Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://tileman.42we...

windows10-ltsc_2021-x64

6

https://tileman.42we...

windows11-21h2-x64

8

Analysis

  • max time kernel
    598s
  • max time network
    599s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/06/2026, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://tileman.42web.io/?=2
  • Sample260628-tevlkaat2p
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 52 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tileman.42web.io/?=2
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb57a6c188,0x7ffb57a6c194,0x7ffb57a6c1a0
      2⤵
        PID:4264
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,266416569549722669,6211324415575175250,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
        2⤵
        • System Time Discovery
        PID:4824
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9518654030048541395,1098643280684696349,262144 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
        2⤵
          PID:3468
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,11048061516482918962,9445733566291480893,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
          2⤵
            PID:1208
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,17008301372041604506,4626088148085645286,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
            2⤵
              PID:1152
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,9647023245819109258,6585907014876326188,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
              2⤵
                PID:4628
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,17420717972715303979,2745773202256793686,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                2⤵
                  PID:3312
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,15221249654916054874,3809349468644938053,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
                  2⤵
                    PID:4380
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4308,i,11256615848745085792,12556763304970255925,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
                    2⤵
                      PID:2192
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,12670781955401937748,15043161917387241463,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
                      2⤵
                        PID:3864
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5308,i,11795724095747118179,3363519946149544776,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
                        2⤵
                          PID:4760
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2378519864860134673,16510888129534407776,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
                          2⤵
                            PID:2780
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,18196654662618754049,4005222001281964479,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                            2⤵
                              PID:4464
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,13692811257819475,2512985019172457375,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3648
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                cookie_exporter.exe --cookie-json=1104
                                3⤵
                                  PID:4588
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,10586382964547765439,10684607102411940487,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
                                2⤵
                                  PID:2788
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,10586382964547765439,10684607102411940487,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
                                  2⤵
                                    PID:1132
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6240,i,9294561645392958087,11967145443152112871,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
                                    2⤵
                                      PID:3232
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6948,i,866758977678681593,1814807694505640048,2097152 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
                                      2⤵
                                        PID:3596
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10381507881279870360,15335550503146196190,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
                                        2⤵
                                          PID:4848
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,7971271354943015085,11171755445737595952,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
                                          2⤵
                                            PID:4440
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,12552397349524361983,16610864784137496193,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                            2⤵
                                              PID:996
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,690991274409684385,10166152402699875889,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
                                              2⤵
                                                PID:2884
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6664,i,12562206490922250513,13566713823454362520,262144 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:10
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3924
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,5521033002560678363,6879941757303684018,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
                                                2⤵
                                                  PID:4476
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,15895083028921290164,8526401477991167502,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
                                                  2⤵
                                                    PID:3948
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,12915632128254154004,9224697997634391531,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
                                                    2⤵
                                                      PID:2444
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,4746122171292959992,3318099041424813096,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=964 /prefetch:14
                                                      2⤵
                                                        PID:428
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,2557249212698086089,13438427296785059824,524288 --field-trial-handle=2268,i,2798731698366239369,1097992885143789319,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
                                                        2⤵
                                                          PID:1544
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:3524
                                                        • C:\Windows\system32\sihost.exe
                                                          sihost.exe
                                                          1⤵
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3356
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe /LOADSAVEDWINDOWS
                                                            2⤵
                                                            • Modifies registry class
                                                            PID:1224
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                          • Boot or Logon Autostart Execution: Active Setup
                                                          • Enumerates connected drives
                                                          • Checks SCSI registry key(s)
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1660
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                          1⤵
                                                            PID:4052
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1200
                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                            1⤵
                                                            • Enumerates system info in registry
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1664

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                blocklist
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                • Size 105KB
                                                                • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                LOG.old
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                • Size 357B
                                                                • SHA256 9a79dd2fd16402e07150f5820bdfe03e0fcb73b5f6225617e5660b85df1e8fd7
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                MANIFEST-000001
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                • Size 158B
                                                                • SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 4KB
                                                                • SHA256 7dbf527ee908fc0afacc39e55c4904f854a0d18e5b47e0131e2cce815f896f6a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 4KB
                                                                • SHA256 ae7414970f8dab623758b5be395da10fc60c41fad145889424c229169acef2c6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                the-real-index~RFe588354.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588354.TMP
                                                                • Size 3KB
                                                                • SHA256 d62452a5c2e55046ad09222ae2fd48e1f2ebe055ffa4f59ee7af0ebad7e900eb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                HubApps
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                • Size 106KB
                                                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 8KB
                                                                • SHA256 dcb30b3a12494c3f8287316a9d9e5525ccc4831a1a79e0319179d142bfb0e6c4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 8KB
                                                                • SHA256 539073358bdec2ee205d1e400d7c425f66d3def2600753c89dc9d9c55241df25
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 9KB
                                                                • SHA256 9f415535878f977b30d39d65a7e9590ea517a94f1febfb6ce28ad424463c39be
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 8KB
                                                                • SHA256 4eac4c3b8a32e65b4fedd116a3d8951700348904e1cabb35becf6b9dd3cc5ff3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 8KB
                                                                • SHA256 46dd249cf2e751f19c2c92e5db4939954f1bfc950ea6496b05bb8d6082367dbb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 111B
                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 13KB
                                                                • SHA256 b90fba0a40c22e1d53cfb2fdb6820bab32e81bfc408ea318f08997150cf7e991
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 13KB
                                                                • SHA256 994286de962436d2bad56ec35012e792c2062379a4348de8a6d87bf59ec1b34b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 13KB
                                                                • SHA256 7b56a2e75c7c4b70bf0f5e56425e3f72af1de4c25554f6d9e668f68e0a2c5ee0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 28KB
                                                                • SHA256 3b46faa524e853d593d4f864cd1f263e19f8b5de89ae0d574dbd60485561fe48
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 31KB
                                                                • SHA256 11124d0f6d9ea735455244e8c5c7d4b7e769f5dc66dc4ea46bdd44c6f18f0e93
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                temp-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\temp-index
                                                                • Size 2KB
                                                                • SHA256 33e23260ce3d20b4e33b9be498d028525e52bf25c88dd0d720dbfc639a8a06e8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe5cba10.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe5cba10.TMP
                                                                • Size 2KB
                                                                • SHA256 c873e8fd4fd6ca3437da3280fc854006c0fd0fdadd51f6df146a3c28ef25cabc
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                index.txt
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                • Size 371B
                                                                • SHA256 21d701fdd8eb49f75f1aa4a23760736c5146cc6a879e4432f7910a86657a1188
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                • Size 240B
                                                                • SHA256 e94fa719507b78981f41179a224baa08aadefb7a65aaf265cc1fe3a7fefae3c3
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe587f9b.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f9b.TMP
                                                                • Size 48B
                                                                • SHA256 baf2da870170033788ee889baf6b5302c476c0b52ca5ea9c25c5a9c277f6e8a3
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                • Size 72B
                                                                • SHA256 ec3015eae3b815f0cfb35bdce853596307e67da2472702474b338905f5789e37
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 4KB
                                                                • SHA256 03f37c5e855e4b9c6ea4eaa02d6e73d3bf7d378778bae3dc4a6fc5050ce8b2a6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\46b585d1-a007-46cb-ad24-46891408b0e8\index-dir\the-real-index
                                                                • Size 72B
                                                                • SHA256 2fc81cdf5a251e1d00627dfda6a880b4e6f0624a1edf827b2a1dae368c0115a4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe587fe9.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\46b585d1-a007-46cb-ad24-46891408b0e8\index-dir\the-real-index~RFe587fe9.TMP
                                                                • Size 48B
                                                                • SHA256 44c81273547ea98e43610a23fe0ab29874bdd8c1fd08b14111695cf830076c93
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                index.txt
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                                • Size 233B
                                                                • SHA256 71dff051b606799258929704487e30a61fd4f93fec274369fd1ca5e592866837
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                index.txt~RFe588008.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe588008.TMP
                                                                • Size 239B
                                                                • SHA256 d709b332daeb081ffcc8f13d0008df5bc2040425542de2be8ae10e2169fdc55b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                OperationConfig
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig~RFe59097c.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59097c.TMP
                                                                • Size 3KB
                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 19KB
                                                                • SHA256 9e3e54208f1b2e56d328ed0c5e97f330265418e3ca1f34cff93ae92872769b6c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 19KB
                                                                • SHA256 c504ad5d8c7c18e5c8daedb8384e1fd548f6564bfce490497029a4f5f544a2cc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 19KB
                                                                • SHA256 a66e12d513e9e7ceb3bcb4d24082171422e2301f8af62056102cd4b8183c8fe2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 27KB
                                                                • SHA256 956fd59d1a3308954979ba152a56373086a060f57687e444dabe4c959f8c6cb5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 27KB
                                                                • SHA256 cb218749ec89d13c8e08bc9fa5eaf8637bd887a52bef9555c74d3218d79784ee
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 578f11e6fc1cf266393f40f433e939118ffcfa3e539bc84aa1e625dc405a95c5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 d437fed2cbc1ba88127e1e03c1aaf198426ee987b4bcdea3c99f3af0df32db95
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                iconcache_idx.db
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                • Size 28KB
                                                                • SHA256 eaf324c86d0c45bb1bbea9d430a67a85c96377e443de2653bd8b235a6baa65df
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/1664-526-0x00000200A6600000-0x00000200A6700000-memory.dmp
                                                                Download

                                                                memory/1664-595-0x00000201DA440000-0x00000201DA460000-memory.dmp
                                                                Download

                                                                memory/1664-592-0x00000200A6240000-0x00000200A6340000-memory.dmp
                                                                Download

                                                                memory/1664-598-0x00000200C9F80000-0x00000200C9FA0000-memory.dmp
                                                                Download

                                                                memory/1664-674-0x00000201DB930000-0x00000201DBA30000-memory.dmp
                                                                Download