Overview

overview

8

Static

static

3

! AdobeAft...on.zip

windows11-ltsc_2024-x64

1

! AdobeAft...on.zip

windows11-21h2-x64

1

2/support/...er.exe

windows11-ltsc_2024-x64

4

2/support/...er.exe

windows11-21h2-x64

4

2/support/...4D.exe

windows11-ltsc_2024-x64

3

2/support/...4D.exe

windows11-21h2-x64

3

2/support/...ce.cmd

windows11-ltsc_2024-x64

8

2/support/...ce.cmd

windows11-21h2-x64

3

AdobeAfter...on.xml

windows11-ltsc_2024-x64

1

AdobeAfter...on.xml

windows11-21h2-x64

8

Resubmissions

10/08/2026, 07:48

260810-jm4jbsyth17

10/08/2026, 07:47

260810-jmz6xatflc7

24/07/2026, 22:22

260724-2amn6agk9x8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    839s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/07/2026, 22:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AdobeAfterEffects26AllTrial_maxon.xml
  • Size 1KB
  • Sample260724-2amn6agk9x
  • SHA256 b15c40c43c60d0213528c56ef0a436c27edb4db9b1bd221a057d00bcb0c4d8da
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AdobeAfterEffects26AllTrial_maxon.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:568
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AdobeAfterEffects26AllTrial_maxon.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/AdobeAfterEffects26AllTrial_maxon.xml"
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff9ec47c188,0x7ff9ec47c194,0x7ff9ec47c1a0
          4⤵
            PID:2560
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,7284020952672208128,12007362270225513692,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
            4⤵
            • System Time Discovery
            PID:3336
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17066377226914799794,4874649373646110258,262144 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
            4⤵
              PID:4992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,1404533473618892344,18050447353746505083,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
              4⤵
                PID:4924
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,14895474775267692551,2624924719601486569,2097152 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                4⤵
                  PID:1876
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,4336325591149981135,8532809398396324847,2097152 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                  4⤵
                    PID:4364
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17530838987006169661,3505298737539551460,2097152 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
                    4⤵
                      PID:844
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,10730195534462089500,10099095781798228878,2097152 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
                      4⤵
                        PID:2472
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4344,i,13979567670703742121,12380697552844240689,2097152 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
                        4⤵
                          PID:848
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4376,i,9697173228400487465,7634390504600483653,2097152 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
                          4⤵
                            PID:3724
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,8125816550765111028,12233775610446193458,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
                            4⤵
                              PID:4264
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6761052551276352547,5273044424810330016,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
                              4⤵
                                PID:2148
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7022976631673619326,14584912601132834024,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
                                4⤵
                                  PID:4020
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,16546596951753801635,16742886214999816015,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
                                  4⤵
                                    PID:3708
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11829019598001581767,1599989585130193239,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
                                    4⤵
                                      PID:4340
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11829019598001581767,1599989585130193239,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
                                      4⤵
                                        PID:3900
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,10761426747150764085,3594527233403855079,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3176
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                          cookie_exporter.exe --cookie-json=1144
                                          5⤵
                                            PID:3828
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,16216028255059359703,3211805551017292370,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
                                          4⤵
                                            PID:1876
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,17238360529163599496,15693359005187165599,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
                                            4⤵
                                              PID:5100
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,13243966490341817365,3062049656317294733,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                                              4⤵
                                                PID:428
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,528373498620184143,306465970500134269,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                                4⤵
                                                  PID:2704
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,8509377809303050659,9058318230273465037,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
                                                  4⤵
                                                    PID:3828
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,1661885597825353928,17243530096758177766,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
                                                    4⤵
                                                      PID:2864
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2747171967715767189,17412906192818821490,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
                                                      4⤵
                                                        PID:672
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,2729173024639502192,10344752319639092214,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
                                                        4⤵
                                                          PID:4968
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,14040326422333666710,17658635780485885143,524288 --field-trial-handle=2248,i,11538306140537177730,1687965463417512468,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
                                                          4⤵
                                                            PID:3424
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:5100
                                                      • C:\Windows\system32\sihost.exe
                                                        sihost.exe
                                                        1⤵
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5112
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe /LOADSAVEDWINDOWS
                                                          2⤵
                                                          • Boot or Logon Autostart Execution: Active Setup
                                                          • Enumerates connected drives
                                                          • Checks SCSI registry key(s)
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3328
                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                        1⤵
                                                        • Enumerates system info in registry
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3924
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3716

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 da6c5d254765c139d88192f3f87e3d379a910f8e52b353e7ac5ddf08b3a1c1e1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 aa958c3679134fea95454c067c8885c2aefce5d755e870c50283c19e74ba9ebf
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            BookmarkMergedSurfaceOrdering
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                            • Size 6B
                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 3KB
                                                            • SHA256 400f0d15fd41bbc508bf27f3847859d2f4f47211525e713ab6a6ab364dc38df4
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index~RFe58fe8f.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fe8f.TMP
                                                            • Size 3KB
                                                            • SHA256 a4daabe97722da3fb8afcc9b64d0f74e0ec0db4fb6f52db8ed446d649cff3d85
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            data_1
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                            • Size 264KB
                                                            • SHA256 ff9188e4d73b9a203580ff5fe32cb5bde4109dd750aa845d1443cf9b641fb842
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            SiteList-Enterprise.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                            • Size 2B
                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Edge Profile.ico
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                            • Size 70KB
                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                            • Size 111B
                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                            • Size 1KB
                                                            • SHA256 855b285069b13674cde5bbd09ce382983f752d8ba6c09374e095cf97e110a991
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 6121dc2efb5d11829f3a8577d90ff48a2d25b3ddda44db80decb8278b54b082e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 10KB
                                                            • SHA256 86239b274bb9f2e56fa2a6aeb3de9ed6183262af8e16ae77930ceb19fcb2bf03
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 12KB
                                                            • SHA256 c221bdbe5ea095a0e5ae934d34685797b198dddbc279485f602d5fe629557f83
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 ae6458c4bc61606f03f3866b537720492710b3b7e20410a9ce40e3e9508583d7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            sync_diagnostic.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                            • Size 4KB
                                                            • SHA256 1d16369d2c823de089338230c45930510645b2106eebfcce5363faed5b877543
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            df840b7b-13a1-4768-9f89-56c8ba7eb3da.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df840b7b-13a1-4768-9f89-56c8ba7eb3da.tmp
                                                            • Size 33KB
                                                            • SHA256 e0e26ce37cabfe22859beafde3f3ee624014318341f81f16d508365010881b9b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OperationConfig
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                            • Size 22KB
                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OperationConfig~RFe599958.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599958.TMP
                                                            • Size 3KB
                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 16KB
                                                            • SHA256 5b21d77c212abee073c220147156b0967a7804064bb121fdb012e8cfc33f5e2c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 20KB
                                                            • SHA256 d31edb92d366d460ea88b1c4b6c0d963baa8c42eff0216b73a9e7a2eba5b88a0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 30KB
                                                            • SHA256 7b35cfc0696c0a21e864d1519daa2390067d60b1f52518ea08a4841fdc9fd8f4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 8KB
                                                            • SHA256 8637c9496290e6fc6d16a00de6152cab9438277869c1ff0300bdb9875458f592
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 20KB
                                                            • SHA256 95cce255fde32588527726c20303fe5cfc9ff497ee72af9e527a798605ff5812
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 8KB
                                                            • SHA256 9e9ae52adc3152ec71733dea4d2e7463cf6808be3a3cf9b5ff5e75929ead194d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            1ca36b0a-f806-42bb-9d67-97da6683ba07.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1ca36b0a-f806-42bb-9d67-97da6683ba07.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            www.bing[2].xml
                                                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2KEI6GG0\www.bing[2].xml
                                                            • Size 14KB
                                                            • SHA256 6c754fe5d51bea7654146079235b9bf7e9dea29ae6b25920d72e5e5521e6cbd3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            489b0f6b-733b-48fc-a18c-25e5f738d667.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\489b0f6b-733b-48fc-a18c-25e5f738d667.tmp
                                                            • Size 1B
                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            a503984f-0adb-4286-87db-5d0f84bcde19.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\a503984f-0adb-4286-87db-5d0f84bcde19.tmp
                                                            • Size 10KB
                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cf72ddc1-f404-4355-9d6c-1fe7e2540a4b.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2676_1684705675\cf72ddc1-f404-4355-9d6c-1fe7e2540a4b.tmp
                                                            • Size 153KB
                                                            • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            content_new.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2676_2077680808\CRX_INSTALL\content_new.js
                                                            • Size 10KB
                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            memory/568-6-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-4-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-13-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-14-0x00007FFA0D6C0000-0x00007FFA0D8C9000-memory.dmp
                                                            Download

                                                            memory/568-11-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-10-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-7-0x00007FFA0D6C0000-0x00007FFA0D8C9000-memory.dmp
                                                            Download

                                                            memory/568-9-0x00007FFA0D6C0000-0x00007FFA0D8C9000-memory.dmp
                                                            Download

                                                            memory/568-8-0x00007FFA0D6C0000-0x00007FFA0D8C9000-memory.dmp
                                                            Download

                                                            memory/568-0-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-5-0x00007FFA0D6C0000-0x00007FFA0D8C9000-memory.dmp
                                                            Download

                                                            memory/568-12-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-2-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-3-0x00007FF9CD750000-0x00007FF9CD760000-memory.dmp
                                                            Download

                                                            memory/568-1-0x00007FFA0D764000-0x00007FFA0D765000-memory.dmp
                                                            Download

                                                            memory/3924-640-0x0000025C83630000-0x0000025C83730000-memory.dmp
                                                            Download

                                                            memory/3924-641-0x0000025C83630000-0x0000025C83730000-memory.dmp
                                                            Download

                                                            memory/3924-679-0x0000025C96800000-0x0000025C96820000-memory.dmp
                                                            Download

                                                            memory/3924-680-0x0000025C84F60000-0x0000025C84F80000-memory.dmp
                                                            Download

                                                            memory/3924-750-0x0000025C96930000-0x0000025C96A30000-memory.dmp
                                                            Download

                                                            memory/3924-777-0x0000025CA8AB0000-0x0000025CA8BB0000-memory.dmp
                                                            Download

                                                            memory/3924-628-0x0000025C837F0000-0x0000025C838F0000-memory.dmp
                                                            Download

                                                            memory/3924-854-0x0000025C81C00000-0x0000025C83605000-memory.dmp
                                                            Download