hxxps://archive[.]org/download/adobe-premiere-pro-2021-v-15[.]4[.]1[.]6-x-64-multilingual/Adobe%20Premiere%20Pro%202021%20v15[.]4[.]1[.]6%20%28x64%29%20Multilingual[.]zip

Analysis

user interaction
yes
max time kernel
117s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
24/07/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/download/adobe-premiere-pro-2021-v-15.4.1.6-x-64-multilingual/Adobe%20Premiere%20Pro%202021%20v15.4.1.6%20%28x64%29%20Multilingual.zip
Sample260724-qqwffseq7s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4200	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293733419959190"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B5A9340B-26AB-4AA3-9BD6-30586E3B0EE0}	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5704	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
5332	OpenWith.exe
5332	OpenWith.exe
5332	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe
5704	OpenWith.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4512	4392	msedge.exe	86
PID 4392 wrote to memory of 4200	4392	msedge.exe	87
PID 4392 wrote to memory of 2044	4392	msedge.exe	88
PID 4392 wrote to memory of 2044	4392	msedge.exe	88
PID 4392 wrote to memory of 2044	4392	msedge.exe	88
PID 4392 wrote to memory of 4924	4392	msedge.exe	89
PID 4392 wrote to memory of 4924	4392	msedge.exe	89
PID 4392 wrote to memory of 3528	4392	msedge.exe	91
PID 4392 wrote to memory of 3528	4392	msedge.exe	91
PID 4392 wrote to memory of 3528	4392	msedge.exe	91
PID 4392 wrote to memory of 1620	4392	msedge.exe	92
PID 4392 wrote to memory of 1620	4392	msedge.exe	92
PID 4392 wrote to memory of 1620	4392	msedge.exe	92
PID 4392 wrote to memory of 3292	4392	msedge.exe	95
PID 4392 wrote to memory of 3292	4392	msedge.exe	95
PID 4392 wrote to memory of 5616	4392	msedge.exe	96
PID 4392 wrote to memory of 5616	4392	msedge.exe	96
PID 4392 wrote to memory of 2928	4392	msedge.exe	97
PID 4392 wrote to memory of 5644	4392	msedge.exe	98
PID 4392 wrote to memory of 2928	4392	msedge.exe	97
PID 4392 wrote to memory of 5644	4392	msedge.exe	98
PID 4392 wrote to memory of 5644	4392	msedge.exe	98
PID 4392 wrote to memory of 3928	4392	msedge.exe	100
PID 4392 wrote to memory of 3168	4392	msedge.exe	108
PID 4392 wrote to memory of 3168	4392	msedge.exe	108
PID 4392 wrote to memory of 3168	4392	msedge.exe	108
PID 4392 wrote to memory of 5952	4392	msedge.exe	117
PID 4392 wrote to memory of 3044	4392	msedge.exe	118
PID 4392 wrote to memory of 4104	4392	msedge.exe	119
PID 4392 wrote to memory of 1424	4392	msedge.exe	121
PID 4392 wrote to memory of 1424	4392	msedge.exe	121
PID 4392 wrote to memory of 1424	4392	msedge.exe	121
PID 4392 wrote to memory of 1640	4392	msedge.exe	122
PID 4392 wrote to memory of 4296	4392	msedge.exe	124
PID 4392 wrote to memory of 4296	4392	msedge.exe	124
PID 4392 wrote to memory of 5540	4392	msedge.exe	125
PID 4392 wrote to memory of 5540	4392	msedge.exe	125
PID 4392 wrote to memory of 5540	4392	msedge.exe	125
PID 4392 wrote to memory of 5696	4392	msedge.exe	126
PID 4392 wrote to memory of 396	4392	msedge.exe	127
PID 4392 wrote to memory of 396	4392	msedge.exe	127
PID 4392 wrote to memory of 396	4392	msedge.exe	127
PID 5704 wrote to memory of 2124	5704	OpenWith.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/download/adobe-premiere-pro-2021-v-15.4.1.6-x-64-multilingual/Adobe%20Premiere%20Pro%202021%20v15.4.1.6%20%28x64%29%20Multilingual.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ff9b966c188,0x7ff9b966c194,0x7ff9b966c1a0
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,7037934165178978230,12511261469122749671,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2275257602884254357,3836361017724847312,262144 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,13340884291906623168,4328000111853478153,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2507090522929973432,9107567348862547399,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,770321938993309794,2555937765026636501,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16592051164111812618,480065022394290439,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,7170130525123873529,1332455894765129547,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=de --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,3780083125556315210,5149318208908224507,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5512,i,7681155664408780207,3069537473484115972,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,13826107237260067150,11946722997793015175,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,13826107237260067150,11946722997793015175,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3664,i,10077677243376644120,6400024895041872089,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,10635609914372246972,6526204745884563807,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,961077269568397669,13952511442281548404,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,6587598071235242420,16082692104705886502,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5756,i,12433464503459113640,14453069501375020756,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,10626540362032432019,5929432488974081261,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,4875058640686145444,3293944063932528577,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6392,i,11242273805624796713,219147606069314040,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14359624399382976088,13388800190603019670,524288 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4024,i,16487703924729062366,4276199702394119882,2097152 --field-trial-handle=2376,i,8852151678241119956,13425946787206345188,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\adobe-premiere-pro-2021-v-15.4.1.6-x-64-multilingual_meta.sqlite
  2⤵
  PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f89d096d4931f102ed0d846cf7c00628e918bf6ece6e67672df102a3827d7001
MD5 df26a001d19a02865f3796364cdc5da9
SHA1 eaa88c3939bdb0b5f62c93b1a8a962eb7578ec6e
SHA512 e881032fa0b755ffaa5bfe96f40ab025af45de1280276abb3fc0c11281f633356a804feb4a4869cda2d7d425bdd5f22b67272724472a7610f8665ca0dfad767b
TLSH
T1D5D012B62A4A7110F2694A31B456CB00776D15A12852A705E22D944CA9A90B562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fc9d363dcce6d5c94c87b7362a8b60fc36233f921336555d02890fdc0bad0bd4
MD5 fc6718213be282a858ea99b9a8cbf611
SHA1 7456c0c7a00e802227f264bcb8ee6482d244c1e1
SHA512 69ddb86f7b8004e71a4bd2958beb805c935acf34a1bc6cfd536580a66452ed7f7b06354a79d11b4c105da61b0124c731462cedfa35add23150a8eb58455b5a04
TLSH
T114E02BAACC21ED2708FD0B19B0499B46E70013173741494F7B3C920D8FB462A46C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 33KB
SHA256 52ea762e70415cc4f1825bcfbbaa9693368856d77f41166f273e345ecb226bab
MD5 573d9ce5ff304ae8e5d7712248751fc3
SHA1 bf55fb1ce8e48fe7e81d58cad73a392486177c56
SHA512 bb84c5ffcff44de8796c564e4150cf5317c757b0880e95216f399d9b4851b99f1bc652868a537d05c24a2a62a85e418f6907a291c97fb17fc4ab81054e88a6db
SSDEEP 768:0XDhbOJa3vwxujpXndCVb/zZQz16b27GYm0D:Whbq4mikdNc1+Ym0D
TLSH
T1A5E2E1676D08CC94DC99854EB6E634734940D3F9DF7C83C0A422C57EBE6AA80869B7C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 db36b76665089114e89738ff69b14ede7e6c85fc2a4f69f278885543fa8c947c
MD5 727ee40ba3cd2150a640375e58067dfc
SHA1 b878c050fe00d49243c756aa7bf7d430732658b0
SHA512 eda88cd0438bcda45d037cd740157698cbc10720cbe5da72eee1697b6f777fcb3f2e0f70bfafde0b0899daaeb0fffe7b33db9430587da64d03438bbc7123aa16
TLSH
T186815F8E0A1115B1E7904AB1D2E21D7135B18AAB34F39FCDC156E6B4FF1D363C20B954
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598e2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598e2d.TMP
Size 3KB
SHA256 aa605e05ac020c880c5f0e25f69d8e21d17c0ea5a9dd07db634f99ddd22e2a62
MD5 0dae97c52303b3362f9b81fb5b454020
SHA1 7cd3fb39e19cb5a85da0039d40a228f94dbf2e20
SHA512 b14d30c8eb05b810ecb855f717dad6ca6482a5e4023f04a335fbe88f97b321dfc7b5d111ddbdf06d1008e74ab23b666e154487169aa58d913fd1bdd70d162b6d
TLSH
T114714D8E0A1154B0D7904AB1D2E21E7138B18AAB34F39FCDD142E7B4FE1D763C51BA54
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ba5d115ffc4192014e1c563ea36c684749a04030658490a5691496b20c3d5fd
MD5 c4e891042f559bc72e43ce68b2c8454a
SHA1 0e1c79b44a383aa7e58fbb565d1a67a33c4ef753
SHA512 d4660cee1ceec8c0e41ad6f6a3238e6c99fa0e5a62c3a335ca34cc1884211ad805443b723c3da7feeff5b5817b915e60b725d90b07f947105220ee77b06506d9
TLSH
T16641B0F757B4856EDB1195F0EA09AF2F8E1C0521472C7CB985E0AE1793E38B1E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eb200b9e9a87059754542a949a0e85d65e58aebb7739190fa106f047affe2d67
MD5 ee366534fde8586a6f46935af053f31e
SHA1 c38f3f1bb37872407abd8de1005b39393e412ef8
SHA512 8c5bca7fb0a34400fc1e4d6d40b8014427ce98b780f4417f815e3f51a2a2d241213439571c9a97e7ea3642b1bb7c89304e11f35c9d1fa9e21f67a896056c7464
TLSH
T17931D1F383E8856ECA1095F0BA18BE2FDE1D0510432C3D9AC5E4AF1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b654264070c58c318ff7c4fb09f0b335bb7d2d458e87a3d653a01f3f33eaf55d
MD5 88e799041d0d78ef0a85159b332bca19
SHA1 ab07f04ea5c9e0fc76d870a7c0fb4259cc4d8b65
SHA512 58a8e4bea96640b77016f77e5d3cd317514099b1f722b316ef3286757f95a89807c0c667eb56f27460226bc6d10d22f2de66024c171c7991d416beba433de9eb
TLSH
T1CC31D1F383E8856ECA1095F0B618BE2FDE1D0510432C3D9AC5E4AF1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6a743a7437ec50e5053a62c5a02cba70ef2a3c727d507eac6b8cbd5e2bf53b9e
MD5 2137cfcc198019bb6490d0912ef7b237
SHA1 7847171d7183b3187a9b75b46d204dcd6fcf2d66
SHA512 980e5df203d2fcd40fd97746252e590982b605f94146f43bef5ad999e304c46a56cff471be04d1e22d2a8a8f88b6ae949430289aa42eca360e1dc7243cf55eac
SSDEEP 192:sxZGRc7yijNKOMl8M9B/fBsscb7aZdwzodpLHW6+WNGYv0uWihDIgjFJ:sxZGaK1B/fBsscb7azzLHbGEBjv
TLSH
T1DC62E9166A24997B9CDBD219F645BF53D6F80573A2905E48A9FCCB0C04E76EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 487a5402e5c138d4b7c6aa38fab178062ab28a998d8bda9630032d0c207492d2
MD5 29369e390a2d5339525e6edf302f9fce
SHA1 a80d8723c9ef0c3bc98a8d0a2c278ca4921538e0
SHA512 a945896d18cee94d05ae02f9e955f82e0eba3e5191609dcbc14bdf551ff3b8f8dac6b26b3ae3b55c0f0f25f354649eba936361b6f10582301d7a7e131fdb8874
SSDEEP 192:sxZGRc7yijNKOMl8M9B/fBs8bTZdWzodpPCHW6+WNapV/YvjWihDIg5CFJ:sxZGai1B/fBs8bTzt6Hb6/qBIv
TLSH
T1E062E9066A249D7B9CDBD219F545BF53D6F80473E2905E48AAFC8A0C04E77ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 9ac19ab3af393500c03752bcc9a4ac9541dd098c9d2b53fb378c5cf3f96d91a4
MD5 9587395da3a6e496dbda9e7be7e163cc
SHA1 5569c65022ab9384c2788503445abcdfae2ab7a9
SHA512 86a7e16d1ea041bb60ff052f9733cc948de910565fc3098134314098d341b293e1256d0ad171be6f4c3fcff535a73872d55697ce1b0d567f7eb7062a64ffaa97
SSDEEP 192:05ppxnY753RNBvRJJdt7pCuDw0uAg/U1wMC4LO9meNMgSHgjA6z0wqAsf0dw4Sen:0LppY93PBZJPtNx5gdTrP
TLSH
T1D6C27606703A0602397E3958B39696364F4235A33458E4BF7FB814A25F6BE225CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9716a98ef32f3935d4062595f4046f9986e7581a6d56e8aa82b12f2d0b1f0e23
MD5 faa89ca9c96410757cbb7b3b6ce1d0ad
SHA1 65a9a2645dbb47f96fbb7336b89aa1a38f73f8e1
SHA512 93f14ce0469bed999c4356a6b9d15d57a5b41ba8370afddf265b28dbb498c7f80f8e1a82d8344f6a10ed19cc8eec2fa9c964097812e87b2678a252ab4d0889dc
SSDEEP 768:BKF2Cz4wgVkEz+e+wUjGj9tKmctmfQ3B6:9Cziki9tVXQ3k
TLSH
T18EF2E6F698D78977E8AE4787A73E2D029AFCC153B5885984B7D81D0DCC860BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6846807ee457063c562cadc6ce33d1808d613e38149bbc3614dae90f1382cb82
MD5 3f141e026c300d92926545f1d5db8ef4
SHA1 7e230bd978b5e56edcc6839d1d0773c7e1d68f89
SHA512 b34a15309eabf7edfbcf80d6dfd4def9342061d0e716696028de2f0ecbe11dfeb385ef9e9ebebc265ece56163f7000e56acfd5b0bd7134ee69ddc35661f5f0e5
SSDEEP 384:nB/iFiZcIJrsNW8TUNTUlI4iQckCrJ2z+e+iN6pvBftGjUs7tJklmctmfQ3ucV5M:BKFQdfwgRk9z+e+wUjGj9tKmctmfQ3B6
TLSH
T145F2D6F698D78977E8AE4B87677E2D029AFCC153B5885984B7D81D0DCC860BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 454cb5cc767d1d5aa9797b76561103975fd5c1ba4867cdcfa7175248273294e4
MD5 8e21849a2da46c17a4dfa3bc289426d9
SHA1 edd92a6d8cde2932b89b7ebf0a420162672946a3
SHA512 8b929bba6308d153db8d56475068a94dc69a631a9a6a7058a000cfdc1f9e19b3fc0ecf3704237fc22a64cacba4893139fbae24f4b9405aeab1fedab7d1bfb42f
SSDEEP 384:np6jiFiZcIlsNW8TUNTUlI4iQckCrNE6pvBftGjUs7tJklmptmfQ3ucV5wty/7It:p6OFQlfwgRkLUjGj9tKmptmfQ3B6
TLSH
T118D24A36E854CAABFCE64B85B74A3A079EF44163CACC9AD4D6D95E1D009B0DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ae55247fc6a068cb6702a0021af69b13f11559c7847f9ad84a55ffbab7560b4d
MD5 e362dc8ade725f35122373929c86dc42
SHA1 5dcf796d227695993d1a818b0f9a42e7d5f1a468
SHA512 846e3c66aa740152aa779b1e0c3ad920da612bdc0c58300b32294f4cbaa527af73f75c0138daa3fa9bb4acf9f005efb960e72e081a01eb6fddbedd411df426dd
SSDEEP 384:nBjiFiZcIlsNW8TUNTUlI4iQckCrNE6pvBftGjUs7tJklmptmfQ3ucV5wty/7IgQ:BOFQlfwgRkLUjGj9tKmptmfQ3B6
TLSH
T1F9D24A36EC54CAABFCE64B85B74A3A079EF44163CACC9AD4D6D95E1D009B0DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aec32a1d550e29d987ae26594f0b3f65d31eb26f3cbcbadbfcf9f9b98314da24
MD5 f38a0fa248191ea15edc895414c8f778
SHA1 9373938583dc70c1e21d6053d7fae0ec5bd5ab85
SHA512 229eccc4c130626e280b5115b5b353d9e70e79a0d705db1c11a7c1e341a296e029b7fa093abe26661c0775d6d98df279893e64209c0043f84a390cc17491820b
SSDEEP 768:BKFHCz4wgVkBz+e+wUjGj9tKmJtmfQ3B6:uCziXi9tVGQ3k
TLSH
T1A2F2E6F698D78977E8AE4787A77E2D029AFCC153B5885984B7D81D0DCC860BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 166344d43ab8f60a085adde8814c25a53aedc39bc1a39a2837036d1bde9ee5bd
MD5 09b49d4d4a2c24d18396bbeb9dba6bfa
SHA1 c37d89b67af079b0959e1d02b2be3c7303af1a0a
SHA512 c474e1dcf4450399438b7ac3fff3c4fdad5ab8ee25a5dbe48a8d6a9c0b9a9ba1f46951a1f7a28fa43f595bbadc6810b156d7a3b0f716266b1bbba0485452e4c3
SSDEEP 384:np6jiF9CcmyWCD3sNW8TUNTUlI46QckCriE6pvBftGjUs7tJklmptmfQ3ucV5wtL:p6OFccpD3fwgpkWUjGj9tKmptmfQ3o
TLSH
T12FD24B36EC58DAA7EDE74B85B75E39039EE04163CAC89AD4DAD91E0C00DB1DD030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a3a50e8393379c94e0bd981f533bb8cdb2db0e48efcad4f7ff431a06a4964ee7
MD5 1896d6343cf0db538e69318b71aff0dd
SHA1 60474247de06ed9415a3b1721ddd9bc7a08c02ac
SHA512 5482cedd32c41db349bd5a81da7a329fa2fc752ea66914a6ab84ec3bd0330b7dd97e39e518bece8bd1a2e048a8f08bf5c21b8f2325fcd53ca14b549798d08b13
SSDEEP 384:npeiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lBKpvBftGjUs7tJ/BpEe4KV8p0PLKtN:p1Fccps3LwgbkUvkjGj9tpQI8p0PLa
TLSH
T1D2B25B36EC58CAB7EDE74F99A74E3A07DEE0116786D89DE4DAD81D0C009319D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3ed57a895f6289125793f5b2b09fab69502b27ba4799b979ea9599b5693824ff
MD5 599f425ab36f8aad2e32e165ab7be36c
SHA1 5146f0bb6fdbb8225013bc2b55d58388b9a13cb4
SHA512 ad78dfb7edddf85442c559e6db80e1b8244879e2b310b04fb3602c791e8d7223bbf7d815ed38866e45c6c34950224dcd6f582a63b594115dda9a11270d1309d1
SSDEEP 768:pEFccps3vwgbkU81jGj9tKm3tmfI8p0PLa:is3Zoi9tV0I8p0PLa
TLSH
T183C24B36E858CAABFCE64B99A64E3907DEE04167C6CC9EE4DADC5D0C00D71DD430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d6e94f558136fe4562f5bf52912821bd1af73a74a1eeb56c652e1e89b3bc7a12
MD5 3d8d19e257791d9905758a9cf03818bc
SHA1 4d39c24feff93736ef98170a37c9b0272f1d7184
SHA512 e84668651dcca8ad4edc40784aca921d3615c580f5120290a53f594445d7e55c202e123eb385f846e679ddddf9d7ddf1129fa04a59af8aab87c895aa1419aea6
TLSH
T1A0E00205E3010457C519033014C71F907FB1D4100393031F4734017C6D323143D59680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dcbb223d3ab9de074618a67751776c0ab1c14e22704e988fbda0903da67d82d5
MD5 fbb45e3442e4c8bcfad30bf00ad21aaf
SHA1 1f5aaaf53229fa8c8ed1618232064477b49cc8d3
SHA512 63feba79d83e2ca3dba1e29798485c46561b08c36652d08e27a03d05254215c366b77f50ce714b8510bdcc55c7e2db9f084d90dd8f749bad335df14bab367bac
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe595143.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595143.TMP
Size 392B
SHA256 143bc7c5b832095bedef69d70da8b01040fa6517ba57436086a08501df89caa8
MD5 326eec3b017e3f8208a90217abee3f7a
SHA1 a53bdb5dbbb25aeabbe2ffb2535dd3ae2d11cfad
SHA512 40f14cb47a48322bd0e4b0146a41b388849beaa8745f6e767ed6a86c55788696539d0a63e66f89ca851c2fb87d151a78201e9391a29d7e36d01eb5ccbfc8702f
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9228844f3ee79528d79c799b8379b2b2048a5b0b8e9f05d27a7aeede7b33125d
MD5 d74df3f4366f1aa90b98ca0f86cfde6e
SHA1 ed20d90c88831f15074d3ffc6b7de34251f4ea4b
SHA512 340eac28b5f866005cdebbb532eaf3d8f8462337635312c44729e61e5f513390844d7ed78e3d8ebff8129ed1c5dd2aa63da45944b749baa826442e81602fa510
TLSH
T1FE41275CBAE91148B3B36E5A9BF6686E487F7D772F0BD49D10110E4E4A22B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

adobe-premiere-pro-2021-v-15.4.1.6-x-64-multilingual_meta.sqlite

Path C:\Users\Admin\Downloads\adobe-premiere-pro-2021-v-15.4.1.6-x-64-multilingual_meta.sqlite
Size 20KB
SHA256 529d02a0dea79509aeafef3a32b08f840fad7134b787b918259b74063dc8ba48
MD5 e90340662405f5aac4b06220cf33ff30
SHA1 97f627e6d2b1fcb85486f6b006a067f75e0dbe3c
SHA512 83353f87e56561856faa261bcf859ad655a7f0124f8e42488f5108aed755334465b93c5d0a52cf6cf521630b1c81efe1f25f12a04cb43f87c8c3b494bca451e1
SSDEEP 48:T9lUAvJ4ewYLnumvCO1SZKeRpo7QQxwM/S2vN8q:vfB4HYzumb1apoxwW1p
TLSH
T18892A92DAA00A419D69295BBE8D1334CC0285267DF76F4E0F5FC01000FE785B62EE787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3928-205-0x0000011C4E0F0000-0x0000011C4F0F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads