Overview

overview

10

Static

static

1

3cdf02f1e4...73.exe

windows7-x64

3

3cdf02f1e4...73.exe

windows10-2004-x64

10

Respektlsestes.ps1

windows7-x64

3

Respektlsestes.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    62s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2025, 15:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Respektlsestes.ps1

  • Size

    51KB

  • MD5

    f177e247c8beadd6e0762493d8e9fe79

  • SHA1

    008d26170d63c58d17695dfa8196e4ce8feb920a

  • SHA256

    825dc4cae1f45f17dc54bd1ec82d890b8266691b5fad32e7882fc8dc6bc2c71b

  • SHA512

    fa9a9a02bcb1d2725b228aea9a8141536578b9cf023b81c2df9a58e1e046f83314f85bb74dca5bd9c0a6ac6cbaad5d74269ae5efa2b15925609fe51308b81884

  • SSDEEP

    1536:3SUTaGUqdmQ8RJETuiBhBzcS6amUmRHYi:iUDQR0bBhCCSH7

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Respektlsestes.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3192
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:456
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTQ4NDJDNTgtQTI1MS00OTY3LUE1RDItNjgzQTEyN0Y4OTEwfSIgdXNlcmlkPSJ7MTQ4NjlBMTgtQ0M3OC00Q0RDLUFBMUQtNEM2NTAwMjZCNkJGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NUZCMTEyNDItNTU4My00MUU5LThEMTgtNzJCNzc3Q0Y1MzZEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTcwNjA5NjE2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2044
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3500
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:892
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2884
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2320
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3864
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4408
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4736
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4020
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:5060
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4876
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3556
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4392
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1452
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1312
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:368
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3536
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:412
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3580
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3588
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4196
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3840
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3660
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1380
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3176
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2356
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1272
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4576
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:5012
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3452
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2060
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1548
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3176
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3608
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4368
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3752
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:512
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3960
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:2176
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2888
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2248
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3172
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4000
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3588
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4336
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:5044
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:400
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1220
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4884
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3528
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3720
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1528

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    3229405e3b8f92c67ef53ed827f07e17

                                                    SHA1

                                                    ca825dc9ec1f8671d1aba2f84af70420bee37554

                                                    SHA256

                                                    ff183f1f376fe950e13ff2b8a9cf52afbdb0469c51a67da70f44376bec3f9880

                                                    SHA512

                                                    54bfbdcec5c02cb715af426d740591a77c6abcd56bed4349a0ed92d4baf56eb7d662daa2344a347c023c46cbcb3a77542bb0fbdafdad3d59fe50e90c7d18715b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
                                                    Filesize

                                                    246B

                                                    MD5

                                                    647e18ff82cee558908f5f65531d762e

                                                    SHA1

                                                    4f347bbcbcfe92c8011e1a60722a8c85d83d7780

                                                    SHA256

                                                    a6152b2d220bb658a4ae259a70da289adeac7d94358f3ffc14c7370283bb2176

                                                    SHA512

                                                    2a088defe1ec6ccca6b5b547ce16eabb0b1387fa1ebbf07c634eb37f6b02f713e1a3dd3ad57f5ba0cd9f82d7605808d9d053568ba43301bd1ac9c1d0b4f9cc38

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    bbd5338931be5e05c755b05744c2c68a

                                                    SHA1

                                                    89b08c17145ef1b9a462a3efe0c71bef45e6c5e4

                                                    SHA256

                                                    0699abe44a630b007b2a608640428dd3e630d106bee8608782c7535b16f74b89

                                                    SHA512

                                                    0b1c2eb4d5d24e47908d7209de781754e9b3fe8b2d2925e0912ca88d75fdc1dde5e3ac6bc880faf087fa42aa17c805e4b74b8c46c1b050c323ded4cf99d9f5dc

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133841941839914810.txt
                                                    Filesize

                                                    75KB

                                                    MD5

                                                    df25d93b22eeb9b8769ef72788ca7114

                                                    SHA1

                                                    f3b78ad4e28cc14305176323ee6e179fc8aff799

                                                    SHA256

                                                    94b9847973a3d44d19f1361ba8c7d269eb0dd717433ad4a7bfff4e6e442c37fe

                                                    SHA512

                                                    0fc2a6c82e5683a93f283826cb86f09269f8f8d58e1980697202bb0403c3181f96500e9adacdb6e2d99f115209cbb0090c96a3be923fe332e4d70cc43336ea54

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\H03PMY0P\microsoft.windows[1].xml
                                                    Filesize

                                                    95B

                                                    MD5

                                                    9c243d70c31989a09da867503584ebb0

                                                    SHA1

                                                    2870e07f5260aec453a2c87176467c23f09255c7

                                                    SHA256

                                                    9481395d97732292a632e8b2fe1d7ff5c5b792b1cd34cb1fc2e9fdf050734f2a

                                                    SHA512

                                                    9a1a7e9da5f8425b2a7870acea88cf725125b2cfe7fc529d8c6c082ec2732687c2bc1e3b02cdbbfdda76ce67c0519fa13dd8f3663ba9e7446f904de0ae86470f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ovqufakj.3vn.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • memory/412-579-0x0000000004800000-0x0000000004801000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/512-1319-0x0000027211240000-0x0000027211340000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/512-1322-0x0000027212390000-0x00000272123B0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/512-1338-0x0000027212350000-0x0000027212370000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/512-1353-0x0000027212760000-0x0000027212780000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1272-1024-0x0000000003700000-0x0000000003701000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/1312-432-0x0000000004860000-0x0000000004861000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/1380-873-0x0000000002A90000-0x0000000002A91000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/1452-295-0x0000022327020000-0x0000022327120000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/1452-296-0x0000022327020000-0x0000022327120000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/1452-300-0x0000022328170000-0x0000022328190000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1452-312-0x0000022328130000-0x0000022328150000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1452-324-0x0000022328540000-0x0000022328560000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1548-1194-0x000001DB5B070000-0x000001DB5B090000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1548-1214-0x000001DB5B680000-0x000001DB5B6A0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1548-1182-0x000001DB5B0B0000-0x000001DB5B0D0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2356-900-0x00000150CC2A0000-0x00000150CC2C0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2356-880-0x00000150CBCC0000-0x00000150CBCE0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2356-875-0x00000150CAD60000-0x00000150CAE60000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2356-887-0x00000150CBC80000-0x00000150CBCA0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2884-34-0x000001A06BF00000-0x000001A06C000000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2884-38-0x000001A06CE80000-0x000001A06CEA0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2884-35-0x000001A06BF00000-0x000001A06C000000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2884-51-0x000001A06CE40000-0x000001A06CE60000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2884-60-0x000001A06D250000-0x000001A06D270000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2884-33-0x000001A06BF00000-0x000001A06C000000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2888-1464-0x0000000004480000-0x0000000004481000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3172-1479-0x00000239D5820000-0x00000239D5840000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3172-1467-0x00000239D4700000-0x00000239D4800000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3172-1471-0x00000239D5860000-0x00000239D5880000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3172-1466-0x00000239D4700000-0x00000239D4800000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3192-12-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-16-0x00000276F3320000-0x00000276F334A000-memory.dmp

                                                    Filesize

                                                    168KB

                                                    Download

                                                  • memory/3192-0-0x00007FFE5EB23000-0x00007FFE5EB25000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/3192-13-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-6-0x00000276F2FB0000-0x00000276F2FD2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/3192-14-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-15-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-11-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-17-0x00000276F3320000-0x00000276F3344000-memory.dmp

                                                    Filesize

                                                    144KB

                                                    Download

                                                  • memory/3192-22-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-19-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-20-0x00007FFE5EB20000-0x00007FFE5F5E1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3192-21-0x00007FFE5EB23000-0x00007FFE5EB25000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/3452-1176-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3500-32-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3536-469-0x00000248B03E0000-0x00000248B0400000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3536-439-0x00000248B0020000-0x00000248B0040000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3536-447-0x00000248AFDD0000-0x00000248AFDF0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3556-293-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3588-608-0x0000027CBA2F0000-0x0000027CBA310000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3588-581-0x0000027CB8E00000-0x0000027CB8F00000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3588-597-0x0000027CB9BE0000-0x0000027CB9C00000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3588-585-0x0000027CB9F20000-0x0000027CB9F40000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3588-580-0x0000027CB8E00000-0x0000027CB8F00000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3660-743-0x0000017E63260000-0x0000017E63280000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3660-754-0x0000017E63880000-0x0000017E638A0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3660-732-0x0000017E632A0000-0x0000017E632C0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3660-727-0x0000017E62340000-0x0000017E62440000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3660-728-0x0000017E62340000-0x0000017E62440000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4020-149-0x0000015781800000-0x0000015781900000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4020-165-0x00000157834A0000-0x00000157834C0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4020-153-0x00000157834E0000-0x0000015783500000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4020-176-0x0000015783AC0000-0x0000015783AE0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4020-148-0x0000015781800000-0x0000015781900000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4196-725-0x0000000004660000-0x0000000004661000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4368-1315-0x0000000004390000-0x0000000004391000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4408-146-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/5012-1062-0x00000221907C0000-0x00000221907E0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/5012-1043-0x00000221903B0000-0x00000221903D0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/5012-1032-0x00000221903F0000-0x0000022190410000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download