Overview

overview

10

Static

static

7

SecurityHe...ay.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    286s
  • max time network
    390s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2024, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecurityHealthSystray.exe

  • Size

    1.5MB

  • MD5

    b0b618706bd5dc3ee0c7ea5df4141994

  • SHA1

    5c2fd255b837ec3e9e31f26906fc84c4f7915efd

  • SHA256

    d120c80694d06777d054968a966a04f6d83ac40cd45da47945bd118d00bcdf93

  • SHA512

    5d539c7df1c16b190822e0eedf8df217508d8c282011fd9b33673e067c5f122ce929f55942be8d24fd6cb32c2897963687fb44544e5e493fcbb9542380058a10

  • SSDEEP

    12288:10VtAsf/qHLHH70mLicSl6/xtdd7jJ04GrbhXC2ip7sf5PVle8isq:cfkZXbb+rbVC207suP

Score
10/10
credential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
    "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "SecurityHealthSystray.exe" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "SecurityHealthSystray.exe" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2176
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4004
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\Documents\xdwdCitrix Receiver.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\Documents\xdwdCitrix Receiver.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2640
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "SecurityHealthSystray.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "SecurityHealthSystray.exe"
        3⤵
          PID:2492
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:384
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "SecurityHealthSystray" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\system32\schtasks.exe
          schtASks /deLeTe /F /Tn "SecurityHealthSystray"
          3⤵
            PID:1028
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "SecurityHealthSystray" & exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4340
          • C:\Windows\system32\schtasks.exe
            schtASks /deLeTe /F /Tn "SecurityHealthSystray"
            3⤵
              PID:2672
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp366E.tmp.bat""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2292
            • C:\Windows\system32\timeout.exe
              timeout 5
              3⤵
              • Delays execution with timeout.exe
              PID:2020
            • C:\Windows\explorer.exe
              explorer.exe
              3⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5000
            • C:\Windows\system32\taskkill.exe
              taskkill /im xdwdMicrosoft Excel Host.exe /f
              3⤵
              • Kills process with taskkill
              PID:1572
            • C:\Windows\system32\timeout.exe
              timeout 3
              3⤵
              • Delays execution with timeout.exe
              PID:4668
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:216
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2208
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5024
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3248
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1756
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:1356
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4056
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1544
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:5092
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4376
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:2104
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3804
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3064
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:4760
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:1624
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4712
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:2856
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4288
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2416
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:3900
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3684
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:532
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:516
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4540
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3080
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:5020
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3968
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1872
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2728
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3224
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4360
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:5116
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1892
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2532
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4900
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4292
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:5100
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3520
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4468
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:2484
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4980
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3836
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2548
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:380
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2076
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2680
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4136
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:1168
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:5032
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:380
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:448
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2796
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:2740
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:2684
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4816
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3864
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:5100
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1136
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4304
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:5116
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3912
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4036
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4140
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1988
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4668
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:1940
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4244
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3540
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:868
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1340
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4112
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3496
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4572
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:2880
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2196
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3444
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:2892
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:2244
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:3924
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:4156
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:4436
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4728
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:3612
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:2148
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:4904
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:1624
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:1272
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4312
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:1412
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:4384

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                    Reconnaissance

                                                                                                                                    Resource Development

                                                                                                                                    Initial Access

                                                                                                                                    Execution

                                                                                                                                    Scheduled Task/Job

                                                                                                                                    1
                                                                                                                                    T1053

                                                                                                                                    Scheduled Task

                                                                                                                                    1
                                                                                                                                    T1053.005

                                                                                                                                    Persistence

                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                    2
                                                                                                                                    T1547

                                                                                                                                    Active Setup

                                                                                                                                    1
                                                                                                                                    T1547.014

                                                                                                                                    Winlogon Helper DLL

                                                                                                                                    1
                                                                                                                                    T1547.004

                                                                                                                                    Event Triggered Execution

                                                                                                                                    1
                                                                                                                                    T1546

                                                                                                                                    AppInit DLLs

                                                                                                                                    1
                                                                                                                                    T1546.010

                                                                                                                                    Scheduled Task/Job

                                                                                                                                    1
                                                                                                                                    T1053

                                                                                                                                    Scheduled Task

                                                                                                                                    1
                                                                                                                                    T1053.005

                                                                                                                                    Privilege Escalation

                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                    2
                                                                                                                                    T1547

                                                                                                                                    Active Setup

                                                                                                                                    1
                                                                                                                                    T1547.014

                                                                                                                                    Winlogon Helper DLL

                                                                                                                                    1
                                                                                                                                    T1547.004

                                                                                                                                    Event Triggered Execution

                                                                                                                                    1
                                                                                                                                    T1546

                                                                                                                                    AppInit DLLs

                                                                                                                                    1
                                                                                                                                    T1546.010

                                                                                                                                    Scheduled Task/Job

                                                                                                                                    1
                                                                                                                                    T1053

                                                                                                                                    Scheduled Task

                                                                                                                                    1
                                                                                                                                    T1053.005

                                                                                                                                    Defense Evasion

                                                                                                                                    Modify Registry

                                                                                                                                    3
                                                                                                                                    T1112

                                                                                                                                    Credential Access

                                                                                                                                    Credentials from Password Stores

                                                                                                                                    2
                                                                                                                                    T1555

                                                                                                                                    Credentials from Web Browsers

                                                                                                                                    1
                                                                                                                                    T1555.003

                                                                                                                                    Windows Credential Manager

                                                                                                                                    1
                                                                                                                                    T1555.004

                                                                                                                                    Unsecured Credentials

                                                                                                                                    1
                                                                                                                                    T1552

                                                                                                                                    Credentials In Files

                                                                                                                                    1
                                                                                                                                    T1552.001

                                                                                                                                    Discovery

                                                                                                                                    Browser Information Discovery

                                                                                                                                    1
                                                                                                                                    T1217

                                                                                                                                    Peripheral Device Discovery

                                                                                                                                    2
                                                                                                                                    T1120

                                                                                                                                    Query Registry

                                                                                                                                    4
                                                                                                                                    T1012

                                                                                                                                    System Information Discovery

                                                                                                                                    4
                                                                                                                                    T1082

                                                                                                                                    Lateral Movement

                                                                                                                                    Collection

                                                                                                                                    Data from Local System

                                                                                                                                    1
                                                                                                                                    T1005

                                                                                                                                    Command and Control

                                                                                                                                    Exfiltration

                                                                                                                                    Impact

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                      Filesize

                                                                                                                                      471B

                                                                                                                                      MD5

                                                                                                                                      731923ffb5923b45e180327093aaaae0

                                                                                                                                      SHA1

                                                                                                                                      4dd712c46221c2861c6b65a6d2013dd3136e0aa0

                                                                                                                                      SHA256

                                                                                                                                      ea388e679c400ae4a209d8f2c07aa35abca71900d64a0b63380613340c919314

                                                                                                                                      SHA512

                                                                                                                                      925483b7f52950c63303b4b65bca42c1d3885066f5af7cd318aa1b71ba42afb9d6e7bc21876a7e5b254a4f569b58116f510919aa291aae2936ad5ca38d805df6

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                      Filesize

                                                                                                                                      412B

                                                                                                                                      MD5

                                                                                                                                      4321e1196e619efc36708656829b726b

                                                                                                                                      SHA1

                                                                                                                                      dea5e47b5790aa25953ce4ba8ec3a5a24bb9d87b

                                                                                                                                      SHA256

                                                                                                                                      7ed7bd8d907b93674090834d676686414ee36c81a25fa0aeb276ac865746c375

                                                                                                                                      SHA512

                                                                                                                                      2e84809cdcac4c2f927dbc13bc6e2a13eb98a02f2750593e92987d651ac66f6a442130373e880e8addfd44e5b17d29ae4545e23cece174bc668ef03cf789b6e8

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      2e4d3dc3d64894a3bc15c1d70407a3db

                                                                                                                                      SHA1

                                                                                                                                      0cc04c276db0842381401a1d7b57880fc57b27aa

                                                                                                                                      SHA256

                                                                                                                                      f0b66f4b4f1d737f1be3fec1fa678e917b4e91a2179368ea2c88456bce86a7d3

                                                                                                                                      SHA512

                                                                                                                                      e8c839dcfe66c44af61f72726dcf2dd98704dc0319e587d1fb1ca01b8d92bf6cb2981391768876af4c0dd3c2e7a040050c80093f08ae5a8363ee78fb85e46c2b

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                                                      Filesize

                                                                                                                                      36KB

                                                                                                                                      MD5

                                                                                                                                      0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                      SHA1

                                                                                                                                      92495421ad887f27f53784c470884802797025ad

                                                                                                                                      SHA256

                                                                                                                                      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                      SHA512

                                                                                                                                      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FKEP33TV\microsoft.windows[1].xml
                                                                                                                                      Filesize

                                                                                                                                      96B

                                                                                                                                      MD5

                                                                                                                                      dcfd0f22889d8b3a982fbe019d01d543

                                                                                                                                      SHA1

                                                                                                                                      fe866022f3fdf8fba4d3bd366ff0e2683fe58e59

                                                                                                                                      SHA256

                                                                                                                                      2337927b5b24c83c8ab37dfc0fe7ddcd832ffb16d0cee5d50344478218893f5b

                                                                                                                                      SHA512

                                                                                                                                      11b59e18705c1d95508e298938525f931c12c9010cdc03fad15f5585bc503713670d93739668d886ed9446d528c3dc7ac8cbc8e52198eb85ea6557821a124cc8

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp366E.tmp.bat
                                                                                                                                      Filesize

                                                                                                                                      240B

                                                                                                                                      MD5

                                                                                                                                      4701fe92c221217f9c69f20c56d0753f

                                                                                                                                      SHA1

                                                                                                                                      bb8b597372b4a4d8e24194f346d4619d174426a8

                                                                                                                                      SHA256

                                                                                                                                      5d8f4a72d7e6d0d460c39d42a95e1ecf8d41c7c5486634e1d408403c111001ba

                                                                                                                                      SHA512

                                                                                                                                      b2ecc14812284553cfb470c565290329fccf996a304f25d50beb0b06114e3b44e9c34ac353cd0eab9cc508958edff41f9b90ec220af8946d09260ba1e24d4553

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Windows\xdwd.dll
                                                                                                                                      Filesize

                                                                                                                                      136KB

                                                                                                                                      MD5

                                                                                                                                      16e5a492c9c6ae34c59683be9c51fa31

                                                                                                                                      SHA1

                                                                                                                                      97031b41f5c56f371c28ae0d62a2df7d585adaba

                                                                                                                                      SHA256

                                                                                                                                      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                                                                                                                                      SHA512

                                                                                                                                      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                                                                                                                                      Download Submit

                                                                                                                                    • memory/516-2934-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/532-2821-0x0000017BB16A0000-0x0000017BB16C0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/532-2790-0x0000017BB10C0000-0x0000017BB10E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/532-2800-0x0000017BB1080000-0x0000017BB10A0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/532-2786-0x0000017BB0160000-0x0000017BB0260000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-773-0x0000000001810000-0x000000000182E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      120KB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-20-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-2054-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-772-0x00000000017E0000-0x00000000017EC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      48KB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-771-0x000000001D650000-0x000000001D6C6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      472KB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-138-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-0-0x00007FFE304F3000-0x00007FFE304F5000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-107-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-4-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-21-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-3-0x00007FFE304F3000-0x00007FFE304F5000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-2-0x00007FFE304F0000-0x00007FFE30FB1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                      Download

                                                                                                                                    • memory/1048-1-0x0000000000E00000-0x0000000000F80000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.5MB

                                                                                                                                      Download

                                                                                                                                    • memory/1356-2210-0x0000000004040000-0x0000000004041000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1544-2218-0x000001FA1F8B0000-0x000001FA1F8D0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1544-2227-0x000001FA1F870000-0x000001FA1F890000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1544-2239-0x000001FA1FE80000-0x000001FA1FEA0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1544-2214-0x000001FA1E950000-0x000001FA1EA50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1756-2084-0x0000019A61CB0000-0x0000019A61CD0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1756-2098-0x0000019A620C0000-0x0000019A620E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1756-2069-0x0000019A61CF0000-0x0000019A61D10000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1872-3110-0x0000024A8C570000-0x0000024A8C590000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1872-3081-0x0000024A8B040000-0x0000024A8B140000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1872-3086-0x0000024A8C1A0000-0x0000024A8C1C0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1872-3098-0x0000024A8C160000-0x0000024A8C180000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2104-2350-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2416-2636-0x00000193F5E00000-0x00000193F5F00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/2416-2637-0x00000193F5E00000-0x00000193F5F00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/2416-2673-0x00000193F72F0000-0x00000193F7310000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2416-2641-0x00000193F6F20000-0x00000193F6F40000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2416-2653-0x00000193F6BE0000-0x00000193F6C00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2532-3379-0x0000020233C40000-0x0000020233C60000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2532-3392-0x0000020233C00000-0x0000020233C20000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2532-3403-0x0000020234010000-0x0000020234030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/2728-3228-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2856-2634-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/3064-2360-0x0000027C6C4D0000-0x0000027C6C4F0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3064-2372-0x0000027C6CAE0000-0x0000027C6CB00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3064-2357-0x0000027C6C510000-0x0000027C6C530000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3064-2352-0x0000027C6B600000-0x0000027C6B700000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3080-2965-0x000001C122740000-0x000001C122760000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3080-2937-0x000001B920020000-0x000001B920120000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3080-2953-0x000001C122330000-0x000001C122350000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3080-2941-0x000001C122370000-0x000001C122390000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3080-2936-0x000001B920020000-0x000001B920120000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3900-2782-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4360-3252-0x0000018EBBFA0000-0x0000018EBBFC0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4360-3234-0x0000018EBBBD0000-0x0000018EBBBF0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4360-3242-0x0000018EBBB90000-0x0000018EBBBB0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4360-3229-0x0000018EBA900000-0x0000018EBAA00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/4712-2491-0x000001BFB9300000-0x000001BFB9400000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/4712-2521-0x000001BFBA9D0000-0x000001BFBA9F0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4712-2508-0x000001BFBA3C0000-0x000001BFBA3E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4712-2495-0x000001BFBA600000-0x000001BFBA620000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4712-2490-0x000001BFB9300000-0x000001BFB9400000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/4760-2488-0x00000000045D0000-0x00000000045D1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4900-3524-0x0000000001400000-0x0000000001401000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/5020-3079-0x0000000003460000-0x0000000003461000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/5024-2062-0x00000000033F0000-0x00000000033F1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/5100-3526-0x000001E2E9B00000-0x000001E2E9C00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/5100-3527-0x000001E2E9B00000-0x000001E2E9C00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/5116-3372-0x0000000004460000-0x0000000004461000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download