Overview

overview

10

Static

static

10

JaffaCakes...21.exe

windows7-x64

10

JaffaCakes...21.exe

windows10-2004-x64

10

JaffaCakes...21.exe

android-9-x86

JaffaCakes...21.exe

android-10-x64

JaffaCakes...21.exe

android-11-x64

JaffaCakes...21.exe

macos-10.15-amd64

JaffaCakes...21.exe

ubuntu-18.04-amd64

JaffaCakes...21.exe

debian-9-armhf

JaffaCakes...21.exe

debian-9-mips

JaffaCakes...21.exe

debian-9-mipsel

Resubmissions

12-01-2025 13:10

250112-qef7dstkgz 10

12-01-2025 10:48

250112-mv9l4ayqhw 10

12-01-2025 10:40

250112-mqmxjaypcs 10

Analysis

  • max time kernel
    900s
  • max time network
    861s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-01-2025 10:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe

  • Size

    667KB

  • MD5

    0c9051fa83195d90120b21f47b895221

  • SHA1

    34c4a5caa77f87bc1394ff9755c5bc78f35e1c9e

  • SHA256

    212abfa710a85ae8c0ded0f528238f6960b2d714106fc920ec639f25ad36ff85

  • SHA512

    f8b2b8290840998cfffb3745378b6b3536fe30e1e64c8421d748beee75ae59bf91130804bbf10b1c05157ec0f8cec947a4ff787b8de5f0bd6343330a713585fe

  • SSDEEP

    12288:WbMqmNEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WIzEEb4Ev/ATEXKGVnGTzpA1Ec1A

Score
10/10
cycbotmodiloaderbackdoordiscoveryevasionpersistencerattrojanupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 7 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 54 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe cmd /c %SIGILL% "SIGTERM|SIGKILL|SIGABRT"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
      JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Users\Admin\DV245F.exe
        C:\Users\Admin\DV245F.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Users\Admin\qeufeon.exe
          "C:\Users\Admin\qeufeon.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1576
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del DV245F.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3680
      • C:\Users\Admin\aohost.exe
        C:\Users\Admin\aohost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:680
        • C:\Users\Admin\aohost.exe
          aohost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4148
      • C:\Users\Admin\bohost.exe
        C:\Users\Admin\bohost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2016
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\6ED1C\F2ED4.exe%C:\Users\Admin\AppData\Roaming\6ED1C
          4⤵
          • Executes dropped EXE
          PID:4556
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\1C8B6\lvvm.exe%C:\Program Files (x86)\1C8B6
          4⤵
          • Executes dropped EXE
          PID:1484
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\6ED1C\F2ED4.exe%C:\Users\Admin\AppData\Roaming\6ED1C
          4⤵
          • Executes dropped EXE
          PID:3456
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\1C8B6\lvvm.exe%C:\Program Files (x86)\1C8B6
          4⤵
          • Executes dropped EXE
          PID:4144
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\6ED1C\F2ED4.exe%C:\Users\Admin\AppData\Roaming\6ED1C
          4⤵
          • Executes dropped EXE
          PID:5456
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\1C8B6\lvvm.exe%C:\Program Files (x86)\1C8B6
          4⤵
          • Executes dropped EXE
          PID:5772
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\6ED1C\F2ED4.exe%C:\Users\Admin\AppData\Roaming\6ED1C
          4⤵
          • Executes dropped EXE
          PID:5704
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\1C8B6\lvvm.exe%C:\Program Files (x86)\1C8B6
          4⤵
          • Executes dropped EXE
          PID:5604
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\6ED1C\F2ED4.exe%C:\Users\Admin\AppData\Roaming\6ED1C
          4⤵
          • Executes dropped EXE
          PID:2364
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\1C8B6\lvvm.exe%C:\Program Files (x86)\1C8B6
          4⤵
          • Executes dropped EXE
          PID:4564
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\6ED1C\F2ED4.exe%C:\Users\Admin\AppData\Roaming\6ED1C
          4⤵
          • Executes dropped EXE
          PID:3988
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\1C8B6\lvvm.exe%C:\Program Files (x86)\1C8B6
          4⤵
          • Executes dropped EXE
          PID:5208
      • C:\Users\Admin\dohost.exe
        C:\Users\Admin\dohost.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://ginomp3.net
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd4c446f8,0x7ffbd4c44708,0x7ffbd4c44718
            5⤵
              PID:3712
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
              5⤵
                PID:4168
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
                5⤵
                  PID:3468
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
                  5⤵
                    PID:1496
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                    5⤵
                      PID:4212
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                      5⤵
                        PID:2140
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                        5⤵
                          PID:4580
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
                          5⤵
                            PID:3616
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                            5⤵
                              PID:1508
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
                              5⤵
                                PID:3744
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                                5⤵
                                  PID:4196
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                                  5⤵
                                    PID:5116
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
                                    5⤵
                                      PID:1652
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14610752204192843566,1218435649970571129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2340 /prefetch:2
                                      5⤵
                                        PID:5384
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c tasklist&&del dohost.exe
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1652
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist
                                        5⤵
                                        • Enumerates processes with tasklist
                                        • System Location Discovery: System Language Discovery
                                        PID:4564
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2152
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      4⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3740
                              • C:\Windows\system32\msiexec.exe
                                C:\Windows\system32\msiexec.exe /V
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4876
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:2448
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:3672
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:4564
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2400
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Enumerates connected drives
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:2384
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:3472
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1692
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                1⤵
                                  PID:2152
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  • Suspicious use of SendNotifyMessage
                                  PID:4124
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3700
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4396
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:680
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3900
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4688
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:3860
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4124
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:976
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:2496
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3384
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4916
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:5056
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4088
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4688
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:5096
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3644
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4552
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:1240
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3668
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3896
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:3064
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4116
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1568
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:4352
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3856
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2552
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:548
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3884
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3620
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:4092
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:552
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2552
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:4216
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4180
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2904
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:3052
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1240
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4172
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:760
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2520
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3740
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:1188
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1664
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2868
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:4396
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4392
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3260
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:2676
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4928
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3776
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:4692
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1832
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:220
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Checks SCSI registry key(s)
                                  PID:4520
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2352
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4928
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:3500
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3648
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5008
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:224
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4728
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2440
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:4688
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3956
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2188
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  PID:2384
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2784
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3384
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  PID:3704
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4456
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2388
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  PID:680
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:428
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4124
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  PID:3608
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3716
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:508
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  PID:2208
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3696
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2460
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:2540
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2524
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3776
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  PID:4244
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4084
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    PID:2776
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Enumerates connected drives
                                    • Checks SCSI registry key(s)
                                    • Modifies registry class
                                    PID:4472
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                    • Modifies registry class
                                    PID:3616
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Enumerates connected drives
                                    • Checks SCSI registry key(s)
                                    PID:4688
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1748
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                      • Modifies Internet Explorer settings
                                      PID:3792
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      • Enumerates connected drives
                                      • Modifies registry class
                                      PID:3132
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4552
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                        • Modifies Internet Explorer settings
                                        • Modifies registry class
                                        PID:508
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Boot or Logon Autostart Execution: Active Setup
                                        PID:4300
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3520
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                          • Modifies Internet Explorer settings
                                          PID:3048
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Boot or Logon Autostart Execution: Active Setup
                                          • Enumerates connected drives
                                          • Checks SCSI registry key(s)
                                          PID:1472
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:768
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4792
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                              • Boot or Logon Autostart Execution: Active Setup
                                              • Enumerates connected drives
                                              • Checks SCSI registry key(s)
                                              PID:5000
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1592
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                • Modifies Internet Explorer settings
                                                PID:3452
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                • Boot or Logon Autostart Execution: Active Setup
                                                • Enumerates connected drives
                                                PID:4792
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4552
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  PID:1064
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Checks SCSI registry key(s)
                                                  PID:1192
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4040
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    PID:2904
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    PID:5000
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3788
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      PID:1480
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Boot or Logon Autostart Execution: Active Setup
                                                      • Checks SCSI registry key(s)
                                                      PID:1508
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:2992
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        PID:1852
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                        • Boot or Logon Autostart Execution: Active Setup
                                                        • Enumerates connected drives
                                                        • Checks SCSI registry key(s)
                                                        PID:3864
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2540
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          PID:3928
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                          • Boot or Logon Autostart Execution: Active Setup
                                                          • Enumerates connected drives
                                                          • Checks SCSI registry key(s)
                                                          PID:1224
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:916
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            PID:752
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            PID:5100
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:1652
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                              • Modifies Internet Explorer settings
                                                              • Modifies registry class
                                                              PID:2556
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Enumerates connected drives
                                                              • Checks SCSI registry key(s)
                                                              PID:3120
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2668
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                • Modifies Internet Explorer settings
                                                                PID:3696
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                • Enumerates connected drives
                                                                • Checks SCSI registry key(s)
                                                                PID:4048
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4800
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                  • Modifies registry class
                                                                  PID:1952
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                  • Enumerates connected drives
                                                                  • Checks SCSI registry key(s)
                                                                  PID:4068
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                  • Modifies registry class
                                                                  PID:1668
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  PID:4044
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                  • Enumerates connected drives
                                                                  • Checks SCSI registry key(s)
                                                                  PID:1600
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:1704
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    PID:2528
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                    • Checks SCSI registry key(s)
                                                                    PID:1172
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:212
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                      • Modifies Internet Explorer settings
                                                                      • Modifies registry class
                                                                      PID:3508
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                      • Enumerates connected drives
                                                                      • Checks SCSI registry key(s)
                                                                      • Modifies registry class
                                                                      PID:2868
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1544
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                        • Modifies Internet Explorer settings
                                                                        • Modifies registry class
                                                                        PID:2796
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                        • Enumerates connected drives
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies registry class
                                                                        PID:212
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:4264
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                          • Modifies Internet Explorer settings
                                                                          PID:764
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                          • Checks SCSI registry key(s)
                                                                          PID:2188
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:5036
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            PID:884
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                            • Enumerates connected drives
                                                                            PID:4280
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:4824
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:4200
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:408
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                  • Modifies Internet Explorer settings
                                                                                  PID:3164

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Active Setup

                                                                                1
                                                                                T1547.014

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Active Setup

                                                                                1
                                                                                T1547.014

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Defense Evasion

                                                                                Hide Artifacts

                                                                                1
                                                                                T1564

                                                                                Hidden Files and Directories

                                                                                1
                                                                                T1564.001

                                                                                Modify Registry

                                                                                6
                                                                                T1112

                                                                                Credential Access

                                                                                Discovery

                                                                                Browser Information Discovery

                                                                                1
                                                                                T1217

                                                                                Peripheral Device Discovery

                                                                                3
                                                                                T1120

                                                                                Process Discovery

                                                                                1
                                                                                T1057

                                                                                Query Registry

                                                                                6
                                                                                T1012

                                                                                System Information Discovery

                                                                                6
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                Lateral Movement

                                                                                Collection

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                  Filesize

                                                                                  471B

                                                                                  MD5

                                                                                  2f9015314ce4f6cf0f35dbb90517b878

                                                                                  SHA1

                                                                                  f35798a720e1d183fa4397fc19a276c599ac4aca

                                                                                  SHA256

                                                                                  460f7c233878f3c0a9115f70f5394c5b43d2937d3ac7349b43009d343ed6051b

                                                                                  SHA512

                                                                                  3f2459ca942460d578cfe9d1f92b01cf949bb26240b5fa4739e8e86768d8c74d362bf97916470b017a6684cb2b2386d9fb2c68c81dcb091ad332ce678bb3a00f

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                  Filesize

                                                                                  412B

                                                                                  MD5

                                                                                  1ec3443bfd2b13212937e705bc131657

                                                                                  SHA1

                                                                                  2db392c46c0bcec06b67810b8d90c4c4b63a31e9

                                                                                  SHA256

                                                                                  6bdf8a14c8d64161395509ac3d5129ff00b679b6d2c81a6f876d33f8dda2f5b8

                                                                                  SHA512

                                                                                  8095efded0f89f81b9f67733ac6c94e319f69de2556dd19fe789562acd56c8acb456e6f488a32c86cb1677a3fe53e7b61b1f3c3c12caaad43b601b8b5b0cd6b0

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  443a627d539ca4eab732bad0cbe7332b

                                                                                  SHA1

                                                                                  86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                                                  SHA256

                                                                                  1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                                                  SHA512

                                                                                  923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  99afa4934d1e3c56bbce114b356e8a99

                                                                                  SHA1

                                                                                  3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                                                  SHA256

                                                                                  08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                                                  SHA512

                                                                                  76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                  Filesize

                                                                                  469B

                                                                                  MD5

                                                                                  c0868b1e1a966202553df2f403d2b884

                                                                                  SHA1

                                                                                  6af3dba20f5abffe5543e0da3b50a962af8a7068

                                                                                  SHA256

                                                                                  ef25a2a179586e49b9bdad9349d30510d57237ff8000efdc9e3301e089de3c77

                                                                                  SHA512

                                                                                  d65488dc624a040be97b27a79ac1047796a24b6667c77ad85e6be0e367a02d1aa9e127ff6e77981857a9a0217a2c0c170508c470aec8fee74375e30c8d87a87d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  83ebfca9428da53a4955af293948f703

                                                                                  SHA1

                                                                                  8148d8a6989f2c9397ba2aa06a7b69a0824fbda2

                                                                                  SHA256

                                                                                  d4bcc1520f316e200dd9b66fae42bebb5fc6072bf277c84a91377630ae0ac189

                                                                                  SHA512

                                                                                  8b1397604ca80b58d80ac33d5c6201fc7a558de106258c3703d5eda87dd9d7405c92a6cbfeb5610b5ba886714e791802b85cb9055d3dbb061bd6f6b0c5b99e38

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  c3eebe7e41a5b8d093e6ee438bd1d828

                                                                                  SHA1

                                                                                  0e628c979f7d4ad6d9a2d8dbe5539d9964a1d1fa

                                                                                  SHA256

                                                                                  c0e7c1d83977543efa8a340f19481aafd7e387ed05e7cb47e87103ca7b9ca4a7

                                                                                  SHA512

                                                                                  0aa7521fb03837790542083847324a94e680739561103e5698237698fa89a34db50e5a3201ededcf54ba32dd7a6c92257bba15c35d1874069a395e0aff2bce2c

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  46295cac801e5d4857d09837238a6394

                                                                                  SHA1

                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                  SHA256

                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                  SHA512

                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                  SHA1

                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                  SHA256

                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                  SHA512

                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  ad139d3a966111d5a17eded1483eb752

                                                                                  SHA1

                                                                                  b76a0c54305b6603bf235841c05742a956cd8964

                                                                                  SHA256

                                                                                  3b3a0d92af82d296106570e5cccb1dc97428b36768cffc392d0b67a8b248c5ee

                                                                                  SHA512

                                                                                  9bc3fa3de64b9987e227486412a73f376fe55041501640802e8f47ac311ee7e178b15d76c65b5c0249fc2910a73d3be9a3615389c3b30f60692f16599a6a0f1f

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  728de51093e6e43c6561574033bec5f7

                                                                                  SHA1

                                                                                  f01adfbeff53ca48ca6fbd211a4903b0c1d20da7

                                                                                  SHA256

                                                                                  60f1eec4be4c7b51d48d0cf4f5fa8329130944e192f523dad9397418f8be9994

                                                                                  SHA512

                                                                                  4e9e1d5d3146b393c2a32c85b52b54bf7536486429ef0c910ae0448e5093c717b2a9e34acedf516e5ead917605a1cfe3a5c0db8d7cae7cc41c3ae2acc20058ca

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  d3ebc79f9da38ec1adfac1bf3651c008

                                                                                  SHA1

                                                                                  15e6ae7299de970450c410d5d78d93c579f68296

                                                                                  SHA256

                                                                                  35b9df7fd1d20b589a254028751b727a4f1c0e6ed65349957f41fed5fbc05c1a

                                                                                  SHA512

                                                                                  fdb86144feec5caeb78b664f52c2ebce37ff66ab9bc9e6f50925b1796fe400ef5c02d73b90bb0d56dec38a1fa70214aada2d67d391380f3c64beacdbd0ddbf2b

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                  Filesize

                                                                                  36KB

                                                                                  MD5

                                                                                  0e2a09c8b94747fa78ec836b5711c0c0

                                                                                  SHA1

                                                                                  92495421ad887f27f53784c470884802797025ad

                                                                                  SHA256

                                                                                  0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                  SHA512

                                                                                  61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                  Filesize

                                                                                  36KB

                                                                                  MD5

                                                                                  ab0262f72142aab53d5402e6d0cb5d24

                                                                                  SHA1

                                                                                  eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                  SHA256

                                                                                  20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                  SHA512

                                                                                  bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133811528398685707.txt
                                                                                  Filesize

                                                                                  75KB

                                                                                  MD5

                                                                                  7411b0f5c2ee2aa3e9795f9772c8485f

                                                                                  SHA1

                                                                                  701bc4e46ed9b7b0721124c710fce0c44af97522

                                                                                  SHA256

                                                                                  09382a1bea045f82103e3a56a580376b31222b98dfd4c0869e18122a70384b1f

                                                                                  SHA512

                                                                                  09b18e08cb990dcea96a91298d3d09fd10bdce04df5e7688d94d3066cc37f0ea56721bc7d99fc92ec14555c56942b4810983cb638ad65750a1028bff52c2e943

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DGTT1KLJ\microsoft.windows[1].xml
                                                                                  Filesize

                                                                                  97B

                                                                                  MD5

                                                                                  dfc314c564e6dcc3d3d7f1d2cdf01ff5

                                                                                  SHA1

                                                                                  53a06942171b8047e4850e459554488280da265e

                                                                                  SHA256

                                                                                  56b9785b0255bd668bfdb7d6f789d1e54de550d567b85e52105893b8fbb45a08

                                                                                  SHA512

                                                                                  48688def79fffd15cd97505f73860552d7ad5069cd741214ca13225dd69eff4111338175bcb6fc9e1ed926f4bbc11b28865ab3df33aabf8bb7b8b68a0531f5f5

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  996B

                                                                                  MD5

                                                                                  ab1702e6d1e4f863f07fc62618d50eeb

                                                                                  SHA1

                                                                                  ee6199b4ced33833f30a3173a74710aa3be5abad

                                                                                  SHA256

                                                                                  c24709517cda8dee11be69b9bfe8a24d70febef1f9c00d4e7856eadcc49f1677

                                                                                  SHA512

                                                                                  cab6db6c49dbbe04068df0d788047fa640ae0f94b29d34a812f26195b5655742ed80d370e990a41f87c594c74279cac5dd69aed69620e5cf7ca207307c7910f9

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  f1ae7849f384d61c913f9816c451c06e

                                                                                  SHA1

                                                                                  1fc9fe852ba554e2c4c5ca5380d5aa132bf24420

                                                                                  SHA256

                                                                                  5788ad25e9859f8a339645b676911a5316a5a6b78c58ac3e3c398b2d1fe62de7

                                                                                  SHA512

                                                                                  60f5e3ba6a2313947eb5dcc3d041e7ad5aa9679e34a92efa257cb431459d44a3b6999228119ab131114b454afcb6d6c6a77c2d503e5adb8406841869b2a48711

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  c5f2790076b4e6510b9f0706e911966e

                                                                                  SHA1

                                                                                  c9bc4d6da77712e2e8192e2c1ecbc55e41fa8165

                                                                                  SHA256

                                                                                  29c8b15213518d0dd59c71dc8abb4ad3f08f85dcd975e940367f1a3e8c603af7

                                                                                  SHA512

                                                                                  e5df013ee396d0ade9b90963d6e5ed210d1ed1e7ec6ee1eb860711f2bcca6ec30dcfbb2a0fda4884b15c4aa0caa12d64da0bbb3dbc98459472ff6ddcd341731d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  092e813244eacc415902b1304b48b5a9

                                                                                  SHA1

                                                                                  aaca6cd148b9ace686bcf3b33f130ce6c7a0432b

                                                                                  SHA256

                                                                                  a199f3bd5671a9231adc50a07900593ad748be5b2d1cd69c202ddf77791653ee

                                                                                  SHA512

                                                                                  f91a5650408ea11c6c4992157e1a66e3359e75a4cdd9bde398211404cff1e934f20c60e10b3dc46738deac1692da150492260f9f5e5c6ad3472682a431c59bd5

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  600B

                                                                                  MD5

                                                                                  234b02e928fd0d69dc79f79d6d5de63e

                                                                                  SHA1

                                                                                  f651f3a399c428466e2ea371e9f61ffcd8c4a470

                                                                                  SHA256

                                                                                  d743fcc7d0b83717a6deb2edc9be7f2ba7665e7618ccf2c39fe619e5df6db305

                                                                                  SHA512

                                                                                  54abc667d9d85951b92ef1290d5c2dc504ac35e0a83c0fd4e0411ed58c24d6975ae5c4ba413c58097e2b4d0b70b0da57eef6a5b9307a30bc51c57aec4090b43c

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  b25ddcb4e01ba3730f0764aba2ca07fa

                                                                                  SHA1

                                                                                  9fed142c28bb47062599ad8ac653cc7938ebdc69

                                                                                  SHA256

                                                                                  1ec0d0cbb5eeae101e88620f596f444b592da306f697e01b35330f876c8c5bd2

                                                                                  SHA512

                                                                                  d60b1362675ea43307a6cdd5608b365908f32c303cd8e90a2e9791d0ab4212448d2a95df97cd9682ac83f068c2bbb42c08ff8166eba063a2896e3f36313056bf

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  f1c55b0675664ec19df2513d5ab7d532

                                                                                  SHA1

                                                                                  ec0de3b465db971b5cef515ee734b8c679314a13

                                                                                  SHA256

                                                                                  33540320ef5b5cb15fa8a9e40749d6bc0d593d6f4fec714ec67ac8ea0cb5d7a8

                                                                                  SHA512

                                                                                  887de5c473c8f4ebe03b0dcb7a8fc79a623c6e16130b25674237ebcabdaaf49d6c7b635ab614a81d5e3030e417a4caa805ec657c229a87cc894163d70d178b2a

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6ED1C\C8B6.ED1
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  4068d7a5bb4b7b64e0ddc2c4c52debab

                                                                                  SHA1

                                                                                  dd7d4d1541377a14947f0db6eec57f9e5d955186

                                                                                  SHA256

                                                                                  173507fd9ef62c341b5b18927f2cfff494511377aba262bd151bd8ab7bc9b6a8

                                                                                  SHA512

                                                                                  96d170e7be14dd5f86c0cb5eb061d1c3a2522f68be3249b5df07916dbdc23385b2bfa06c3f0634ce9c1ef53b5a989a9a625a4ee430ccc748c6748441be04b2a6

                                                                                  Download Submit

                                                                                • C:\Users\Admin\DV245F.exe
                                                                                  Filesize

                                                                                  216KB

                                                                                  MD5

                                                                                  00b1af88e176b5fdb1b82a38cfdce35b

                                                                                  SHA1

                                                                                  c0f77262df92698911e0ac2f7774e93fc6b06280

                                                                                  SHA256

                                                                                  50f026d57fea9c00d49629484442ea59cccc0053d7db73168d68544a3bbf6f59

                                                                                  SHA512

                                                                                  9e55e7c440af901f9c6d0cdae619f6e964b9b75c9351c76ea64362ff161c150b12a1caabb3d2eb63353a59ae70e7159ca6b3793ed0cc11994766846ac316107f

                                                                                  Download Submit

                                                                                • C:\Users\Admin\aohost.exe
                                                                                  Filesize

                                                                                  152KB

                                                                                  MD5

                                                                                  4401958b004eb197d4f0c0aaccee9a18

                                                                                  SHA1

                                                                                  50e600f7c5c918145c5a270b472b114faa72a971

                                                                                  SHA256

                                                                                  4c477ed134bc76fa7b912f1aad5e59d4f56f993baa16646e25fec2fdeed3bd8b

                                                                                  SHA512

                                                                                  f0548bdaafce2cde2f9d3bd1c26ed3c8e9321ef6d706bd372e18886d834828e5bb54ae44f19764e94574ceb4a1a2a99bdd8476e174b05114fcac9a6d4a2d58e6

                                                                                  Download Submit

                                                                                • C:\Users\Admin\bohost.exe
                                                                                  Filesize

                                                                                  173KB

                                                                                  MD5

                                                                                  0578a41258df62b7b4320ceaafedde53

                                                                                  SHA1

                                                                                  50e7c0b00f8f1e5355423893f10ae8ee844d70f4

                                                                                  SHA256

                                                                                  18941e3030ef70437a5330e4689ec262f887f6f6f1da1cd66c0cbae2a76e75bf

                                                                                  SHA512

                                                                                  5870a73798bad1f92b4d79f20bf618112ec8917574f6b25ab968c47afff419a829eef57b0282fb4c53e6e636436c8cf52a01426c46bdd4a0ea948d371f0feb09

                                                                                  Download Submit

                                                                                • C:\Users\Admin\dohost.exe
                                                                                  Filesize

                                                                                  24KB

                                                                                  MD5

                                                                                  d7390e209a42ea46d9cbfc5177b8324e

                                                                                  SHA1

                                                                                  eff57330de49be19d2514dd08e614afc97b061d2

                                                                                  SHA256

                                                                                  d2d49c37bdf2313756897245c3050494b39e824af448450eca1c0e83cf95b1e5

                                                                                  SHA512

                                                                                  de0eb11dd20cd9d74f47b138fb4189a299a57173fe2635150045b01629354f35b26e0575acd25501403af0db238a123b2e5a79582b47aee1d6e786f5eec1929d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\qeufeon.exe
                                                                                  Filesize

                                                                                  216KB

                                                                                  MD5

                                                                                  875b6c3f3a32fbdcdc6ee620d63c713b

                                                                                  SHA1

                                                                                  a87a57e32c0671a264fc0dc9ab9d304071b8eb44

                                                                                  SHA256

                                                                                  263f2d336b080000f9a701a695e62c9f639d7ebf5d736a80718f108fca8894fa

                                                                                  SHA512

                                                                                  c92be8bbc53c7efbdeb52be04308db069072aec23deb2f9a095e5250988023a9f06bd80376751a5d733b668fc60c5bc3f177f27e21d45d17ef2ea07ad8e57f79

                                                                                  Download Submit

                                                                                • memory/680-557-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/680-47-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                  Download

                                                                                • memory/920-54-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/920-6-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/920-7-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/920-4-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/920-0-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/920-1-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/920-248-0x0000000000400000-0x00000000004CF000-memory.dmp

                                                                                  Filesize

                                                                                  828KB

                                                                                  Download

                                                                                • memory/976-705-0x00000273AEE20000-0x00000273AEF20000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/976-708-0x00000273AFF80000-0x00000273AFFA0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/976-740-0x00000273B0350000-0x00000273B0370000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/976-720-0x00000273AFF40000-0x00000273AFF60000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/976-703-0x00000273AEE20000-0x00000273AEF20000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/976-704-0x00000273AEE20000-0x00000273AEF20000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1484-137-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                  Filesize

                                                                                  328KB

                                                                                  Download

                                                                                • memory/1692-274-0x00000258FFE50000-0x00000258FFE70000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1692-292-0x0000025080260000-0x0000025080280000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1692-261-0x00000258FFE90000-0x00000258FFEB0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2016-242-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                  Filesize

                                                                                  328KB

                                                                                  Download

                                                                                • memory/2016-139-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                  Filesize

                                                                                  328KB

                                                                                  Download

                                                                                • memory/2016-75-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                  Filesize

                                                                                  328KB

                                                                                  Download

                                                                                • memory/2384-254-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2476-5-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                  Filesize

                                                                                  124KB

                                                                                  Download

                                                                                • memory/2496-847-0x0000000003F50000-0x0000000003F51000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3860-701-0x00000000048B0000-0x00000000048B1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4124-411-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4148-74-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                  Download

                                                                                • memory/4148-48-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                  Download

                                                                                • memory/4148-46-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                  Download

                                                                                • memory/4148-41-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                  Download

                                                                                • memory/4148-42-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                  Download

                                                                                • memory/4396-438-0x0000019C7C080000-0x0000019C7C0A0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4396-426-0x0000019C7BA60000-0x0000019C7BA80000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4396-419-0x0000019C7BAA0000-0x0000019C7BAC0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4556-73-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                  Filesize

                                                                                  328KB

                                                                                  Download

                                                                                • memory/4688-559-0x000001C9B4E50000-0x000001C9B4F50000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4688-572-0x000001C9B5D70000-0x000001C9B5D90000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4688-584-0x000001C9B6180000-0x000001C9B61A0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4688-564-0x000001C9B5DB0000-0x000001C9B5DD0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4688-560-0x000001C9B4E50000-0x000001C9B4F50000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4916-848-0x000001877DA40000-0x000001877DB40000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4916-854-0x000001877EB90000-0x000001877EBB0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4916-869-0x000001877EF60000-0x000001877EF80000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4916-857-0x000001877EB50000-0x000001877EB70000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/5056-1001-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download