Analysis

  • max time kernel
    41s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2025 06:33

General

  • Target

    2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe

  • Size

    272KB

  • MD5

    cf7c5f8523446c33cc27330492313e50

  • SHA1

    df91c2b5aebaed460065cc0a78f92cc2fb8d1490

  • SHA256

    2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88e

  • SHA512

    720ea22534d52a5e5989786baf959123105f99b96a0c1619a1bea1b9f9259773969a55006e81f449a34347bb19a48e0b584409ebb5c849c57b2576b19ad32843

  • SSDEEP

    6144:luupvQP0sP7wBfndGZ/1+UcJ0oVzQ6OCn9IAuE6eGni+FjpyObkF:3I06kBf2/11cJ3xO6UE6eSiqlVwF

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe
    "C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4992
    • C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe
      C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe startC:\Users\Admin\AppData\Roaming\2277B\77105.exe%C:\Users\Admin\AppData\Roaming\2277B
      2⤵
        PID:860
      • C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe
        C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe startC:\Program Files (x86)\7B96A\lvvm.exe%C:\Program Files (x86)\7B96A
        2⤵
          PID:3044
        • C:\Program Files (x86)\LP\0592\FBD5.tmp
          "C:\Program Files (x86)\LP\0592\FBD5.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1656
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1320
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:732
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1020
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2828
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3640
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2680
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1460
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3568
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3512
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4788
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2980
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2620
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4448
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2272
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1704
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:684
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1980
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1728
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1712
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1352
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:1876
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:1492
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4248
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4352
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:2184
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:388
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1100
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:1672
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2832
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3472
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:820
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3908
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4188
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:432
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:5036
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3888
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:2296
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3288
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4040
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:2340
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:820
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:2436
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:4092
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3056
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1204
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:448
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4620
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4076
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:2768
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4996
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3512
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:1376
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4352
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:2084
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3696
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:1296
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1936
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:3628

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Program Files (x86)\LP\0592\FBD5.tmp

                                                                                                    Filesize

                                                                                                    97KB

                                                                                                    MD5

                                                                                                    cab43ad35f751376dc1ab8fc3ab7ac80

                                                                                                    SHA1

                                                                                                    f3ac69c098e47f27e1694e3be74e3282c8cbd02f

                                                                                                    SHA256

                                                                                                    555248b09ae00b6cce717d7033bb416fc0983b545d0eadba846105249a62295d

                                                                                                    SHA512

                                                                                                    3b1383badd5d6b5bf9d517ab1a6729d4f5de3bfc10d8595e0582849b8d1504e87d71b3e3b104ba11162dd2727216de1f28324aa7d6b231a61725231e09406515

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                    Filesize

                                                                                                    471B

                                                                                                    MD5

                                                                                                    ee5415ca8c7e87fbf47dbc771cad0ae1

                                                                                                    SHA1

                                                                                                    0db7cc24e8508752fb7d433aea2f214c5cf61b4d

                                                                                                    SHA256

                                                                                                    29eebe18342f8d4574c4f39615bb1f3839ea0b8827946be7057af93042dbf188

                                                                                                    SHA512

                                                                                                    d481865e9a45ac395068c8d36f65fa331d87728611b0a373307ff223dc5c607b1650e261ce4b92fc05013fb276fdc31ab29d65c6c93a96be46d86dbbc08aeec6

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                    Filesize

                                                                                                    412B

                                                                                                    MD5

                                                                                                    5889aeccf35998a72a1076e5d9e402fe

                                                                                                    SHA1

                                                                                                    f796990aafb1d0e77596a54881263350f68a6d64

                                                                                                    SHA256

                                                                                                    8d0d2be2b673f620567f6e41d8b709b6271b7b62af174e5963d57d4e846fc54d

                                                                                                    SHA512

                                                                                                    d4c4e906356323a53ce5d06091aa8f461c358fb8c562e51969ab4f2e8c202ff77c6a58b9d18615b63682f7d5214209ad6ed2e476d45fb9820cc13f252f65ef37

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    649f7dd7345626ddb47c787b7a8676e3

                                                                                                    SHA1

                                                                                                    6dbdcee08ff2aef8211080e56e25080150ecdc8e

                                                                                                    SHA256

                                                                                                    d399beec290a609d60086d900de8c733ab3def3406e9d626315cbd597285be81

                                                                                                    SHA512

                                                                                                    267a6c7f068365667b3da157e707799e7e9bd875e74d04fba6b654f27ee3c3762e3d8260c4b9f0543e645f5daddf812e7eb8e42f4e491899950431f47d84e354

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2C1DWAXK\microsoft.windows[1].xml

                                                                                                    Filesize

                                                                                                    96B

                                                                                                    MD5

                                                                                                    e348d00fe7b19d8e8f6efc5cd8f3be59

                                                                                                    SHA1

                                                                                                    de85b87da07da2e4b4215ef312d318f1b329ca6e

                                                                                                    SHA256

                                                                                                    4ee26da36e3b7d5c9f14f2ed8d6c75c10434acec949dc6e550f176b9acb84dd7

                                                                                                    SHA512

                                                                                                    a0a9a671e08cb35904098426cf1b50a11d6a0c7be57f684f9808f5c953ac2732dd1f090c3d12260870056a1ee5f9097ad9872715c798fba196d7212a536afcbe

                                                                                                  • C:\Users\Admin\AppData\Roaming\2277B\B96A.277

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    1d631a187b64589d3c50d169db018bac

                                                                                                    SHA1

                                                                                                    0fa733e27a47ef9bb21b60da9244e70e19562987

                                                                                                    SHA256

                                                                                                    fa8e09d1a8de628b68e311f6425aa4c5f87a6405650c9a42f9376346b862912b

                                                                                                    SHA512

                                                                                                    790801494471c6ca20e6fc6c01e2b87ffc1febc99d38c848e0c98d6fdac0e09ad100a5d18c5867cab576cfb6aee667f92dc7df5dd48b4dcf1e278c98cde261ca

                                                                                                  • C:\Users\Admin\AppData\Roaming\2277B\B96A.277

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    c0c59783dd37065a632627da777aea5a

                                                                                                    SHA1

                                                                                                    f62041691b34bcf0c5b74e824df4674aa3b52335

                                                                                                    SHA256

                                                                                                    93d3222bd141d641247c65ba8746dd4e37be507d6d75a87879d17c4006983e8c

                                                                                                    SHA512

                                                                                                    544f48ec2dae21388dfa6143b6413fecc593d6daec8dfecc63ee4c090e6ed7dc1c23163e36f497ceb143a84b5645704991e92b2524910b93b1f02d40ffe256c7

                                                                                                  • C:\Users\Admin\AppData\Roaming\2277B\B96A.277

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    99ce277422a4063662dc042712f006bd

                                                                                                    SHA1

                                                                                                    e3bd4cb744ba1aac3ff132abfd5ea1805535edfa

                                                                                                    SHA256

                                                                                                    d74d923063daf3cc85f10637290083b6cafb5722bf8763f93dee171c4cf5c3b5

                                                                                                    SHA512

                                                                                                    463f95d55b4b3de138d04bd63a35ac0d96d01b94998fb34805877e9168d9f84a053e6bbceb195c1904fbe4bb6d4c684f05413c25dc4a339df4a6a7b7ab43cec0

                                                                                                  • C:\Users\Admin\AppData\Roaming\2277B\B96A.277

                                                                                                    Filesize

                                                                                                    597B

                                                                                                    MD5

                                                                                                    e32043d9fa701b90924791d607326cb4

                                                                                                    SHA1

                                                                                                    198d2f6913496fc8ab68f5867b4fa0d80bbc323e

                                                                                                    SHA256

                                                                                                    6cf461fc81b47a8021da88490c918f8f73b6f74e67f5a551b8d3037d4aa352f3

                                                                                                    SHA512

                                                                                                    7a3a5c3d5f81802044509977d0cfcf43f6d628ed66a5b460841c3b4479a5ce5cf0722eb81f342ae3a15492d51a2d55028830ea1c8340ea35270b6a62891beed0

                                                                                                  • C:\Users\Admin\AppData\Roaming\2277B\B96A.277

                                                                                                    Filesize

                                                                                                    897B

                                                                                                    MD5

                                                                                                    5fdfd9d4c837f00d4831feefeaa84899

                                                                                                    SHA1

                                                                                                    a5e307465d1da9bcbaf0d36ed1ffb57b68257724

                                                                                                    SHA256

                                                                                                    27e0e433fe674f38d3b37c55439b528f0ecfdfca5b1f1b583d0add354803e3e5

                                                                                                    SHA512

                                                                                                    082ff5844cb67589c390dd8e030ef462d288d198c3c34b27ac16bd347524c66cfe9192ec48e393346f6a31f650426c912b2d8e44c0d21f25636b91d8131447a9

                                                                                                  • C:\Users\Admin\AppData\Roaming\2277B\B96A.277

                                                                                                    Filesize

                                                                                                    297B

                                                                                                    MD5

                                                                                                    71edd83ab02ccaec9e040c50282165e1

                                                                                                    SHA1

                                                                                                    73ce1244779d43395abeb3461c83b169dc50431c

                                                                                                    SHA256

                                                                                                    59a530b7a3d612d22fe82d218e2f038f9056eacdd3b6166c4ade3e4d1d7172ed

                                                                                                    SHA512

                                                                                                    dfd4e8f3faf86e8eb94bbb5bc50823150460bed065925cdaf9569f0a983d39f1e190b3d8d4f221274604d5fc1d3e13f2259ca3e4160901c1a150f54bfebbf3fb

                                                                                                  • memory/388-1401-0x00000000023E0000-0x00000000023E1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/684-809-0x0000017989000000-0x0000017989100000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/684-838-0x000001798A4C0000-0x000001798A4E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/684-814-0x0000017989EE0000-0x0000017989F00000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/684-824-0x0000017989EA0000-0x0000017989EC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/860-68-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/860-67-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/1352-1109-0x0000000004330000-0x0000000004331000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/1460-362-0x0000024E74B60000-0x0000024E74B80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1460-357-0x0000024E73B20000-0x0000024E73C20000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1460-372-0x0000024E74B20000-0x0000024E74B40000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1460-385-0x0000024E74F20000-0x0000024E74F40000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1492-1128-0x0000020EEB820000-0x0000020EEB840000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1492-1113-0x0000020EEA700000-0x0000020EEA800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1492-1117-0x0000020EEB860000-0x0000020EEB880000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1492-1147-0x0000020EEBC20000-0x0000020EEBC40000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1656-660-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                    Filesize

                                                                                                    112KB

                                                                                                  • memory/1672-1404-0x00000200FEA00000-0x00000200FEB00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1672-1405-0x00000200FEA00000-0x00000200FEB00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1672-1408-0x00000200FFB60000-0x00000200FFB80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1672-1403-0x00000200FEA00000-0x00000200FEB00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1712-996-0x00000152BFAF0000-0x00000152BFB10000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1712-989-0x00000152BF650000-0x00000152BF670000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1712-964-0x00000152BF690000-0x00000152BF6B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/1712-959-0x0000014ABD540000-0x0000014ABD640000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1712-961-0x0000014ABD540000-0x0000014ABD640000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/1980-957-0x0000000004850000-0x0000000004851000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/2184-1263-0x000001BBD32B0000-0x000001BBD32D0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/2184-1295-0x000001BBD3880000-0x000001BBD38A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/2184-1276-0x000001BBD3270000-0x000001BBD3290000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/2184-1259-0x000001BBD2350000-0x000001BBD2450000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/2184-1258-0x000001BBD2350000-0x000001BBD2450000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/2272-807-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/2980-663-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/3044-167-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/3568-514-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/3640-356-0x0000000003300000-0x0000000003301000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/4248-1257-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/4448-692-0x0000023498790000-0x00000234987B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4448-670-0x00000234983C0000-0x00000234983E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4448-678-0x0000023498380000-0x00000234983A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4448-666-0x0000023497300000-0x0000023497400000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4448-665-0x0000023497300000-0x0000023497400000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4788-544-0x00000234058A0000-0x00000234058C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4788-516-0x0000023404500000-0x0000023404600000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4788-521-0x00000234052D0000-0x00000234052F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4788-517-0x0000023404500000-0x0000023404600000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/4788-533-0x0000023405290000-0x00000234052B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                  • memory/4992-0-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/4992-661-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/4992-165-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/4992-66-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                                                    Filesize

                                                                                                    412KB

                                                                                                  • memory/4992-64-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/4992-3-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                    Filesize

                                                                                                    424KB

                                                                                                  • memory/4992-2-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                                                    Filesize

                                                                                                    412KB