hxxp://goggle[.]com

Analysis

max time kernel
150s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250313-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250313-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://goggle.com

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876674878442993"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2366915068-2945093646-1682508031-1000\{8869582F-C85A-45DC-BC42-BF4EA0D0DF2E}	msedge.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4768	Process not Found
4672	Process not Found
544	Process not Found
2616	Process not Found
1248	Process not Found
2032	Process not Found
3728	Process not Found
3592	Process not Found
3500	Process not Found
4480	Process not Found
2508	Process not Found
3732	Process not Found
2612	Process not Found
3924	Process not Found
4556	Process not Found
1936	Process not Found
3716	Process not Found
1056	Process not Found
2848	Process not Found
2080	Process not Found
1648	Process not Found
1860	Process not Found
4572	Process not Found
3196	Process not Found
4716	Process not Found
4316	Process not Found
3056	Process not Found
3020	Process not Found
2392	Process not Found
2164	Process not Found
240	Process not Found
1768	Process not Found
1748	Process not Found
3544	Process not Found
1848	Process not Found
216	Process not Found
1872	Process not Found
4592	Process not Found
1664	Process not Found
3608	Process not Found
3204	Process not Found
4544	Process not Found
4644	Process not Found
4984	Process not Found
2864	Process not Found
3788	Process not Found
1008	Process not Found
984	Process not Found
1212	Process not Found
564	Process not Found
2156	Process not Found
3420	Process not Found
4536	Process not Found
4188	Process not Found
1744	Process not Found
1620	Process not Found
4000	Process not Found
4940	Process not Found
3472	Process not Found
4648	Process not Found
3992	Process not Found
960	Process not Found
1236	Process not Found
2312	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4684	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 3176	3752	msedge.exe	81
PID 3752 wrote to memory of 3176	3752	msedge.exe	81
PID 3752 wrote to memory of 5108	3752	msedge.exe	82
PID 3752 wrote to memory of 5108	3752	msedge.exe	82
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 1224	3752	msedge.exe	83
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84
PID 3752 wrote to memory of 216	3752	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://goggle.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x280,0x7ffadb62f208,0x7ffadb62f214,0x7ffadb62f220
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2140,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2560,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4216,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4236,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4844,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5292,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3344,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3608,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3468,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6072,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5192,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6416,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6132,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6668,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6828,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6964,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=604,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3636,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5404,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=3576,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=3724,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=3692,i,15619749305630035768,2912582521904350598,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3148

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c5055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a30e4e41a534edd73feda5b98272cb69

SHA1
64e5a7d2db025c4a058ee3a7e59d6ab1d760a9d3

SHA256
646196621e964288fb55321ca142c193bb4e940993eb2f4d2e0da383853cb918

SHA512
eeeb03711649773230ab251be30485af1337148a6699205dbe551ab207f5d407fc8424775c9a549a554bcdef22cc97c6e17884793a7d6f021aff4d98da7e1d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d2108420aafcdb3f79af5b1a8e14b3aa

SHA1
7233b2c9fde3fa03042a9a6119283ac7d327efed

SHA256
0d147df8630f0d62244f510066562f7f6fb2a20c2f838b17ba638690a8239abf

SHA512
52203bb5a5ed54cfcb5b3c83993bb3b53cd3b87f0199e6691983adf0b46aadbdd08a44cd20d9736b992980f9eeacbe227918c47386af9bbab084152f446589a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
1ab5c1a51aba9292c754f9abe65becc9

SHA1
14c9bbce1e1b6326fb414e4ccef8c6610502e0a3

SHA256
cae78eefc0fb16ef8189e410321d89bb488ce3d68844356ec7b00ab1bc466425

SHA512
b0851fdc232a1ab6da658c7f03ddf60b840d4e7b4f82c108d682b2bde0503a4044cc38ffc9c4193dfd9ddcd68f757529922962f718694a6af8239478ce50b808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
719a159d1a276e48b5436e203cacba57

SHA1
ab98af49fbc614e6ec17b21af8471bdf432ede25

SHA256
ff3bb591a445bffe9992e9f28876d081cf2bdf307a04d29282fab74debe15211

SHA512
969ddbc3c1270cf17d9ac5c8605c307541265906597306db2e500dc322d3a09b1228a60054d536ba50576eebda7bc53228f2416214d18bd3e214c74323e2be40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d0ec.TMP

Filesize
3KB

MD5
7f8cc4382e1239e935aacc56bf157050

SHA1
ab4ce44aeada0e3c4579ca700b2ae074bc02ffcd

SHA256
cb73e384a58987285fa4ed647877a65ddbe979a74fea8f7e046aaae920a67e3f

SHA512
2e1f9e17f40f47098e075b65e791a10d6a85a3b56da325af8f3df25867e6cfced98c906c596e003299ac1cdf1fa38181b7f58da8a6027052e65174878603bb2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
69654133d32f13a0493342d9da4d8085

SHA1
e05f78b2497f5e54b828a50aed0365418d857052

SHA256
8c0d76d7b0f89446d6d4260eeab33361cbd1c48b758ddc8e7b80cd97e22162c7

SHA512
2d48621c92751ba81038eb3c3351ae2d102dd4178efa12bf5a68c329e371e85333430d608c4b957a0db9f3c7310fa7e350709b689f16b3f867b4b805363d3574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e288b2ae82d595d7a9074954d36a0555

SHA1
8e1cabba7346c598ae8fdfa8cf4948567088bbd0

SHA256
463a947f1e31cc35fa97b20bdee5c484dc1a369cac3b2e110802ba100a5e6fb5

SHA512
7964fa21a07af0d64262cc48314de2018d094d5e05c16f6b036adab96203110c76b1e3db55773bf571dc55afff87b011acab74472ae3e8334465b30eb70eeac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
8fe8f8e01c7ad3e04f0fa300ad49ad7d

SHA1
58b8f0d5f87e347bd9bbdae69a08ec3d80ca3a73

SHA256
3193bac5e69d83dc4d387f12e345ded3c5a40f46eea28cdd5cedec90cb0b4e1e

SHA512
2b115324f1644f0873216a63acd8969966c6035c650f9a38daa76dbd21d0ba37eb473988fb8e646137118850fe3fdbd5ad533166df2dc71832c8187ba15300d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
604ce432b0b7dfd426f48e28c42e0a7b

SHA1
af5018b3abf9d096302da8f3e6ba51a98b1528fb

SHA256
00c87de16dd6f3dbcadb552bbf3275577f3b7a3eece82ed4dbe710e8218927e0

SHA512
818dd9feef141646b03a9ca6fb05017ef6b3cf74f9d3832c7cd5cfd898f5e5c7194adccba3aaeed76ed387c964d60720c791dd9d9990b633ba7a2c16f1191814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
7f48f9a03faf6f89e6f2935ab5eb3ac4

SHA1
83612260d347186a27e68e4a1d78a70a87b0e474

SHA256
6c52bb55f33f273b19feab704dcc47ed61e1cb66382615b79f64a603add859b7

SHA512
4256176623db93807743b57d201c5ffa80e974b8efb7fabdfea97e3a4267f41b1762ca8642e36c130f5c16dd1e34317d064dd1f3f0fc785d62f11756f117cd28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
a52ab32dc247fdcb7f6ddc84359da5ef

SHA1
8d437a01cf9f2a64d68a411b12955b9af978dac1

SHA256
ae60c046aa1ad5ddfe35ac0b92b94d01b91800eae18f1ee9d953587b1b3308b9

SHA512
773535abc85606c90b5a7c85c2da3fba6858e2e3bcf4476cbce384933ad84a759f4b46223fe885a6afef54e04900114dd382dd3f8d8a65dbb015e22bc664d33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c82734b5-1875-4441-8bb9-60c62eaaeed1.tmp

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
1021B

MD5
2b095136a1a8c2b8411a91f2cce9a52f

SHA1
ed318c03b7fb8d8b80f6ddc4d050ccd34c2f7b6a

SHA256
bcd218b7ea492e597b8f00b1aac73bfdc1965048fea4bef1d1c801ee253b6a0d

SHA512
e480c5e842fdca7d52a6c5a753f0599497369adcc957a6a27bc6f99a067039eaecbb6f6502e21bcad03ba59bbfe9e578dba31e6108ce1c1bc843fc677ebb5b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
70387b731b450d209ee8d955044b5616

SHA1
60c9e226652186b86385ed807cfaf6af3901b0af

SHA256
7ea4751f8c7570811c32716f3e05b5594439b9bde3894a3053bc01bef64e235c

SHA512
7410fe5bdc0849dba4e8318c22139bbeab9dc3ca63d18168da6916ca129269322c518ae0cc7bdcdd3010bbd686ed71c3660bfe426d7ca21a3eff2f113d0fc806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
b79c51c32deb4469471667aef2850750

SHA1
b2dca497db0ac2290eebc40b372c9f721829d31f

SHA256
520ecb457f85628ea5a00b234aec156557a39fe78608789a380416319cb151b4

SHA512
b19a4cc3dce53d4586dda96387bde8e0c020f40143e331544aa0cd59603b00b478ea39c9fe2d2f208d548bf8b834cd3b8c416ac569429df5f4a31444a6ab9a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
d3073f64f93fe127c65c45d907f23d48

SHA1
b83f78b7d5288557ca30a0189b66c85557caaecf

SHA256
779a70d7f5817e550f90cff735357102cef5e9c554abd687522d5cc4821e65fb

SHA512
b4feabe90ff085860c0d8dc0d6d92fb83fe5881029cdc494459cb834b867d326896446f1784be494aa8bcd0b3ad862d7b7e7dbfbeaa9b32aa4151a2a3c4aca45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
b890e630b99d2bc3d630f830fcdc4eea

SHA1
829918b80c833136199f195fdfe5cbb9d755292c

SHA256
f65cfffb4ac8acf61b8f0b3af632186df329d27cc923e32d4e5eb99e4f04d102

SHA512
6a4b8c8ce94bde576eb358cc93e2f4a453bf20ba2146345bb13dcbd5596cfef3055ba9635197be32bef6e761ab6736e8d37416a42fdcf1bdbfe806aa21f10df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b014e102c4f75d670ea9ad8b1eb83e51

SHA1
0b0d704e32984c710b662050106575f39b932f93

SHA256
b88a2ad671fbecb28326503269c939161ebf1b3e93c8467ae3cbe8f6a49f3e1b

SHA512
916e90aeccc34ab03e8e478c3a15e2cc03d80d030f7b29292674b13d3ecd714630bfa98f7bb9f2bc96dea27552c266e64474ba5d9a7ad054dbdcc80c1c0653d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4a8ca13-f31e-4913-908c-03d657e2dbf2.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads