Overview

overview

10

Static

static

1

df90131c24...5N.exe

windows7-x64

8

df90131c24...5N.exe

windows10-2004-x64

10

Kmpehjenes.ps1

windows7-x64

3

Kmpehjenes.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    27s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 12:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Kmpehjenes.ps1

  • Size

    54KB

  • MD5

    43597781601bc20d50b9471e00d7dd55

  • SHA1

    e2f85d659088f7a8dbac0a01cb6b369ea081bb0b

  • SHA256

    4c010add8f075a98219cfdaea2b8b7cbd6a1d2f596045561916e2c1da7c67631

  • SHA512

    be044aaaa9f586318809942495b269ae8dbabd4aeaf4c2c5b70ed51787141bc8cd0ccf4a4fed2921ed3108e1e6edbfdc61b704252631aa2504926bbcd64361ee

  • SSDEEP

    1536:xheJwDvcGy850uvpiIxAM6itrfxgjmpbiCluD/f3LUQB4H2y:uJMkZapQMx7qmNioqX/SD

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Kmpehjenes.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4248
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4940
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:444
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1228
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3608
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1088
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1624
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4260
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4168
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1152
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4884
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3608
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3824
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:768
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:3516
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3816
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:440
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:768
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4336
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4988
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4792
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3940
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3988
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4420
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4448
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3784
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1500
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3952
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3624
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:968
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3884
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3900
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1280
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:752
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3784
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4972
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4180
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4028
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4156
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4512
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4116
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3956
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1484
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2932
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4260
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2728
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2352
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4272
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:5016
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4308
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2480
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4964
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:1280
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:1992
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:2040
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:1072
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:3516
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:4968
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:704
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3016
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3768
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:748
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3572
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:5056
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:1352
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:400
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:1040

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                ccffb61f97b12ae337fd5856148a0214

                                                                                                                SHA1

                                                                                                                c55c7dfe9db06d95b5728ef458da3914a3b7bce1

                                                                                                                SHA256

                                                                                                                e374beca91eae778404f0048aea29cab754e8928ea1f9b5846912912bf86a246

                                                                                                                SHA512

                                                                                                                77d6a41c97beee34796c1300938aecc403f2a069cf7f432d1ecf6991b150b0fe11189bcfa30cb61304f2ec17d0abee097ba97774a31fe1483b224a4bc9d3f652

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                Filesize

                                                                                                                412B

                                                                                                                MD5

                                                                                                                b6d7da8158764fd7ef5d26bacdb037e8

                                                                                                                SHA1

                                                                                                                b22300c81014a78da43cdb2700df46629a8cb0bd

                                                                                                                SHA256

                                                                                                                c5bb61c41a10aed11198567ec2d4f639db37346d418c445410c6e84211b3fb16

                                                                                                                SHA512

                                                                                                                65cab7827bba4134689c01cead1f02392f9f9eb7b32a6d0261f36e2f1319ac935639f7abbb163fa6a361e04716cbf3021a21ed89947416fc8d39045373febf1b

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                ae31bcc908bbb19cbbe72e1731729557

                                                                                                                SHA1

                                                                                                                0b97748ede0340ef6169b44573256fe7d402661a

                                                                                                                SHA256

                                                                                                                9fcf1844abba5d85fa0cd087f8b0052580cad5c6b03bfd362acf84d790797158

                                                                                                                SHA512

                                                                                                                b1a80bce40f4a75f6634f547193ba536dd5810bb6d76b7c6907e1496a2bfd7252c34a115e68a338e079bab5f8b700ca6056259bcff8363d31c71baafe80b9e44

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133751968827112818.txt
                                                                                                                Filesize

                                                                                                                75KB

                                                                                                                MD5

                                                                                                                7a488567a29bec024401a47e70a936cb

                                                                                                                SHA1

                                                                                                                d92f591dba9e78f9d4ad50628449c4074a0bd16a

                                                                                                                SHA256

                                                                                                                fa03c9c23c5f3f6338ecef5ee694857955f3b6d461380258a79dda9e3d13bd73

                                                                                                                SHA512

                                                                                                                7cdd2f73a76710c0b40b56c693819fbfcbd177e6d4177fe1979e57377d8affc86824126969ea0a228d0b9c629716b3da052c02b805ed3e59187043271c4247ea

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80GI1ZH7\microsoft.windows[1].xml
                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                742f1cda58883699ef753f83244412ce

                                                                                                                SHA1

                                                                                                                38531f396e1d9dc9ba6bba0604149c377605f57a

                                                                                                                SHA256

                                                                                                                5ef67927e9fdebb14515728d51548c52536519b35b5a52728ca1d660d957025f

                                                                                                                SHA512

                                                                                                                11acf77cd15052ae9cf554ab666f6c1e629e174fad16659738a11bee6a53b857f375fe99701e7c14c14286193864449f5b88a208ff34f4874e8351dff6a3a6f2

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tslzl1m4.q1w.ps1
                                                                                                                Filesize

                                                                                                                60B

                                                                                                                MD5

                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                SHA1

                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                SHA256

                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                SHA512

                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                Download Submit

                                                                                                              • memory/440-640-0x000001728EA00000-0x000001728EB00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/440-641-0x000001728EA00000-0x000001728EB00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/440-644-0x000001728F8E0000-0x000001728F900000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/440-653-0x000001728F8A0000-0x000001728F8C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/440-676-0x000001728FEC0000-0x000001728FEE0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/752-1382-0x0000000004470000-0x0000000004471000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/968-1092-0x0000024799F80000-0x0000024799FA0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/968-1088-0x0000024798E20000-0x0000024798F20000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/968-1105-0x0000024799F40000-0x0000024799F60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/968-1124-0x000002479A350000-0x000002479A370000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/968-1087-0x0000024798E20000-0x0000024798F20000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/1088-32-0x0000028411840000-0x0000028411940000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/1088-36-0x0000028412860000-0x0000028412880000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1088-59-0x0000028412C30000-0x0000028412C50000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1088-46-0x0000028412820000-0x0000028412840000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1152-340-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/1228-30-0x0000000004500000-0x0000000004501000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/1280-1240-0x000002790A300000-0x000002790A400000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/1280-1239-0x000002790A300000-0x000002790A400000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/1280-1245-0x000002790B460000-0x000002790B480000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1280-1254-0x000002790B420000-0x000002790B440000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1280-1276-0x000002790B830000-0x000002790B850000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1624-193-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2224-638-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3516-493-0x0000021C84500000-0x0000021C84600000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/3516-492-0x0000021C84500000-0x0000021C84600000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/3516-496-0x0000021C851E0000-0x0000021C85200000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3516-491-0x0000021C84500000-0x0000021C84600000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/3516-526-0x0000021C851A0000-0x0000021C851C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3516-527-0x0000021C858B0000-0x0000021C858D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3608-359-0x0000020B852A0000-0x0000020B852C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3608-372-0x0000020B858C0000-0x0000020B858E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3608-347-0x0000020B852E0000-0x0000020B85300000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3608-342-0x0000020B84500000-0x0000020B84600000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/3824-489-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3884-1237-0x0000000003330000-0x0000000003331000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3940-821-0x000002752BC00000-0x000002752BC20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3940-791-0x000002752B840000-0x000002752B860000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3940-803-0x000002752B800000-0x000002752B820000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3952-1085-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3988-933-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/4168-229-0x00000162ADA50000-0x00000162ADA70000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4168-201-0x00000162AD680000-0x00000162AD6A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4168-210-0x00000162AD640000-0x00000162AD660000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4168-195-0x00000162AC600000-0x00000162AC700000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/4248-13-0x000002E7F7130000-0x000002E7F715A000-memory.dmp

                                                                                                                Filesize

                                                                                                                168KB

                                                                                                                Download

                                                                                                              • memory/4248-16-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4248-1-0x000002E7F5DB0000-0x000002E7F5DD2000-memory.dmp

                                                                                                                Filesize

                                                                                                                136KB

                                                                                                                Download

                                                                                                              • memory/4248-11-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4248-12-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4248-21-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4248-20-0x00007FFF703D3000-0x00007FFF703D5000-memory.dmp

                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                Download

                                                                                                              • memory/4248-19-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4248-18-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4248-14-0x000002E7F7130000-0x000002E7F7154000-memory.dmp

                                                                                                                Filesize

                                                                                                                144KB

                                                                                                                Download

                                                                                                              • memory/4248-0-0x00007FFF703D3000-0x00007FFF703D5000-memory.dmp

                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                Download

                                                                                                              • memory/4248-15-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/4448-939-0x000002A7874F0000-0x000002A787510000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4448-934-0x000002A786700000-0x000002A786800000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/4448-971-0x000002A787AC0000-0x000002A787AE0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4448-948-0x000002A7874B0000-0x000002A7874D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4972-1384-0x0000025AF0700000-0x0000025AF0800000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/4972-1390-0x0000025AF1820000-0x0000025AF1840000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4988-784-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download