Overview

overview

8

Static

static

1

Reserva un...ne.eml

windows11-21h2-x64

1

email-html-2.html

windows11-21h2-x64

8

email-plain-1.txt

windows11-21h2-x64

3

Analysis

  • max time kernel
    900s
  • max time network
    812s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/07/2026, 22:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    email-html-2.html
  • Size 7KB
  • Sample260720-2yptesav31
  • SHA256 aa4ffa9d5df98be05158faf5681ac4b723653ab77f6983641e0d221bb06467cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 55 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fffdfc4c188,0x7fffdfc4c194,0x7fffdfc4c1a0
      2⤵
        PID:2088
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,16369830764809424163,1329740602066950990,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:11
        2⤵
        • System Time Discovery
        PID:2112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10809726172380357427,7640319836989802696,262144 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:2664
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,11369024442082703031,14218233612990980797,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
          2⤵
            PID:4804
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,691126843473528898,9896758501019359188,2097152 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
            2⤵
              PID:904
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15606985567952125815,1093634482955897912,2097152 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
              2⤵
                PID:2320
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,13114749793625602365,18075978196923550361,2097152 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
                2⤵
                  PID:3232
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,9287301492854482689,1262728198382880619,2097152 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
                  2⤵
                    PID:3380
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4232,i,9859236900843635379,7782502342402361749,2097152 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
                    2⤵
                      PID:2868
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4272,i,17620385352784340026,18290855779119976677,2097152 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:9
                      2⤵
                        PID:4460
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,16575607284761247371,11942607387488867953,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
                        2⤵
                          PID:3260
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,8471263714356023615,15328645103136527485,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
                          2⤵
                            PID:2312
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15172194450221054131,6669368878325278469,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                            2⤵
                              PID:1276
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15172194450221054131,6669368878325278469,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                              2⤵
                                PID:1008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14189281681177308671,11960771431116828043,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3048
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1132
                                  3⤵
                                    PID:4492
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,13878413702765969245,13322641993367939963,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
                                  2⤵
                                    PID:4488
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,2321666802870354175,10465678512739153762,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
                                    2⤵
                                      PID:2156
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,11166461782368319937,7419512382519904497,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
                                      2⤵
                                        PID:2540
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,17298324199350271248,15964204292384486920,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
                                        2⤵
                                          PID:3532
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,10111847826071811418,8411905085303071478,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
                                          2⤵
                                            PID:2624
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5872,i,9464535747271095637,17050356484429523130,262144 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:10
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1424
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,1114925524184618333,14186580665102793333,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
                                            2⤵
                                              PID:4516
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,7555181718930699967,17054639669452939834,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
                                              2⤵
                                                PID:2540
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12956514747928923774,6294330375791167794,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
                                                2⤵
                                                  PID:4976
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,2157203242679361768,5636790610573893794,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14
                                                  2⤵
                                                    PID:3472
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,7684945863256587430,10866855516862490182,524288 --field-trial-handle=2184,i,5492954060766253703,8289282280043402339,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
                                                    2⤵
                                                      PID:3412
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:4440
                                                    • C:\Windows\system32\sihost.exe
                                                      sihost.exe
                                                      1⤵
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3044
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe /LOADSAVEDWINDOWS
                                                        2⤵
                                                        • Modifies registry class
                                                        PID:2872
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Boot or Logon Autostart Execution: Active Setup
                                                      • Enumerates connected drives
                                                      • Checks SCSI registry key(s)
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3172
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                      1⤵
                                                        PID:2876
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1724
                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                        1⤵
                                                        • Enumerates system info in registry
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:468

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 8b98ade942a8747b838525fab33e985cdad967132f18099e1927edd4ddcf705c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            4e7723c9-68b8-49c4-b7ce-4521a950e11a.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e7723c9-68b8-49c4-b7ce-4521a950e11a.tmp
                                                            • Size 70KB
                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            LOG.old
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                            • Size 331B
                                                            • SHA256 a24adfd0ae6582c0cb22e656b014b22e1cd5e61d43ccfe36c66f317cd9493dfe
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            LOG.old
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                            • Size 334B
                                                            • SHA256 a6c14a43babc9c49e31e5a5c83d2320b619c2e44fab47655a39709f3ddc8d08d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            LOG.old
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                            • Size 334B
                                                            • SHA256 c9b4c25c8df87c4e4fff22bc8659939ae3c43dbc96f5d0a129c96bedd2a262a2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            BookmarkMergedSurfaceOrdering
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                            • Size 6B
                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 3KB
                                                            • SHA256 0e575dfc20a906d4921440bf10d3322a767b2a99d09d449c1bf7c8b76d04e41b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SiteList-Enterprise.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                            • Size 2B
                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                            • Size 1KB
                                                            • SHA256 45e8a2634e4a84d4b45fbf631ffbaf52d01af160b738f7ca317feb034249d9e5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                            • Size 1KB
                                                            • SHA256 056bb0b06bb7704b1d5f4384e4ea5562112d46c9cae711e0f67df4421ad3f1f8
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                            • Size 111B
                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 10KB
                                                            • SHA256 e6913716d8bc7e961f8225a4c79e0003461690ec028e29827aad86379104112c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 10KB
                                                            • SHA256 1349f14a01b3e6a363e136d6cba1be8d18d975f83f2398d49b795b62c8a869e3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 10KB
                                                            • SHA256 c0e10caa32e3ccff4c7daf46d00452edded8aae4dd5b2104d3a70e9c7ea37cdd
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                            • Size 28KB
                                                            • SHA256 fd3870541adbde6eaa4feaf8e486bdd8fb90575f023a9d0bfe6d341e06bcd5cb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
                                                            • Size 816B
                                                            • SHA256 70f22b19185188bbace2e8c687e0675cccef08f1fae33c42107a22e379fe4b28
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
                                                            • Size 816B
                                                            • SHA256 0b4eeb059cfdf34013bbb11824d7e1d25b5ada5bb6ddcba750954403e9c20bb7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index.txt
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                            • Size 371B
                                                            • SHA256 2ee3d322099d3c9bab55c8a6a41fe4da39455f4aa4cdd327f11bd9b8185f2108
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            sync_diagnostic.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                            • Size 4KB
                                                            • SHA256 a76e73d16c6d8e5fe9218ac6abb384c30bb7488fc1411f980d77bf5ece637198
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 12KB
                                                            • SHA256 25032dcc71562efdf4fbf73c2d450842b5d0d6f5fca6e5f76707b3815a00a2bb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 20KB
                                                            • SHA256 640d23170a2e97047206d332da3830a6cff28e927599c61fbc22383a8ba2e775
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 19KB
                                                            • SHA256 e669112220daba56e63c826604af5021883b95923ec3d55e483ab14d5538b3cf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 13KB
                                                            • SHA256 e608e334fff8437d93b007fa8576311c838eea2abe349aa8e733f61c9b31a12b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 20KB
                                                            • SHA256 3a546667e57f74f4043a3c5f4be059fb80294198ebda7d838c5c964f59c89d41
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 8KB
                                                            • SHA256 ab102f24ff00756a72f48718abfb45b80771dd873677283b479fca3f4fa23aa7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 8KB
                                                            • SHA256 9156f3bd16cd40d94c166b0281087ede018a26cf0612c4fca29abf16dc9f5b43
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            22daf535-cb51-478a-a96e-d2b2f548ffba.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22daf535-cb51-478a-a96e-d2b2f548ffba.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            memory/468-443-0x00000184394B0000-0x00000184395B0000-memory.dmp
                                                            Download

                                                            memory/468-445-0x00000184395B0000-0x00000184396B0000-memory.dmp
                                                            Download

                                                            memory/468-451-0x00000184395B0000-0x00000184396B0000-memory.dmp
                                                            Download

                                                            memory/468-444-0x00000184394B0000-0x00000184395B0000-memory.dmp
                                                            Download

                                                            memory/468-466-0x0000018439290000-0x0000018439390000-memory.dmp
                                                            Download

                                                            memory/468-374-0x0000018437760000-0x0000018437780000-memory.dmp
                                                            Download

                                                            memory/468-371-0x0000018437B80000-0x0000018437BA0000-memory.dmp
                                                            Download

                                                            memory/468-310-0x0000018403FE0000-0x00000184040E0000-memory.dmp
                                                            Download