Overview

overview

8

Static

static

3

2026-07-01...ti.exe

windows10-2004-x64

8

2026-07-01...ti.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 07:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe
  • Size 71KB
  • Sample260701-jfa87sg12q
  • SHA256 0f44b79a39a57f4284f03e357ba609f9162da145f3f202cc842505523f3ca0ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 41 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Users\Admin\AppData\Local\Temp\2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5868
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Local\Temp\2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5736
        • C:\Windows\system32\PING.EXE
          ping -n 3 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:6972
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Windows\System32\cmd.exe
      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Local\Temp\2026-07-01_ce081ccbe217c02b4c2a5c5f70fbd2ec_cobalt-strike_conti.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\System32\PING.EXE
        ping -n 3 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:7008
  • C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    1⤵
      PID:5084
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58D646.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58D646.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6804
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58D646.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6884
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5816
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E7CB.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E7CB.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E7CB.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:5184
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1668
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F17F.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F17F.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2508
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F17F.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6756
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59041D.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59041D.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6320
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59041D.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2036
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E590D16.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E590D16.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E590D16.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4200
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D90.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D90.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6080
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E591D90.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:6836
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6480
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592948.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592948.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592948.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5924
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6556
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E593946.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E593946.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:7084
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E593946.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1104
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5944A0.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5944A0.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5944A0.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3928
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4764
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59549E.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59549E.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59549E.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3488
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E596027.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E596027.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5428
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E596027.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:6452
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1564
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597006.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597006.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:6696
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597006.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3680
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4420
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597B8F.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597B8F.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2044
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597B8F.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5328
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6844
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E598B3F.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E598B3F.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:6444
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E598B3F.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4716
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6236
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599706.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599706.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:6124
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599706.exe"
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:804
        • C:\Windows\System32\PING.EXE
          ping -n 3 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2892
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59A6D5.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59A6D5.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:6372
      • C:\Windows\System32\cmd.exe
        cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59A6D5.exe"
        2⤵
          PID:5864
          • C:\Windows\System32\PING.EXE
            ping -n 3 127.0.0.1
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5112
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59B2CC.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59B2CC.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:1576
        • C:\Windows\System32\cmd.exe
          cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59B2CC.exe"
          2⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2888
          • C:\Windows\System32\PING.EXE
            ping -n 3 127.0.0.1
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1808
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        1⤵
          PID:840
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59C1FE.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59C1FE.exe
          1⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          PID:1840
          • C:\Windows\System32\cmd.exe
            cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59C1FE.exe"
            2⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4160
            • C:\Windows\System32\PING.EXE
              ping -n 3 127.0.0.1
              3⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:6136
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          1⤵
            PID:6736
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59CDE5.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59CDE5.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            PID:5968
            • C:\Windows\System32\cmd.exe
              cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59CDE5.exe"
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2668
              • C:\Windows\System32\PING.EXE
                ping -n 3 127.0.0.1
                3⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4928
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59DD47.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59DD47.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            PID:6088
            • C:\Windows\System32\cmd.exe
              cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59DD47.exe"
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:6040
              • C:\Windows\System32\PING.EXE
                ping -n 3 127.0.0.1
                3⤵
                • Runs ping.exe
                PID:6016
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59E92D.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59E92D.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            PID:2672
            • C:\Windows\System32\cmd.exe
              cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59E92D.exe"
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:5900
              • C:\Windows\System32\PING.EXE
                ping -n 3 127.0.0.1
                3⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1408
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59F8DD.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59F8DD.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            PID:632
            • C:\Windows\System32\cmd.exe
              cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59F8DD.exe"
              2⤵
                PID:6624
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • Runs ping.exe
                  PID:5404
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A04A5.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A04A5.exe
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:6396
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A04A5.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:6920
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4396
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A1445.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A1445.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:6964
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A1445.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:5752
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:6664
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A202C.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A202C.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:5660
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A202C.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:5604
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:6796
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A2F7D.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A2F7D.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:4828
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A2F7D.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:6640
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:6948
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A3B35.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A3B35.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:3276
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A3B35.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:5724
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • Runs ping.exe
                  PID:1724
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A4B24.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A4B24.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:6880
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A4B24.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:1508
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:6012
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A56AD.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A56AD.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:2360
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A56AD.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4552
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:932
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A66AA.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A66AA.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:6136
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A66AA.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4124
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:6392
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A7224.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A7224.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:1104
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A7224.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:3960
                • C:\Windows\System32\PING.EXE
                  ping -n 3 127.0.0.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:488
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8222.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8222.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:4776
              • C:\Windows\System32\cmd.exe
                cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8222.exe"
                2⤵
                  PID:6828
                  • C:\Windows\System32\PING.EXE
                    ping -n 3 127.0.0.1
                    3⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4156
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8D8C.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8D8C.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:6544
                • C:\Windows\System32\cmd.exe
                  cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8D8C.exe"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:3888
                  • C:\Windows\System32\PING.EXE
                    ping -n 3 127.0.0.1
                    3⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:6896
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AA123.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AA123.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:2996
                • C:\Windows\System32\cmd.exe
                  cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AA123.exe"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:3944
                  • C:\Windows\System32\PING.EXE
                    ping -n 3 127.0.0.1
                    3⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:1972
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AAB45.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AAB45.exe
                1⤵
                • Executes dropped EXE
                PID:3860
                • C:\Windows\System32\cmd.exe
                  cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AAB45.exe"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:4888
                  • C:\Windows\System32\PING.EXE
                    ping -n 3 127.0.0.1
                    3⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:3152
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5ABCAA.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5ABCAA.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:5592
                • C:\Windows\System32\cmd.exe
                  cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5ABCAA.exe"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:3068
                  • C:\Windows\System32\PING.EXE
                    ping -n 3 127.0.0.1
                    3⤵
                    • Runs ping.exe
                    PID:5756
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AC47A.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AC47A.exe
                1⤵
                • Executes dropped EXE
                PID:6816
                • C:\Windows\System32\cmd.exe
                  cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AC47A.exe"
                  2⤵
                    PID:6744
                    • C:\Windows\System32\PING.EXE
                      ping -n 3 127.0.0.1
                      3⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:3028
                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AD802.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AD802.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:5852
                  • C:\Windows\System32\cmd.exe
                    cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AD802.exe"
                    2⤵
                      PID:2320
                      • C:\Windows\System32\PING.EXE
                        ping -n 3 127.0.0.1
                        3⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:5248
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5ADFF1.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5ADFF1.exe
                    1⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    PID:2856
                    • C:\Windows\System32\cmd.exe
                      cmd /c ping -n 3 127.0.0.1 >nul && del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5ADFF1.exe"
                      2⤵
                        PID:2684
                        • C:\Windows\System32\PING.EXE
                          ping -n 3 127.0.0.1
                          3⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:3392
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AF36A.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AF36A.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2604
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AFB49.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5AFB49.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2776

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          msca_0E58D646.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58D646.exe
                          • Size 71KB
                          • SHA256 881b3c63f857414e69b76f0518d76ee4b97ac36d3e3c16cc5e6f17fc7ddd9a00
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E58E7CB.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58E7CB.exe
                          • Size 71KB
                          • SHA256 cff6d350d3730590f0df8af4969fe05f06de5eea1517af123a8f978012f6744a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E58F17F.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E58F17F.exe
                          • Size 71KB
                          • SHA256 00e2a0ebcf09743e6285321039543059b62bcb5b6db7d880c2e3ed66d9104586
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59041D.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59041D.exe
                          • Size 71KB
                          • SHA256 d452ed666ade4a06f32c26b7be9f4a9c4f3ee00bde7a6e0b10ee445429208068
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E590D16.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E590D16.exe
                          • Size 71KB
                          • SHA256 57afcb2a1c92642e8a85470fdcc105fc75ac5bc4107a68e5c7c99fd072e9aeee
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E592948.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E592948.exe
                          • Size 71KB
                          • SHA256 28e0d104f3f3e4ae1b0c3dbe5e000db25b8beef21e8500715db2ca88fb984bc1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E593946.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E593946.exe
                          • Size 71KB
                          • SHA256 0f44b79a39a57f4284f03e357ba609f9162da145f3f202cc842505523f3ca0ea
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5944A0.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5944A0.exe
                          • Size 71KB
                          • SHA256 d8c305701828292c41690db5a635d7a4d3ddfff4c9b6dcd9e7c8d9d713324692
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59549E.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59549E.exe
                          • Size 71KB
                          • SHA256 4d8a511b5bead4e7770054a5a8f8e0c0aa9b4d9519a04d4ba09896f82d463b5a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E596027.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E596027.exe
                          • Size 71KB
                          • SHA256 40b897276b605a1faf3f741472e3c55a7adada21b221edd6468bdba5561fecc4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E597006.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597006.exe
                          • Size 71KB
                          • SHA256 918fd1c4bc8c8ae463a0363babf59b8fcfde67d25cabe8c93b0f60cd90a32597
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E597B8F.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E597B8F.exe
                          • Size 71KB
                          • SHA256 d92b32dcad66a432fa9083cdc3acc4fdd9a16f367df977466f739d7b93b44c44
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E598B3F.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E598B3F.exe
                          • Size 71KB
                          • SHA256 dd0b59d9fd06b3023d6265564c507456c55f0beb2c73060a7685474e06154204
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E599706.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E599706.exe
                          • Size 71KB
                          • SHA256 803227487dd064da86a4772c10373881f87cef3a8289e3188be7e2ecc6a27b24
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59A6D5.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59A6D5.exe
                          • Size 71KB
                          • SHA256 053aaf290f2c4c74dd5890cf8cefb6da3fb9734d2046f7320b6548fcac398cc5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59B2CC.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59B2CC.exe
                          • Size 71KB
                          • SHA256 89c2c9d9d566e04346b78307bc1719f5e09827778449142fc6e592bcc6280e48
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59C1FE.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59C1FE.exe
                          • Size 71KB
                          • SHA256 94c969d4a15ab4f5eeb72ea721610a9c2bc9decd2010bc231f605cd3e7409390
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59CDE5.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59CDE5.exe
                          • Size 71KB
                          • SHA256 83e1c8460d6571c272166917c261c40ac7328b8ea1c6b6d867614ccf623de203
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59E92D.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59E92D.exe
                          • Size 71KB
                          • SHA256 ed078ec743b57e1cc30bd3293258c1358853df9c7d461e838df8044fa4f002c7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E59F8DD.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E59F8DD.exe
                          • Size 71KB
                          • SHA256 60d7425976d676d3803546cd2e3b3444adceadd3641fc6a115388588fbb2053b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A04A5.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A04A5.exe
                          • Size 71KB
                          • SHA256 e3e1ec95f3a81f61279cbd91c0c26e5f8a0f4649d516b0f0d8aee96200a8efd4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A1445.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A1445.exe
                          • Size 71KB
                          • SHA256 cf8e3847cab716bd17832e17e38608124f2d3c82a40dca7c3d0630f7fbbe8075
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A202C.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A202C.exe
                          • Size 71KB
                          • SHA256 94aceb2a4ae553756e8d5cd838912fb1d5b391363de34ca6467e7ea1d08d42d3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A2F7D.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A2F7D.exe
                          • Size 71KB
                          • SHA256 687d42a6fdf9d437c84047d5edf22e6db2cb572e0b185afb99569c173b975b66
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A3B35.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A3B35.exe
                          • Size 71KB
                          • SHA256 de9e3385651a6f78b7c477e210bb167bbebddbe4b23f500a0604a1f9b74963ae
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A4B24.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A4B24.exe
                          • Size 71KB
                          • SHA256 6f1f56016cf2e045d7cbf992cc392f4172d8e99d7a5e8fbf527d73873b545665
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A56AD.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A56AD.exe
                          • Size 71KB
                          • SHA256 1f034f8476e0c0e5a9a3e0663c6913c98c64bb6ad46d7c35bda324f8e0718f18
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A66AA.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A66AA.exe
                          • Size 71KB
                          • SHA256 c3fdf1ec6a08643860546cc626279f285550d7c22b9fbd15b8f0a097683cca73
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A7224.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A7224.exe
                          • Size 71KB
                          • SHA256 d02d9644976d0b0676fb10fdf8f3f6f7e09b37f0443d62644cc3e00a1d0358a9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A8222.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8222.exe
                          • Size 71KB
                          • SHA256 b24ed1a8a838d43805405cb9c98292c54fb5a7f8fa2defd1b03f591d4d452a5c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          msca_0E5A8D8C.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\msca_0E5A8D8C.exe
                          • Size 71KB
                          • SHA256 bc965ffa6077aa4f482deeb15c9440da245efd853cb7ccad2304951fe163e72f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/2800-49-0x00007FF755AB0000-0x00007FF755AC9000-memory.dmp
                          Download

                          memory/3704-44-0x0000000008A40000-0x0000000008B1C000-memory.dmp
                          Download

                          memory/3704-121-0x00000000097D0000-0x00000000098AC000-memory.dmp
                          Download

                          memory/3704-69-0x0000000008ED0000-0x0000000008FAC000-memory.dmp
                          Download

                          memory/3704-66-0x0000000008ED0000-0x0000000008FAC000-memory.dmp
                          Download

                          memory/3704-67-0x0000000008ED0000-0x0000000008FAC000-memory.dmp
                          Download

                          memory/3704-64-0x0000000008DF0000-0x0000000008ECC000-memory.dmp
                          Download

                          memory/3704-60-0x0000000008DF0000-0x0000000008ECC000-memory.dmp
                          Download

                          memory/3704-68-0x0000000008ED0000-0x0000000008FAC000-memory.dmp
                          Download

                          memory/3704-65-0x0000000008ED0000-0x0000000008FAC000-memory.dmp
                          Download

                          memory/3704-63-0x0000000008DF0000-0x0000000008ECC000-memory.dmp
                          Download

                          memory/3704-62-0x0000000008DF0000-0x0000000008ECC000-memory.dmp
                          Download

                          memory/3704-61-0x0000000008DF0000-0x0000000008ECC000-memory.dmp
                          Download

                          memory/3704-72-0x0000000003430000-0x0000000003431000-memory.dmp
                          Download

                          memory/3704-51-0x0000000003410000-0x0000000003411000-memory.dmp
                          Download

                          memory/3704-76-0x0000000003420000-0x0000000003421000-memory.dmp
                          Download

                          memory/3704-79-0x0000000003420000-0x0000000003421000-memory.dmp
                          Download

                          memory/3704-81-0x0000000003440000-0x0000000003441000-memory.dmp
                          Download

                          memory/3704-84-0x0000000003440000-0x0000000003441000-memory.dmp
                          Download

                          memory/3704-96-0x0000000009290000-0x000000000936C000-memory.dmp
                          Download

                          memory/3704-98-0x0000000009290000-0x000000000936C000-memory.dmp
                          Download

                          memory/3704-97-0x0000000009460000-0x000000000953C000-memory.dmp
                          Download

                          memory/3704-94-0x0000000009290000-0x000000000936C000-memory.dmp
                          Download

                          memory/3704-95-0x0000000009460000-0x000000000953C000-memory.dmp
                          Download

                          memory/3704-93-0x0000000009460000-0x000000000953C000-memory.dmp
                          Download

                          memory/3704-90-0x0000000009290000-0x000000000936C000-memory.dmp
                          Download

                          memory/3704-91-0x0000000009460000-0x000000000953C000-memory.dmp
                          Download

                          memory/3704-3-0x0000000000C50000-0x0000000000C51000-memory.dmp
                          Download

                          memory/3704-99-0x0000000009460000-0x000000000953C000-memory.dmp
                          Download

                          memory/3704-92-0x0000000009290000-0x000000000936C000-memory.dmp
                          Download

                          memory/3704-103-0x0000000003460000-0x0000000003461000-memory.dmp
                          Download

                          memory/3704-38-0x0000000008A40000-0x0000000008B1C000-memory.dmp
                          Download

                          memory/3704-5-0x0000000000C60000-0x0000000000C61000-memory.dmp
                          Download

                          memory/3704-119-0x00000000097D0000-0x00000000098AC000-memory.dmp
                          Download

                          memory/3704-116-0x0000000009610000-0x00000000096EC000-memory.dmp
                          Download

                          memory/3704-115-0x0000000009610000-0x00000000096EC000-memory.dmp
                          Download

                          memory/3704-112-0x0000000009610000-0x00000000096EC000-memory.dmp
                          Download

                          memory/3704-39-0x0000000008B20000-0x0000000008BFC000-memory.dmp
                          Download

                          memory/3704-43-0x0000000008B20000-0x0000000008BFC000-memory.dmp
                          Download

                          memory/3704-41-0x0000000008B20000-0x0000000008BFC000-memory.dmp
                          Download

                          memory/3704-40-0x0000000008A40000-0x0000000008B1C000-memory.dmp
                          Download

                          memory/3704-42-0x0000000008A40000-0x0000000008B1C000-memory.dmp
                          Download

                          memory/3704-45-0x0000000008B20000-0x0000000008BFC000-memory.dmp
                          Download

                          memory/3704-0-0x0000000000C50000-0x0000000000C51000-memory.dmp
                          Download

                          memory/3704-47-0x0000000008A40000-0x0000000008B1C000-memory.dmp
                          Download

                          memory/3704-46-0x0000000008B20000-0x0000000008BFC000-memory.dmp
                          Download

                          memory/3704-33-0x0000000003510000-0x0000000003511000-memory.dmp
                          Download

                          memory/3704-30-0x0000000003510000-0x0000000003511000-memory.dmp
                          Download

                          memory/3704-28-0x0000000000C40000-0x0000000000C41000-memory.dmp
                          Download

                          memory/3704-21-0x00000000032E0000-0x00000000032E1000-memory.dmp
                          Download

                          memory/3704-19-0x00000000084F0000-0x00000000085CC000-memory.dmp
                          Download

                          memory/3704-12-0x00000000084F0000-0x00000000085CC000-memory.dmp
                          Download

                          memory/3704-13-0x00000000085D0000-0x00000000086AC000-memory.dmp
                          Download

                          memory/3704-14-0x00000000085D0000-0x00000000086AC000-memory.dmp
                          Download

                          memory/3704-20-0x00000000084F0000-0x00000000085CC000-memory.dmp
                          Download

                          memory/3704-17-0x00000000085D0000-0x00000000086AC000-memory.dmp
                          Download

                          memory/3704-11-0x00000000084F0000-0x00000000085CC000-memory.dmp
                          Download

                          memory/3704-10-0x00000000084F0000-0x00000000085CC000-memory.dmp
                          Download

                          memory/3704-15-0x00000000085D0000-0x00000000086AC000-memory.dmp
                          Download

                          memory/3704-16-0x00000000085D0000-0x00000000086AC000-memory.dmp
                          Download

                          memory/3704-7-0x0000000007800000-0x00000000078C9000-memory.dmp
                          Download

                          memory/4300-101-0x00007FF68EF20000-0x00007FF68EF39000-memory.dmp
                          Download

                          memory/5868-18-0x00007FF755AB0000-0x00007FF755AC9000-memory.dmp
                          Download

                          memory/6804-70-0x00007FF7ABAD0000-0x00007FF7ABAE9000-memory.dmp
                          Download