Analysis

  • max time kernel
    43s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2025 17:46

General

  • Target

    231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe

  • Size

    272KB

  • MD5

    5d2019b11efa06a03cf44a9014fbffe2

  • SHA1

    04c40f1c947f13d417bbdc1ca5bbd9907c0ff859

  • SHA256

    231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550

  • SHA512

    c60e3c030597e4ac5e9b1ace29b4062659370cf1185b5415fe86d95b551caa7fa3a69e51e600e6dfe2fbbc30a3b1c4244da47910369f591e8e8de247971edd55

  • SSDEEP

    6144:luupvQP0sP7wBfndGZ/1+UcJ0oVzQ6OCn9IAuE6eGni+FjpyObkF1:3I06kBf2/11cJ3xO6UE6eSiqlVwF1

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe
    "C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe
      C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe startC:\Users\Admin\AppData\Roaming\E9CE3\07D49.exe%C:\Users\Admin\AppData\Roaming\E9CE3
      2⤵
        PID:3664
      • C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe
        C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe startC:\Program Files (x86)\E3646\lvvm.exe%C:\Program Files (x86)\E3646
        2⤵
          PID:2680
        • C:\Program Files (x86)\LP\49FE\F8C7.tmp
          "C:\Program Files (x86)\LP\49FE\F8C7.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3020
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3896
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4244
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2488
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:312
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2580
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:740
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        PID:4324
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4276
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3156
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3068
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3832
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4788
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2932
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:116
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3708
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1524
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:1488
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3440
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4996
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3512
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4000
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4788
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4184
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3076
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:8
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:956
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3580
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1900
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3680
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2696
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2180
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3352
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3224
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3680
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:2804
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3040
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4836
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4220
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4944
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4020
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3756
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3856
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4208
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:4796
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3076
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:2444
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:400
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3824
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3096
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:3344
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2496
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1644
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:5000
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:536
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:2824
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4148
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3416
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3564
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:216

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Program Files (x86)\LP\49FE\F8C7.tmp

                                                                                                    Filesize

                                                                                                    97KB

                                                                                                    MD5

                                                                                                    cab43ad35f751376dc1ab8fc3ab7ac80

                                                                                                    SHA1

                                                                                                    f3ac69c098e47f27e1694e3be74e3282c8cbd02f

                                                                                                    SHA256

                                                                                                    555248b09ae00b6cce717d7033bb416fc0983b545d0eadba846105249a62295d

                                                                                                    SHA512

                                                                                                    3b1383badd5d6b5bf9d517ab1a6729d4f5de3bfc10d8595e0582849b8d1504e87d71b3e3b104ba11162dd2727216de1f28324aa7d6b231a61725231e09406515

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                    Filesize

                                                                                                    471B

                                                                                                    MD5

                                                                                                    3807da8007a3216b9db6e58ca749811f

                                                                                                    SHA1

                                                                                                    aa4c4d2b8857ecd134c11acba6a86866aaccfd3d

                                                                                                    SHA256

                                                                                                    e9493935e296833020121052d4d3be8c49c8de30504c0c12c94dc6a0f58ce693

                                                                                                    SHA512

                                                                                                    8ac77e01506f76d24b228053e10da64d2061068b09098c0ffe71bc3076611cb19d55a38d704d7626a6aa90fa2c1d36c31663a3538476884993a0f8104d18000c

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                    Filesize

                                                                                                    412B

                                                                                                    MD5

                                                                                                    5de8718d1ae86f72bf426ff2c0d583c3

                                                                                                    SHA1

                                                                                                    0d9b6adb8a088236ac35e353acd1a1fa3c9e5227

                                                                                                    SHA256

                                                                                                    68e149cdf6735fe67c3cdbd597d38c1bd94602d89692292994d14a54d3c2596c

                                                                                                    SHA512

                                                                                                    448968c817d0a59f86d7ba1f075031885ee4398ff4ea680360a333931eda6c0a9480cfe17fc1bc504d7a6976d32ae8a7e1439396008f511660807c1a7d63bad0

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    b79f7dce14a2192a17a32e2dce2992c2

                                                                                                    SHA1

                                                                                                    9da684c229f8692bad049f72fa31237592151dba

                                                                                                    SHA256

                                                                                                    b98da72de65f8ab4795b85a2857eeaae01864d499eaed2ad5ae3de35a387a737

                                                                                                    SHA512

                                                                                                    0366eaac0d11cb2a04154cc98b0103036d260e03a1e8d580b923d0007bc4b09189f8f8b643db9b8acfca545f3203460b9f0ee338b52d3cee9f9bb1559696c8a9

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml

                                                                                                    Filesize

                                                                                                    97B

                                                                                                    MD5

                                                                                                    539db492f33fccee9be530dd0bf34a46

                                                                                                    SHA1

                                                                                                    650b2a3583d6c9499b4ed73e9a5dca37f342a50e

                                                                                                    SHA256

                                                                                                    f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999

                                                                                                    SHA512

                                                                                                    9328f2fa286b4a9ca6ae57ddd9fca0b1140e5f68a5e143fd8ae6ea212a1af5d7b6b2289c324fa9480ca8d2e6d3b0cf7115611a56a3a161c5ad2f988f6ae62a0a

                                                                                                  • C:\Users\Admin\AppData\Roaming\E9CE3\3646.9CE

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    e669fa4da9063967a85fa4d970d7b9e3

                                                                                                    SHA1

                                                                                                    f548606ac360fe6848d1be01bfab7600e9780a30

                                                                                                    SHA256

                                                                                                    0df7add4b11d2091ea9a1c9e93461fdceae2d9c48168ee40f1ecb3a684a7629a

                                                                                                    SHA512

                                                                                                    f22e7d4c56d5d51e6f8f9e7ea2e5d1ecbeb36a54202f6566596b4a55dac222e24fb1d216bacb6e63bde813f9ac0b281a1fd9e40d3bee12af85182f311ad7686a

                                                                                                  • C:\Users\Admin\AppData\Roaming\E9CE3\3646.9CE

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    3f7e68dc5d21ce5e202cf865beb6e144

                                                                                                    SHA1

                                                                                                    5aa9ceed70554555561f79bd7ccebbe3a9c217ba

                                                                                                    SHA256

                                                                                                    531ab555d1a93a851c62614e09922236566fc75a2172021004e2af7c8b3eefd3

                                                                                                    SHA512

                                                                                                    d2e408490058ac0c956855f93b5ee831d94465476d2e4ad8b1754bc7483e6463f72404b4f5a08c8b0ccf3459b25174a31598b3992de4e54f186bdabd70c13d29

                                                                                                  • C:\Users\Admin\AppData\Roaming\E9CE3\3646.9CE

                                                                                                    Filesize

                                                                                                    597B

                                                                                                    MD5

                                                                                                    3fb354ac6f0d1a8eee9eb8200e545abe

                                                                                                    SHA1

                                                                                                    1cd8cc367a36e0d449213d38883dc143f77dee19

                                                                                                    SHA256

                                                                                                    6d1f3285f6876ea26ac68a9e15e4c4d505c910f27ef3576738559dc4774dc40a

                                                                                                    SHA512

                                                                                                    7a8068526beee01a52047cc18ca59f4592264db4ed2ff440d8b8a6689dfc44ed646f7a9e1a60d01fcc79284b28a7cee52f45e7ac7dd6499e795e9ed430bfcecd

                                                                                                  • C:\Users\Admin\AppData\Roaming\E9CE3\3646.9CE

                                                                                                    Filesize

                                                                                                    297B

                                                                                                    MD5

                                                                                                    71edd83ab02ccaec9e040c50282165e1

                                                                                                    SHA1

                                                                                                    73ce1244779d43395abeb3461c83b169dc50431c

                                                                                                    SHA256

                                                                                                    59a530b7a3d612d22fe82d218e2f038f9056eacdd3b6166c4ade3e4d1d7172ed

                                                                                                    SHA512

                                                                                                    dfd4e8f3faf86e8eb94bbb5bc50823150460bed065925cdaf9569f0a983d39f1e190b3d8d4f221274604d5fc1d3e13f2259ca3e4160901c1a150f54bfebbf3fb

                                                                                                  • C:\Users\Admin\AppData\Roaming\E9CE3\3646.9CE

                                                                                                    Filesize

                                                                                                    897B

                                                                                                    MD5

                                                                                                    3330f159feb7091633de8d5767e2e9c0

                                                                                                    SHA1

                                                                                                    4d28ee32993585a147a91d51ed3d549de3d6e01f

                                                                                                    SHA256

                                                                                                    c4f369a63b3126b4ad47f208431c27aa617e275ee9f40f6e10b3e4a367167dc4

                                                                                                    SHA512

                                                                                                    5cc32f531bafbfefe878721293448edb98543136e31501c2105600710bb78efd5064acf2b2cb28c24d12e76615384377e649dd1cf9ab8be56024ace1633fb7fe

                                                                                                  • memory/312-387-0x0000000002F70000-0x0000000002F71000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/740-393-0x0000023DDC520000-0x0000023DDC540000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/740-424-0x0000023DDCAE0000-0x0000023DDCB00000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/740-423-0x0000023DDC1D0000-0x0000023DDC1F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/740-388-0x0000023DDB700000-0x0000023DDB800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/956-1303-0x00000269A6100000-0x00000269A6200000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/956-1302-0x00000269A6100000-0x00000269A6200000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/956-1307-0x00000269A7220000-0x00000269A7240000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/956-1329-0x00000269A7680000-0x00000269A76A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/956-1317-0x00000269A6FE0000-0x00000269A7000000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1488-868-0x000001F78C840000-0x000001F78C860000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1488-881-0x000001F78CC50000-0x000001F78CC70000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1488-855-0x000001F78C880000-0x000001F78C8A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1488-850-0x000001F78B720000-0x000001F78B820000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/2000-820-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/2000-84-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/2000-86-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                                                    Filesize

                                                                                                    412KB

                                                                                                  • memory/2000-201-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/2000-0-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/2000-2-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                                                    Filesize

                                                                                                    412KB

                                                                                                  • memory/2000-3-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/2680-204-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/2680-203-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/3020-708-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                    Filesize

                                                                                                    112KB

                                                                                                  • memory/3068-699-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/3076-1300-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/3156-578-0x0000028E68950000-0x0000028E68970000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/3156-553-0x0000028E67420000-0x0000028E67520000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3156-552-0x0000028E67420000-0x0000028E67520000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3156-556-0x0000028E68580000-0x0000028E685A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/3156-551-0x0000028E67420000-0x0000028E67520000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3156-564-0x0000028E68540000-0x0000028E68560000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/3440-999-0x0000000004730000-0x0000000004731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/3512-1028-0x000002643ACA0000-0x000002643ACC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/3512-1000-0x0000026439770000-0x0000026439870000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3512-1001-0x0000026439770000-0x0000026439870000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3512-1005-0x000002643A6D0000-0x000002643A6F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/3512-1017-0x000002643A690000-0x000002643A6B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/3580-1448-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/3664-88-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/3664-87-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/3680-1450-0x00000231ED400000-0x00000231ED500000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3680-1451-0x00000231ED400000-0x00000231ED500000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/3708-848-0x0000000002930000-0x0000000002931000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/4000-1147-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/4184-1150-0x0000023717F00000-0x0000023718000000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4184-1186-0x0000023719390000-0x00000237193B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4184-1168-0x0000023718F80000-0x0000023718FA0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4184-1154-0x0000023718FC0000-0x0000023718FE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4184-1149-0x0000023717F00000-0x0000023718000000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4324-549-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/4788-719-0x000001BDCEA20000-0x000001BDCEA40000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4788-739-0x000001BDCEE20000-0x000001BDCEE40000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4788-702-0x000001BDCD700000-0x000001BDCD800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4788-706-0x000001BDCEA60000-0x000001BDCEA80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4788-701-0x000001BDCD700000-0x000001BDCD800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB