8230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9b01ad465baf0e6fcc4f309ec8ae69b06bff6bb5f0aa7feb1a6db3092ed1de80
MD5 e1a793a5424a40e275dcd574446f20fb
SHA1 e6bea6f80c39397289f9199aeef4bf87f80d7416
SHA512 cbc8a1177b359d2713eda0a2e42e60792d94960d7ce6d19d99a91e5b91d6894cb7385b8ef1c8cde6dde4645cf34cf38f77691f842919a488bbf3fffbd3aec249
SSDEEP 384:FZcIY8NN5cUx4EktIUAK/rY8thBBeRs9JKgqijUIe:9YsxJUT/r5thBTjKgqmUIe
TLSH
T16C929E3068B5AA7A9CE6E585F486361B8FF89067E7C46F94D1FCBB0D018A4D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 439527b1efeb78cdeeb2523ded36a872eea62bb7eec70a26f5d99423ba4f0616
MD5 a082ec7c02b0c0dc224fe5b349545bf4
SHA1 9bac211e6cfdf8d967107d0036752fa13b33a40c
SHA512 2c7dab5d4f5d440b4bb2f2cf8a0ca2882a04d7b229a40400ea1c8cc90fbcd2680d03618aa234a8baf9f3973f16101797ad44152ed083d58ac47a2dbc2cfb4356
SSDEEP 192:7GNM6fNNQmiUyXzHzPL/GPTyeYhV7qDaT1U6:7GNM61LMzTPL/fU6U6
TLSH
T11302F934ACA86C7B8EE7AE55F48737175FA4207BDA951F44C6E82B0C00D769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6537a06dc25e28cc807d4b7cd22ce56eb765dc34e3762410029d74a37e3a09c3
MD5 a7291f0f9a1e3f9c7da1026932e22fce
SHA1 036d61490bed4f8cca461675373ebdb10b650139
SHA512 674b0600559483cac2e638d65a1613a79f8000973f8592225223f3dd405def168ad4bc5d9d7a2137382fa0d2724c527cb9aa4e41cd322bebc8593d48130851f9
SSDEEP 192:QGNw6fN7QmiUyoSzgL/GPTyeYecPwxQV3ZtqK28U6:QGNw61tBKgL/rYaLhBU6
TLSH
T1F4122931B8A8BC2B8DD2A4A5F48736179E645167DB896F84C6EC3B1C02DF1EC130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 78e00feec0ca9928fb6b586e995b022e3ffb8f3f89aba8e1525a11e2173fc89c
MD5 91333e046ddb98b31a2bd7c176a25ef4
SHA1 f2038581a968f81d1b303f2b250ced6b2df944e2
SHA512 aacb4f41c28339cf8560df6c8bf9b5ead650a246b4ffe003b8172119823a9ccf59eb0e98f49060804ff2f5d1a5256bb2ed88d5cd279bd8fe9dfc2767bcaf1530
SSDEEP 384:IZcIY8NN2cUx4EktIUAK/rY8thBBeRs9JKgqijUIe:2YHxJUT/r5thBTjKgqmUIe
TLSH
T1AA92AE3068B4AA7A9CE6E585F486371B8FF89067E7C46F94D0FCBB0D018A0D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads