Overview

overview

8

Static

static

3

2026-06-27...ti.exe

windows10-2004-x64

8

2026-06-27...ti.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 01:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe
  • Size 71KB
  • Sample260629-bgl34aa14p
  • SHA256 e3e1ec95f3a81f61279cbd91c0c26e5f8a0f4649d516b0f0d8aee96200a8efd4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 21 IoCs
  • Adds Run key to start application 2 TTPs 45 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 46 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Runs ping.exe 1 TTPs 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Local\Temp\2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:5212
        • C:\Windows\system32\PING.EXE
          ping -n 3 127.0.0.1
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2392
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe
    C:\Users\Admin\AppData\Local\Temp\2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Local\Temp\2026-06-27_fa11f55498b40d3a4eb0c5a55dc9962f_cobalt-strike_conti.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5960
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2020
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E587E05.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E587E05.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5388
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E587E05.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4968
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E588A1A.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E588A1A.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E588A1A.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2032
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E589630.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E589630.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E589630.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5908
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1348
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58A860.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58A860.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58A860.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:464
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5728
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58B1A7.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58B1A7.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5328
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58B1A7.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1180
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58C222.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58C222.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58C222.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4292
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58CABD.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58CABD.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58CABD.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1684
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58DA4E.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58DA4E.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58DA4E.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4368
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E606.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E606.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3336
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E606.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5208
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1700
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F5C5.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F5C5.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F5C5.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1592
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5901BB.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5901BB.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5901BB.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3740
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3280
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59113C.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59113C.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:5496
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59113C.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4236
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:964
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D42.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D42.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:3424
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D42.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1604
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1344
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592C85.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592C85.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:4768
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592C85.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5888
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4364
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5938AA.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5938AA.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:3516
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5938AA.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5688
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1208
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59481B.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59481B.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:4480
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59481B.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5224
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1968
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E595421.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E595421.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:5168
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E595421.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1572
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1452
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5963A2.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5963A2.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:3228
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5963A2.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5936
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2756
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59797C.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59797C.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:1348
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59797C.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4732
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3716
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597EFA.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597EFA.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:5732
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597EFA.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3776
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2212
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1616
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4548
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599263.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599263.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:2484
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599263.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5044
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4100
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4828
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4836

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IconCache.db
        • Path C:\Users\Admin\AppData\Local\IconCache.db
        • Size 13KB
        • SHA256 5ae7250938ac611eda2d392ee22a14cf062ab7772a6165505a0406ae7fd966ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiscoverCacheData.dat
        • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
        • Size 1019B
        • SHA256 1a716b8a1bf041d9096541cdd3fa4633c8a581adc7a1cf4448eb5b992234f891
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        msca_0E587E05.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E587E05.exe
        • Size 71KB
        • SHA256 ac73b74e7ebb70c0bceba71ca0de5048360af52dfcd315c9c372af5f56869d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E588A1A.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E588A1A.exe
        • Size 71KB
        • SHA256 0521945cb28dfddc7190eb43023a2fca81bfb42014e742193a61402168c643e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E589630.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E589630.exe
        • Size 71KB
        • SHA256 320533aae0a0198c43959f6735f874a61cde74363cd19f6b901eaad2131b6336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58A860.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58A860.exe
        • Size 71KB
        • SHA256 c9042ab7d96f784ae3ba2993d91a81e86517d8735d309220337ef7f09c4c7861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58B1A7.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58B1A7.exe
        • Size 71KB
        • SHA256 b26b13bda8b3eed59a01d3a66fe8de996938b77b0066f815eedb582de999453c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58C222.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58C222.exe
        • Size 71KB
        • SHA256 eadd73a6c51c173a14b4d01a2f413f002e8476013bb2a37eba1a1fcb22d3139b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58CABD.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58CABD.exe
        • Size 71KB
        • SHA256 b7429436e30d7d8e3487ca58d8cd4f82a35fa8c05efc0848987f3ae92338b99e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58DA4E.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58DA4E.exe
        • Size 71KB
        • SHA256 2f8506078f50aa42cca5cc0a07b5512b86528b87ab446bfb84f60b95b3e917f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58E606.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E606.exe
        • Size 71KB
        • SHA256 b360002bc2ce504b10749837bdb37802e9ae18bd6802ed1a724cd6ae3251b213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E58F5C5.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F5C5.exe
        • Size 71KB
        • SHA256 de96a4a697c727a2c6fae971588987c596a29ce1b11f6b8a0b4807560ae14aac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E59113C.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59113C.exe
        • Size 71KB
        • SHA256 bd9e0cd1b59be679be0d446bcecedf3aa31cc477b09ae2a51ebd5206af4bd86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E591D42.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D42.exe
        • Size 71KB
        • SHA256 82a5b5eb76e1dd17d52ad2979c46ceb197b0d78800d245e55858d4f421f4fe46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E592C85.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592C85.exe
        • Size 71KB
        • SHA256 d3d4aa03c7610c06a1bfe4b05e9d1763579cac2711d993a371f0a5457e8020f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E59481B.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59481B.exe
        • Size 71KB
        • SHA256 d3c06ec7a4f7ad0d286e7421c7394b935f7f1214cbd8aa2e64bac11e7802a7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E595421.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E595421.exe
        • Size 71KB
        • SHA256 f854c3e6dfd6e17902fa1da37e6f4ac919fea3db430aa023a495e2c80144571d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E59797C.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59797C.exe
        • Size 71KB
        • SHA256 30f022e66e9101e8ef36ea92c87af75604161eb6c85f9d2f76b6caef627bc857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msca_0E599263.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599263.exe
        • Size 71KB
        • SHA256 94c969d4a15ab4f5eeb72ea721610a9c2bc9decd2010bc231f605cd3e7409390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2476-20-0x00007FF6B7510000-0x00007FF6B7529000-memory.dmp
        Download

        memory/2792-101-0x00007FF727610000-0x00007FF727629000-memory.dmp
        Download

        memory/3492-48-0x0000000003CA0000-0x0000000003CA1000-memory.dmp
        Download

        memory/3492-96-0x0000000009E90000-0x0000000009F6C000-memory.dmp
        Download

        memory/3492-39-0x0000000009450000-0x000000000952C000-memory.dmp
        Download

        memory/3492-36-0x0000000009370000-0x000000000944C000-memory.dmp
        Download

        memory/3492-38-0x0000000009370000-0x000000000944C000-memory.dmp
        Download

        memory/3492-34-0x0000000009370000-0x000000000944C000-memory.dmp
        Download

        memory/3492-3-0x0000000001240000-0x0000000001241000-memory.dmp
        Download

        memory/3492-37-0x0000000009370000-0x000000000944C000-memory.dmp
        Download

        memory/3492-35-0x0000000009370000-0x000000000944C000-memory.dmp
        Download

        memory/3492-51-0x0000000003A00000-0x0000000003A01000-memory.dmp
        Download

        memory/3492-45-0x0000000003CA0000-0x0000000003CA1000-memory.dmp
        Download

        memory/3492-62-0x00000000098D0000-0x00000000099AC000-memory.dmp
        Download

        memory/3492-64-0x00000000098D0000-0x00000000099AC000-memory.dmp
        Download

        memory/3492-63-0x00000000098D0000-0x00000000099AC000-memory.dmp
        Download

        memory/3492-69-0x0000000009A70000-0x0000000009B4C000-memory.dmp
        Download

        memory/3492-68-0x0000000009A70000-0x0000000009B4C000-memory.dmp
        Download

        memory/3492-67-0x0000000009A70000-0x0000000009B4C000-memory.dmp
        Download

        memory/3492-65-0x0000000009A70000-0x0000000009B4C000-memory.dmp
        Download

        memory/3492-61-0x00000000098D0000-0x00000000099AC000-memory.dmp
        Download

        memory/3492-60-0x00000000098D0000-0x00000000099AC000-memory.dmp
        Download

        memory/3492-5-0x0000000001250000-0x0000000001251000-memory.dmp
        Download

        memory/3492-66-0x0000000009A70000-0x0000000009B4C000-memory.dmp
        Download

        memory/3492-72-0x0000000001230000-0x0000000001231000-memory.dmp
        Download

        memory/3492-0-0x0000000001240000-0x0000000001241000-memory.dmp
        Download

        memory/3492-76-0x0000000003A10000-0x0000000003A11000-memory.dmp
        Download

        memory/3492-79-0x0000000003A10000-0x0000000003A11000-memory.dmp
        Download

        memory/3492-81-0x0000000003A20000-0x0000000003A21000-memory.dmp
        Download

        memory/3492-84-0x0000000003A20000-0x0000000003A21000-memory.dmp
        Download

        memory/3492-95-0x000000000C8D0000-0x000000000C9AC000-memory.dmp
        Download

        memory/3492-42-0x0000000009450000-0x000000000952C000-memory.dmp
        Download

        memory/3492-98-0x000000000C8D0000-0x000000000C9AC000-memory.dmp
        Download

        memory/3492-40-0x0000000009450000-0x000000000952C000-memory.dmp
        Download

        memory/3492-93-0x000000000C8D0000-0x000000000C9AC000-memory.dmp
        Download

        memory/3492-92-0x0000000009E90000-0x0000000009F6C000-memory.dmp
        Download

        memory/3492-90-0x000000000C8D0000-0x000000000C9AC000-memory.dmp
        Download

        memory/3492-97-0x0000000009E90000-0x0000000009F6C000-memory.dmp
        Download

        memory/3492-94-0x0000000009E90000-0x0000000009F6C000-memory.dmp
        Download

        memory/3492-91-0x000000000C8D0000-0x000000000C9AC000-memory.dmp
        Download

        memory/3492-89-0x0000000009E90000-0x0000000009F6C000-memory.dmp
        Download

        memory/3492-103-0x0000000003A40000-0x0000000003A41000-memory.dmp
        Download

        memory/3492-43-0x0000000009450000-0x000000000952C000-memory.dmp
        Download

        memory/3492-41-0x0000000009450000-0x000000000952C000-memory.dmp
        Download

        memory/3492-119-0x000000000DEA0000-0x000000000DF7C000-memory.dmp
        Download

        memory/3492-112-0x000000000DD20000-0x000000000DDFC000-memory.dmp
        Download

        memory/3492-117-0x000000000DEA0000-0x000000000DF7C000-memory.dmp
        Download

        memory/3492-115-0x000000000DD20000-0x000000000DDFC000-memory.dmp
        Download

        memory/3492-113-0x000000000DD20000-0x000000000DDFC000-memory.dmp
        Download

        memory/3492-10-0x0000000008F30000-0x000000000900C000-memory.dmp
        Download

        memory/3492-11-0x0000000008F30000-0x000000000900C000-memory.dmp
        Download

        memory/3492-12-0x0000000008F30000-0x000000000900C000-memory.dmp
        Download

        memory/3492-15-0x0000000009010000-0x00000000090EC000-memory.dmp
        Download

        memory/3492-16-0x0000000009010000-0x00000000090EC000-memory.dmp
        Download

        memory/3492-17-0x0000000009010000-0x00000000090EC000-memory.dmp
        Download

        memory/3492-13-0x0000000008F30000-0x000000000900C000-memory.dmp
        Download

        memory/3492-25-0x0000000003A80000-0x0000000003A81000-memory.dmp
        Download

        memory/3492-19-0x0000000009010000-0x00000000090EC000-memory.dmp
        Download

        memory/3492-21-0x0000000001270000-0x0000000001271000-memory.dmp
        Download

        memory/3492-18-0x0000000009010000-0x00000000090EC000-memory.dmp
        Download

        memory/3492-9-0x0000000008F30000-0x000000000900C000-memory.dmp
        Download

        memory/3492-6-0x00000000088F0000-0x00000000089B9000-memory.dmp
        Download

        memory/5000-44-0x00007FF6B7510000-0x00007FF6B7529000-memory.dmp
        Download

        memory/5388-70-0x00007FF6EA940000-0x00007FF6EA959000-memory.dmp
        Download