Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://17augdoomsers...

windows10-ltsc_2021-x64

3

http://17augdoomsers...

windows11-21h2-x64

8

Analysis

  • max time kernel
    900s
  • max time network
    814s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-de
  • resource tags

    arch:x64arch:x86image:win11-20260911-delocale:de-deos:windows11-21h2-x64systemwindows
  • submitted
    11/10/2026, 12:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://17augdoomsers.blogspot.com/pleasant.pdf
  • Sample261011-p2vsmaaa46
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 22 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 57 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://17augdoomsers.blogspot.com/pleasant.pdf
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffafd18c188,0x7ffafd18c194,0x7ffafd18c1a0
      2⤵
        PID:4756
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,11271071761481818834,2845435285168005611,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
        2⤵
        • System Time Discovery
        PID:4588
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,14020161435997221035,8285954215332524950,262144 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
        2⤵
          PID:4320
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8801045692199181204,1501330413777852102,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
          2⤵
            PID:4952
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,715810135516009507,1374639928727656466,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
            2⤵
              PID:3632
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,8048051339686147061,4969860567495784692,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              2⤵
                PID:4700
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,9039070196096892058,6353607090375854518,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                2⤵
                  PID:244
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,9983771571352104391,11012386841725914783,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
                  2⤵
                    PID:4976
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4172,i,17648290716871776295,5062690828553572055,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
                    2⤵
                      PID:4852
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,976819976251563493,12754866592442361751,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
                      2⤵
                        PID:1812
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4552,i,2359288000485762603,1011438797648816868,2097152 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
                        2⤵
                          PID:1644
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,170881202695559450,15735791556786295492,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
                          2⤵
                            PID:3032
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,8468936657878198843,1185531242240776477,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                            2⤵
                              PID:3792
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,847434087922270761,5635297119311258397,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                              2⤵
                                PID:1836
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,847434087922270761,5635297119311258397,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                                2⤵
                                  PID:2776
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,9808780761956316322,5142443155777474950,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4032
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                    cookie_exporter.exe --cookie-json=624
                                    3⤵
                                      PID:4488
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,7200382729571488909,9004228186980719201,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                    2⤵
                                      PID:4924
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,14880889895080821627,13562116373351385211,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
                                      2⤵
                                        PID:656
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,11955945423582844234,8552483886391264988,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
                                        2⤵
                                          PID:1408
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,5293581449284344819,14409305645949838120,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                                          2⤵
                                            PID:3276
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,4967873075171742467,10966432530131336688,262144 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:10
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1436
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13237860038323607629,3025940130374264203,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
                                            2⤵
                                              PID:3252
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,967432502106572540,11950525125520114168,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
                                              2⤵
                                                PID:2240
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,16864498949407727703,14767569059811313354,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
                                                2⤵
                                                  PID:1464
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,1338773617223088519,16137479859103100076,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:14
                                                  2⤵
                                                    PID:1488
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,11069999560442248893,6896362673684882068,524288 --field-trial-handle=1716,i,3119156045199179583,16377487425572822048,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                                                    2⤵
                                                      PID:3232
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:3780
                                                    • C:\Windows\system32\sihost.exe
                                                      sihost.exe
                                                      1⤵
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4736
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe /LOADSAVEDWINDOWS
                                                        2⤵
                                                        • Modifies registry class
                                                        PID:3456
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Boot or Logon Autostart Execution: Active Setup
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:2712
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Boot or Logon Autostart Execution: Active Setup
                                                      • Enumerates connected drives
                                                      • Drops file in Windows directory
                                                      • Checks SCSI registry key(s)
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:568
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4324
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                      1⤵
                                                        PID:988
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3700
                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                        1⤵
                                                        • Enumerates system info in registry
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3896

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            2fec666c-a2d5-4ded-a9c4-096d77cb83f2.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2fec666c-a2d5-4ded-a9c4-096d77cb83f2.tmp
                                                            • Size 26KB
                                                            • SHA256 64a252616969e3f92696b0f5b9598d5745b407bda1786838aa51ebde08f29fef
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            3264cb51-d688-42bb-a764-aa72bdd10469.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3264cb51-d688-42bb-a764-aa72bdd10469.tmp
                                                            • Size 18KB
                                                            • SHA256 6f603ffa2de7b8bf3748af16654bc9b68e98f505a686d9b6c67ec98fb6e3b8a5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            36d07599-22ca-4b35-8834-e170a9bb8e6a.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36d07599-22ca-4b35-8834-e170a9bb8e6a.tmp
                                                            • Size 8KB
                                                            • SHA256 127ba5d6798e6af9aaf0bd79c229b485826e5587126e899fa2cd6ec19df2b65d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            700489b2-d497-4081-9172-9e880c100cdc.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\700489b2-d497-4081-9172-9e880c100cdc.tmp
                                                            • Size 18KB
                                                            • SHA256 a125b5baa7f2fb64d59cd6f6937acdf85ba031d9e533e7497de1f8db27eeec00
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            8a572aa6-dcc2-43eb-b197-6cdd66205eb6.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a572aa6-dcc2-43eb-b197-6cdd66205eb6.tmp
                                                            • Size 26KB
                                                            • SHA256 cd4ea15039e956797e99363fcb265a80bae718a82d688f901dd00c884c12fe88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 798df09e54df6f20104c3db421e9c171028a1a3e0e66d5471b3e5f70d71b3aab
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            3a36a698-7f76-486e-a6d0-f1346ab47ff2.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a36a698-7f76-486e-a6d0-f1346ab47ff2.tmp
                                                            • Size 10KB
                                                            • SHA256 29f338b707ad5de83a5b8481037201dfe2d4de7618ede0086cc71ca2c7b5380d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            3d4f5ecb-1c7b-4420-a4ab-649e3d59f5f6.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d4f5ecb-1c7b-4420-a4ab-649e3d59f5f6.tmp
                                                            • Size 10KB
                                                            • SHA256 89bcf7a3cb2d9f24b7f15c0e30d797c28b36ee032aee7a138bbcf41a2ba59925
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            5d7e309e-38db-4a6d-85ba-343a939bcd11.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d7e309e-38db-4a6d-85ba-343a939bcd11.tmp
                                                            • Size 70KB
                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            7a4d7873-960a-4934-bd47-d270c7097975.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a4d7873-960a-4934-bd47-d270c7097975.tmp
                                                            • Size 28KB
                                                            • SHA256 aca3f4213f2ee701e26a04d9a2fb82ffef1e13444e3411610653901fc60651bf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            LOG.old
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                            • Size 331B
                                                            • SHA256 ca6c78ebdf7eca0097673e88212862c6e9a6a85200602b8141f636b0b3285d4f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            LOG.old
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                            • Size 334B
                                                            • SHA256 c1e6752cf0f61c40ab267ef3836c96dda8b2a47890c3b003f0271e46f7a82d75
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            LOG.old
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                            • Size 331B
                                                            • SHA256 658ad39c0684f5c87804212dfc3a6a544cf96f86a9876eaaf20c93a8c84a4d88
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                            • Size 3KB
                                                            • SHA256 c756761aaa5431b5ce6e8c233a74a6df301b37da9851e07d04a29226531037b8
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 3KB
                                                            • SHA256 b02ad81f0077cff7f9a30329e742834f739c9e08af8012d6b53502b643ff2730
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            7ccf9239-9d56-4f3d-b1c0-6ccc031ed6eb.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7ccf9239-9d56-4f3d-b1c0-6ccc031ed6eb.tmp
                                                            • Size 2B
                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            0d74b398-7741-4954-85f9-82f65607f6f0.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d74b398-7741-4954-85f9-82f65607f6f0.tmp
                                                            • Size 1KB
                                                            • SHA256 6f0914476f277530125e643feeb3f63c4811d9a987c928406df43917fad0d79c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            3b3cea45-e52d-49dd-a61b-3c0ddb192eef.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3b3cea45-e52d-49dd-a61b-3c0ddb192eef.tmp
                                                            • Size 111B
                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            60649956-51fc-4303-83bf-855876376d4b.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\60649956-51fc-4303-83bf-855876376d4b.tmp
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            b668b6fc-1996-439c-a152-164819e75ac8.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b668b6fc-1996-439c-a152-164819e75ac8.tmp
                                                            • Size 1KB
                                                            • SHA256 a3e52410426e1412bf8248bf4eb1c7553dd4d788f441f67b201a7742a63e8124
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 10KB
                                                            • SHA256 6f123c745b7c1522b2434870786d7ab858f9f2fb9850b05e9e25ab6668f279f8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\temp-index
                                                            • Size 864B
                                                            • SHA256 9f3a23d826c32675c7e97ffffdd52cf307f25a22df04c272a5b96ee36959a400
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\the-real-index
                                                            • Size 864B
                                                            • SHA256 b32ca78907e417d0dbb596977c70971d12d668707b0fce25c0bd3913fd165626
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index.txt.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                            • Size 371B
                                                            • SHA256 5ec06aaae7477b9ce4a38b9736b454a347e89ee9a4d7f35080d2422dc9a20bb0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            sync_diagnostic.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                            • Size 5KB
                                                            • SHA256 565d49ebf612a777f1c7ebd4a00fe24ceba5ee9262250be698eff1927c5e19b3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            9d4d7d65-2a51-4e99-81ed-99b25e74216c.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9d4d7d65-2a51-4e99-81ed-99b25e74216c.tmp
                                                            • Size 22KB
                                                            • SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 8KB
                                                            • SHA256 9bc381387daec047fd3c643c2fb4c7a148a90b74c863828702b81c8aef36488b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            c0a56cbe-1832-4307-9e2c-a642a9bad533.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0a56cbe-1832-4307-9e2c-a642a9bad533.tmp
                                                            • Size 18KB
                                                            • SHA256 2f298afcfc24033494783b4d1707ca87e319c30f99b1a5baa7e8c4ecbf2c8b9e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            c086e762-7d3f-4619-920c-0779bc73c8c1.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c086e762-7d3f-4619-920c-0779bc73c8c1.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            iconcache_idx.db
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                            • Size 28KB
                                                            • SHA256 a1d016c7284c73611343ae540b3c1b3b900b18b162f66d1a48c82e9aa6dc6b16
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            volume.PNF
                                                            • Path C:\Windows\INF\volume.PNF
                                                            • Size 6KB
                                                            • SHA256 9b5721dc4c75cf9579bd61c6bd0a1bbeb86fe9e7d2b4f001037888c0cc1405da
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            memory/3896-446-0x0000028A75DE0000-0x0000028A75EE0000-memory.dmp
                                                            Download

                                                            memory/3896-445-0x0000028A75DE0000-0x0000028A75EE0000-memory.dmp
                                                            Download

                                                            memory/3896-463-0x0000028A761E0000-0x0000028A762E0000-memory.dmp
                                                            Download

                                                            memory/3896-491-0x0000028A761E0000-0x0000028A762E0000-memory.dmp
                                                            Download

                                                            memory/3896-423-0x0000028974B90000-0x0000028974BB0000-memory.dmp
                                                            Download

                                                            memory/3896-422-0x0000028A74D10000-0x0000028A74D30000-memory.dmp
                                                            Download

                                                            memory/3896-379-0x0000028972A00000-0x0000028972B00000-memory.dmp
                                                            Download

                                                            memory/3896-369-0x0000028960EB0000-0x0000028960FB0000-memory.dmp
                                                            Download