Overview

overview

8

Static

static

1

PlayGTA5/D...me.cmd

windows11-21h2-x64

3

PlayGTA5/D...ommand

windows11-21h2-x64

3

PlayGTA5/D...me.ps1

windows11-21h2-x64

3

PlayGTA5/L...al.cmd

windows11-21h2-x64

3

PlayGTA5/L...ommand

windows11-21h2-x64

3

PlayGTA5/S...al.ps1

windows11-21h2-x64

3

PlayGTA5/V...me.cmd

windows11-21h2-x64

3

PlayGTA5/V...ommand

windows11-21h2-x64

3

PlayGTA5/d...ame.py

windows11-21h2-x64

3

PlayGTA5/m...her.sh

windows11-21h2-x64

3

PlayGTA5/s...cal.py

windows11-21h2-x64

3

PlayGTA5/s...eck.js

windows11-21h2-x64

3

PlayGTA5/s...ler.js

windows11-21h2-x64

3

PlayGTA5/s...x.html

windows11-21h2-x64

8

PlayGTA5/s...y.html

windows11-21h2-x64

3

PlayGTA5/s...uch.js

windows11-21h2-x64

3

PlayGTA5/v...ame.py

windows11-21h2-x64

3

Resubmissions

26/10/2026, 17:33

261026-v4tw1afv4v6

26/10/2026, 14:35

261026-rx229axtcw8

Analysis

  • max time kernel
    900s
  • max time network
    813s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    26/10/2026, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PlayGTA5/support/index.html
  • Size 10KB
  • Sample261026-rx229axtcw
  • SHA256 a5bc9c6cfe38d08d745a4daafa1d882eb96a090714c52eedf1933eec3a63e9df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 54 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\PlayGTA5\support\index.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe677dc188,0x7ffe677dc194,0x7ffe677dc1a0
      2⤵
        PID:5068
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7934214009489913014,9104126466753679396,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
        2⤵
        • System Time Discovery
        PID:5100
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,6861348599277782418,14209190943011526113,262144 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
        2⤵
          PID:432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,17704165309452828124,13012013085856187840,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
          2⤵
            PID:2272
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3931627632073602731,3076539721856609260,2097152 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
            2⤵
              PID:1264
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,12110908379953336752,15209125580826456265,2097152 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
              2⤵
                PID:3832
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,8891870574509417186,11758349042754309863,2097152 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
                2⤵
                  PID:4496
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,4223224614941433731,6087951650098113340,2097152 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
                  2⤵
                    PID:2004
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4160,i,16049742324917110158,14342858339411452454,2097152 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
                    2⤵
                      PID:1000
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4172,i,116448406233772476,5931866536285738447,2097152 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
                      2⤵
                        PID:3432
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,10880240810541403788,15310951082885848665,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
                        2⤵
                          PID:4492
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,886941385347358010,365952575283489102,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
                          2⤵
                            PID:4604
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,3732271439416247053,714472230978492339,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3768
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                              cookie_exporter.exe --cookie-json=1128
                              3⤵
                                PID:3364
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,18349600575333767295,314145484291246118,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                              2⤵
                                PID:1080
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,18349600575333767295,314145484291246118,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                                2⤵
                                  PID:992
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,12713044828658041845,16086772991552530314,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
                                  2⤵
                                    PID:4964
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,14858860224430219965,5054169731593254477,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
                                    2⤵
                                      PID:1416
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,1568888321382883688,4419412518734388787,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
                                      2⤵
                                        PID:4952
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,17477644069977540097,9688724434259564937,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
                                        2⤵
                                          PID:4748
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5088,i,257432908490226999,8586629754133853733,262144 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:10
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4344
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,3961353923430272891,12020601452086712442,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
                                          2⤵
                                            PID:960
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11657524967360990390,10691343481223620381,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:14
                                            2⤵
                                              PID:1776
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,1201990424651754692,6667056759663646569,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
                                              2⤵
                                                PID:440
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1020,i,5329797032630551845,8075787086527174224,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                                                2⤵
                                                  PID:3184
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,14329831564768027308,2528113581820072883,524288 --field-trial-handle=2480,i,15097772014211752469,14786382245017285,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
                                                  2⤵
                                                    PID:4056
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:2448
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3584
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe /LOADSAVEDWINDOWS
                                                      2⤵
                                                      • Modifies registry class
                                                      PID:2536
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:900
                                                  • C:\Windows\System32\rundll32.exe
                                                    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                    1⤵
                                                      PID:3448
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2216
                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                      1⤵
                                                      • Enumerates system info in registry
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4296

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          83acbbe3-7c25-4882-b454-4a576ab2e26a.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83acbbe3-7c25-4882-b454-4a576ab2e26a.tmp
                                                          • Size 18KB
                                                          • SHA256 56e7a84eb2dc3520d65f078e607dad341355406765aadb5067bf297887ab083b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          9544110c-808f-4e35-b158-2b367453778e.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9544110c-808f-4e35-b158-2b367453778e.tmp
                                                          • Size 8KB
                                                          • SHA256 dae26ff131cf0a957d77bdac96fd8377dbfb27e6883c9ad48bee49f47dc175a0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 798df09e54df6f20104c3db421e9c171028a1a3e0e66d5471b3e5f70d71b3aab
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          1720c75d-a2f6-4f9b-a885-23562289ac88.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1720c75d-a2f6-4f9b-a885-23562289ac88.tmp
                                                          • Size 6B
                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          1a2c83b2-8a64-4f5f-9dc4-53638e95d3a8.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a2c83b2-8a64-4f5f-9dc4-53638e95d3a8.tmp
                                                          • Size 10KB
                                                          • SHA256 53f21c2b73267dfcdb387f847d97ad2cd33a495292385d23da059f8b874df5e5
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          3af14638-7f18-4697-b24d-0170bc4a5745.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3af14638-7f18-4697-b24d-0170bc4a5745.tmp
                                                          • Size 10KB
                                                          • SHA256 740020c55d5d9af6559ed6400230d56741dd73689e362ccd5568f709f155d0fd
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          56f92bee-85eb-474d-b584-46631595fe48.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56f92bee-85eb-474d-b584-46631595fe48.tmp
                                                          • Size 28KB
                                                          • SHA256 7589ee2a687a4bd55de07d5ac45cdd362807a9a2e16cacafee48a4f5afcc2273
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          8b2f039f-1729-4db2-9227-5323d73294c3.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b2f039f-1729-4db2-9227-5323d73294c3.tmp
                                                          • Size 70KB
                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          9208546d-5da6-449a-a966-48f6f734e2b2.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9208546d-5da6-449a-a966-48f6f734e2b2.tmp
                                                          • Size 9KB
                                                          • SHA256 86935622f6a305cd237680cd614be88a3f18e4b8b025d6b0aa28f8ee819c080b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          LOG
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
                                                          • Size 331B
                                                          • SHA256 44264c0622319763f66fe89b3a7a6fd73c619f284ebfb30a0091a119111fa06c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          LOG.old
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                          • Size 334B
                                                          • SHA256 1db98d0bde55234f7b7f0d08433b78b07ee0105459da9ab3714b1a3a1ade4013
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          LOG.old
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                          • Size 331B
                                                          • SHA256 4538d0a3185202c4b086419641c6928b8d9a1a5e3a3bc6264542905a77b63702
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          temp-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                          • Size 3KB
                                                          • SHA256 900f4470b196f88482375f4404ee4d9c69b6d6a5e2ab7012d026c627b0abfd50
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                          • Size 3KB
                                                          • SHA256 12f1e775a8d66e7ba284e42981ada317f6dec116190caa13c0d3e887d0d92305
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          98da03c9-d435-4544-9c4e-5abea257dace.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\98da03c9-d435-4544-9c4e-5abea257dace.tmp
                                                          • Size 2B
                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          3c4d4dbd-c937-410f-b745-2726b9ead6fc.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3c4d4dbd-c937-410f-b745-2726b9ead6fc.tmp
                                                          • Size 966B
                                                          • SHA256 7b8b931123c4468679dd775cf0acf850d0bd3c45f01695fe770cdf2e89c7c390
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          4e2db7c9-504d-45c5-8c43-0932a14e11a0.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e2db7c9-504d-45c5-8c43-0932a14e11a0.tmp
                                                          • Size 949B
                                                          • SHA256 d2655d7ec2b9ec0d8b86bd37d3dc748042d084b1c1893f7fe438f47cfcc713a4
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          7b50c622-842c-49d7-92e1-4b5d975688e5.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b50c622-842c-49d7-92e1-4b5d975688e5.tmp
                                                          • Size 111B
                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          d67dd874-dbe3-4318-9109-8f68501b4531.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d67dd874-dbe3-4318-9109-8f68501b4531.tmp
                                                          • Size 2B
                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          temp-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\temp-index
                                                          • Size 768B
                                                          • SHA256 c38fcfaeaf17b078d91d75268a57b3042d95230e61e2f5b950aa28286efa811d
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\the-real-index
                                                          • Size 768B
                                                          • SHA256 9a6ce4d20090dba74f6fa18c2826aef7f66e28712b9a14d79ea74730f9d6a719
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          index.txt.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                          • Size 371B
                                                          • SHA256 42e4b3f10edc878712e67de6c6cf511fe59a1ac376d85055885bbb6979943ebe
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          sync_diagnostic.log
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                          • Size 4KB
                                                          • SHA256 b04db1958a92e69fd99c0a7b4b894afdccbf282849a219d8c224eb81d7e73edc
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          c47723d2-1b45-4790-b92f-da7227f8178a.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c47723d2-1b45-4790-b92f-da7227f8178a.tmp
                                                          • Size 10KB
                                                          • SHA256 5a693c01f4c8bc67b072770b9debfd5b470d336527ce5016d429dce654640c19
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          0699f094-62f1-48d8-9576-e97a81f48d37.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0699f094-62f1-48d8-9576-e97a81f48d37.tmp
                                                          • Size 22KB
                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          OperationConfig
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                          • Size 3KB
                                                          • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          c23a1a49-4983-40bb-99b0-62eef1025846.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c23a1a49-4983-40bb-99b0-62eef1025846.tmp
                                                          • Size 21KB
                                                          • SHA256 abbe8c0c852a2037642f0c8189614c10cf7811280becaafcbccb7ca693a9d8fb
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          cb1e550b-df91-4e03-87be-73f6eb2db2b7.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb1e550b-df91-4e03-87be-73f6eb2db2b7.tmp
                                                          • Size 21KB
                                                          • SHA256 c474aa46901a9229e9c1663a2aaf3960d2d99f2cdfd11e2781541a529f50d285
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          cec004ad-19e1-43e0-888f-010196e1f339.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cec004ad-19e1-43e0-888f-010196e1f339.tmp
                                                          • Size 18KB
                                                          • SHA256 46044547ed38f6667b6af4933aefbfc4ea288b4494a9f354921805d4ee9d9cc5
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          dd493b4a-df90-4540-b1c0-ecb8299eda9f.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd493b4a-df90-4540-b1c0-ecb8299eda9f.tmp
                                                          • Size 8KB
                                                          • SHA256 aeb6c9f9062082ccc15bcfc5fbe076ed37b1cd7b395c023cdb652aade6d9090a
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          f28e8bc8-4f3d-4c6b-aa51-c71877a6e283.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f28e8bc8-4f3d-4c6b-aa51-c71877a6e283.tmp
                                                          • Size 13B
                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          f1a3f3e5-5cb8-43db-9486-d041041cf58b.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1a3f3e5-5cb8-43db-9486-d041041cf58b.tmp
                                                          • Size 18KB
                                                          • SHA256 4e853ea8546b2fef54db91454e3b65d6dba373390fbad50aa4d9ecb16ebb3d4a
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          memory/4296-385-0x0000021BA50F0000-0x0000021BA51F0000-memory.dmp
                                                          Download

                                                          memory/4296-386-0x0000021CA60C0000-0x0000021CA60E0000-memory.dmp
                                                          Download

                                                          memory/4296-387-0x0000021BA5940000-0x0000021BA5960000-memory.dmp
                                                          Download

                                                          memory/4296-454-0x0000021CB7B80000-0x0000021CB7C80000-memory.dmp
                                                          Download

                                                          memory/4296-351-0x0000021BA50F0000-0x0000021BA51F0000-memory.dmp
                                                          Download

                                                          memory/4296-350-0x0000021B92C90000-0x0000021B92D90000-memory.dmp
                                                          Download