727c9b6456e569d5914cee5352df3dbc7cc64bddf3dd8298ed1795f181ca4fc8

Analysis

max time kernel
27s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2023 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6925b5f4124cc2579cc79485df454933_mafia_JC.exe
Size

4.0MB
MD5

6925b5f4124cc2579cc79485df454933
SHA1

3e3f8ef44b713af8a92424abdd105962d26e3980
SHA256

727c9b6456e569d5914cee5352df3dbc7cc64bddf3dd8298ed1795f181ca4fc8
SHA512

7c94563440c309f6ad4ee6e1978d1a316df8d27854d21786d1583d0b6ec19edbe43b4a63fe85757296382e536a9d72ac2a621ae8df3c802318ac7a84fd61d144
SSDEEP

49152:C9yiCJ5rFwnANZGEXep+9TxFegOSDAmosh3ANkTTl37olwiC55mHuynn/wbi7Xq:pJ5rFwnApezgOS9V3AMxewiCmHuyn/b6

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	StartMenuExperienceHost.exe

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	StartMenuExperienceHost.exe
File opened (read-only)	\??\F:	StartMenuExperienceHost.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	StartMenuExperienceHost.exe
File opened (read-only)	\??\D:	StartMenuExperienceHost.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Program crash 49 IoCs

pid	pid_target	Process	procid_target
3772	648	WerFault.exe	90
3840	4268	WerFault.exe	98
4460	856	WerFault.exe	107
4956	4804	WerFault.exe	105
5056	708	WerFault.exe	114
1836	3100	WerFault.exe	121
3968	4988	WerFault.exe	119
3464	4652	WerFault.exe	130
1160	3400	WerFault.exe	128
1748	3004	WerFault.exe	139
1092	3952	WerFault.exe	137
3024	4016	WerFault.exe	148
956	2748	WerFault.exe	146
3576	3732	WerFault.exe	154
3964	2220	WerFault.exe	161
5064	4668	WerFault.exe	159
4768	4604	WerFault.exe	169
1368	2056	WerFault.exe	167
1528	4416	WerFault.exe	175
3604	3908	WerFault.exe	182
2992	4688	WerFault.exe	180
2136	2032	WerFault.exe	188
3588	644	WerFault.exe	196
3968	856	WerFault.exe	194
884	1940	WerFault.exe	204
3948	3268	WerFault.exe	202
3840	4564	WerFault.exe	212
2460	4368	WerFault.exe	210
3408	4136	WerFault.exe	220
3852	4076	WerFault.exe	218
4664	580	WerFault.exe	228
1736	4380	WerFault.exe	226
2164	2228	WerFault.exe	236
4044	1216	WerFault.exe	234
992	4268	WerFault.exe	246
2740	1824	WerFault.exe	243
4836	436	WerFault.exe	256
452	4388	WerFault.exe	254
4352	2008	WerFault.exe	265
2432	2464	WerFault.exe	263
3668	1916	WerFault.exe	274
1836	4444	WerFault.exe	272
684	2604	WerFault.exe	282
3648	580	WerFault.exe	280
2076	4948	WerFault.exe	291
2592	2548	WerFault.exe	289
4172	1520	WerFault.exe	299
4928	4536	WerFault.exe	297
3592	952	WerFault.exe	305

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{E0FD8160-2026-40EF-AB73-C0FBA34A1EC7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{2F9978D5-0194-4C71-BFEB-24C3AE22FDDF}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{FFDE3A56-9371-4791-ACB4-127DA700E3F7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{C95A0823-70AC-4E60-A997-99C52D853C98}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{613AF52F-0EF6-4634-922C-59FB048C7200}	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	648	explorer.exe
Token: SeCreatePagefilePrivilege	648	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4268	explorer.exe
Token: SeCreatePagefilePrivilege	4268	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	explorer.exe
Token: SeCreatePagefilePrivilege	4804	explorer.exe
Token: SeShutdownPrivilege	4804	Process not Found
Token: SeCreatePagefilePrivilege	4804	Process not Found
Token: SeShutdownPrivilege	4804	Process not Found
Token: SeCreatePagefilePrivilege	4804	Process not Found
Token: SeShutdownPrivilege	4804	Process not Found
Token: SeCreatePagefilePrivilege	4804	Process not Found

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
648	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4268	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
4804	Process not Found
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
708	StartMenuExperienceHost.exe
4988	StartMenuExperienceHost.exe
4988	StartMenuExperienceHost.exe
4988	StartMenuExperienceHost.exe
4988	StartMenuExperienceHost.exe
4988	StartMenuExperienceHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3104	StartMenuExperienceHost.exe
1080	StartMenuExperienceHost.exe
4664	StartMenuExperienceHost.exe
856	explorer.exe
4100	StartMenuExperienceHost.exe
3100	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\6925b5f4124cc2579cc79485df454933_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6925b5f4124cc2579cc79485df454933_mafia_JC.exe"
1⤵
PID:3736

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 648 -s 6136
  2⤵
  - Program crash
  PID:3772

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 648 -ip 648
1⤵
PID:1480

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4268 -s 6068
  2⤵
  - Program crash
  PID:3840

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 4268 -ip 4268
1⤵
PID:3492

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4804 -s 7256
  2⤵
  - Program crash
  PID:4956

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 856 -s 3912
  2⤵
  - Program crash
  PID:4460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 856 -ip 856
1⤵
PID:1880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 4804 -ip 4804
1⤵
PID:5104

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 708 -s 5836
  2⤵
  - Program crash
  PID:5056

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 708 -ip 708
1⤵
PID:1036

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4988 -s 3416
  2⤵
  - Program crash
  PID:3968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
PID:3364

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3100 -s 3544
  2⤵
  - Program crash
  PID:1836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 180 -p 3100 -ip 3100
1⤵
PID:1492

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 4988 -ip 4988
1⤵
PID:4612

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
PID:3400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3400 -s 5656
  2⤵
  - Program crash
  PID:1160

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3692

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4652 -s 3572
  2⤵
  - Program crash
  PID:3464

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 4652 -ip 4652
1⤵
PID:3968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 3400 -ip 3400
1⤵
PID:856

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3952 -s 6088
  2⤵
  - Program crash
  PID:1092

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3004 -s 3568
  2⤵
  - Program crash
  PID:1748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 176 -p 3004 -ip 3004
1⤵
PID:3816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 3952 -ip 3952
1⤵
PID:2008

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2748 -s 7372
  2⤵
  - Program crash
  PID:956

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1724

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4016 -s 3564
  2⤵
  - Program crash
  PID:3024

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 4016 -ip 4016
1⤵
PID:3576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 2748 -ip 2748
1⤵
PID:4524

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3732 -s 5912
  2⤵
  - Program crash
  PID:3576

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 584 -p 3732 -ip 3732
1⤵
PID:1940

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4668 -s 4732
  2⤵
  - Program crash
  PID:5064

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:708

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 2692
  2⤵
  - Program crash
  PID:3964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 176 -p 2220 -ip 2220
1⤵
PID:2072

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 4668 -ip 4668
1⤵
PID:4652

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2056 -s 7344
  2⤵
  - Program crash
  PID:1368

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3568

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4604 -s 2556
  2⤵
  - Program crash
  PID:4768

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 4604 -ip 4604
1⤵
PID:2428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 2056 -ip 2056
1⤵
PID:3268

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4416 -s 3448
  2⤵
  - Program crash
  PID:1528

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 176 -p 4416 -ip 4416
1⤵
PID:2156

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4688 -s 6204
  2⤵
  - Program crash
  PID:2992

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3336

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3908 -s 3544
  2⤵
  - Program crash
  PID:3604

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 3908 -ip 3908
1⤵
PID:4500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 4688 -ip 4688
1⤵
PID:4440

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2032 -s 5832
  2⤵
  - Program crash
  PID:2136

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:4988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 2032 -ip 2032
1⤵
PID:3504

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 856 -s 7400
  2⤵
  - Program crash
  PID:3968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1880

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 644 -s 3464
  2⤵
  - Program crash
  PID:3588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 644 -ip 644
1⤵
PID:852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 856 -ip 856
1⤵
PID:3792

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3268 -s 5936
  2⤵
  - Program crash
  PID:3948

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3132

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1940 -s 3556
  2⤵
  - Program crash
  PID:884

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 1940 -ip 1940
1⤵
PID:1300

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 3268 -ip 3268
1⤵
PID:4612

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4368 -s 7292
  2⤵
  - Program crash
  PID:2460

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3312

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4564 -s 3556
  2⤵
  - Program crash
  PID:3840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 4564 -ip 4564
1⤵
PID:3508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4368 -ip 4368
1⤵
PID:2228

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4076 -s 7564
  2⤵
  - Program crash
  PID:3852

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4012

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4136 -s 3596
  2⤵
  - Program crash
  PID:3408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 4136 -ip 4136
1⤵
PID:1300

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 4076 -ip 4076
1⤵
PID:3460

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4380 -s 7292
  2⤵
  - Program crash
  PID:1736

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5108

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 580 -s 3584
  2⤵
  - Program crash
  PID:4664

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 580 -ip 580
1⤵
PID:2184

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4380 -ip 4380
1⤵
PID:1164

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1216 -s 4928
  2⤵
  - Program crash
  PID:4044

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3636

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2228 -s 3572
  2⤵
  - Program crash
  PID:2164

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 2228 -ip 2228
1⤵
PID:3596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 640 -p 1216 -ip 1216
1⤵
PID:1364

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1824 -s 6024
  2⤵
  - Program crash
  PID:2740

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4440

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4268 -s 3608
  2⤵
  - Program crash
  PID:992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 180 -p 4268 -ip 4268
1⤵
PID:116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 1824 -ip 1824
1⤵
PID:4768

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4388 -s 6180
  2⤵
  - Program crash
  PID:452

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1216

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 436 -s 3564
  2⤵
  - Program crash
  PID:4836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 636 -p 436 -ip 436
1⤵
PID:3496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 656 -p 4388 -ip 4388
1⤵
PID:1008

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2464 -s 7456
  2⤵
  - Program crash
  PID:2432

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4688

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 3524
  2⤵
  - Program crash
  PID:4352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 2008 -ip 2008
1⤵
PID:932

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 2464 -ip 2464
1⤵
PID:2216

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4444 -s 5668
  2⤵
  - Program crash
  PID:1836

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1984

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1916 -s 3540
  2⤵
  - Program crash
  PID:3668

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 696 -p 1916 -ip 1916
1⤵
PID:3508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 680 -p 4444 -ip 4444
1⤵
PID:4600

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 580 -s 7904
  2⤵
  - Program crash
  PID:3648

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5064

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2604 -s 3544
  2⤵
  - Program crash
  PID:684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 712 -p 2604 -ip 2604
1⤵
PID:348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 676 -p 580 -ip 580
1⤵
PID:4536

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2548 -s 5856
  2⤵
  - Program crash
  PID:2592

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3904

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4948 -s 3556
  2⤵
  - Program crash
  PID:2076

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 700 -p 4948 -ip 4948
1⤵
PID:2604

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 2548 -ip 2548
1⤵
PID:1836

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4536 -s 3660
  2⤵
  - Program crash
  PID:4928

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1624

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 3556
  2⤵
  - Program crash
  PID:4172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 668 -p 1520 -ip 1520
1⤵
PID:3104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4536 -ip 4536
1⤵
PID:3944

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 952 -s 6032
  2⤵
  - Program crash
  PID:3592

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1476

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 640 -p 952 -ip 952
1⤵
PID:3464

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1520

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
2919b3baf938d2e3ce1bd7df60366ab9

SHA1
d96c472a76ea6a4fe46c905bbd3290d25e72ab90

SHA256
ff4a593993b067379ae88ecc2b0c7ecbe78877de254b1eadf7daa11737c79247

SHA512
005da0a78d6f94299bb16cdefde2222a0a1498acff936bdcf7a44c61bbe9704c256ca511700a846448794307928d2487be3ae0c8a412fa5be5673a20c73fb6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
404B

MD5
674d5f5b1508cc18ec1d2473c1493d5a

SHA1
b776a1cc2a9a85a509644af78a4776153e7815f1

SHA256
dd85649a59bfe1446a488af4333421630be862178d21dc5d636e03f9005569f7

SHA512
b023882382bbe875ff7687b43c6e7030456f21bf400e81a80200a78f99966d004ba7c767b1daf7828d33cd85fec084e3424e549dcfe78c046bdf0ad7b42853ce

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
memory/436-502-0x000001F531690000-0x000001F5316B0000-memory.dmp

Filesize
128KB

Download
memory/436-496-0x000001F5312C0000-0x000001F5312E0000-memory.dmp

Filesize
128KB

Download
memory/436-499-0x000001F531280000-0x000001F5312A0000-memory.dmp

Filesize
128KB

Download
memory/580-427-0x0000022D89740000-0x0000022D89760000-memory.dmp

Filesize
128KB

Download
memory/580-429-0x0000022D89700000-0x0000022D89720000-memory.dmp

Filesize
128KB

Download
memory/580-431-0x0000022D89B00000-0x0000022D89B20000-memory.dmp

Filesize
128KB

Download
memory/644-338-0x0000026EC7120000-0x0000026EC7140000-memory.dmp

Filesize
128KB

Download
memory/644-340-0x0000026EC6DD0000-0x0000026EC6DF0000-memory.dmp

Filesize
128KB

Download
memory/644-342-0x0000026EC74E0000-0x0000026EC7500000-memory.dmp

Filesize
128KB

Download
memory/856-330-0x0000000004600000-0x0000000004601000-memory.dmp

Filesize
4KB

Download
memory/856-148-0x00000184BC9D0000-0x00000184BC9F0000-memory.dmp

Filesize
128KB

Download
memory/856-151-0x00000184BC990000-0x00000184BC9B0000-memory.dmp

Filesize
128KB

Download
memory/856-155-0x00000184BCFA0000-0x00000184BCFC0000-memory.dmp

Filesize
128KB

Download
memory/1216-442-0x0000000004090000-0x0000000004091000-memory.dmp

Filesize
4KB

Download
memory/1824-465-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/1940-368-0x000001DFB9160000-0x000001DFB9180000-memory.dmp

Filesize
128KB

Download
memory/1940-364-0x000001DFB8D20000-0x000001DFB8D40000-memory.dmp

Filesize
128KB

Download
memory/1940-361-0x000001DFB8D60000-0x000001DFB8D80000-memory.dmp

Filesize
128KB

Download
memory/2056-282-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/2220-267-0x0000029849AC0000-0x0000029849AE0000-memory.dmp

Filesize
128KB

Download
memory/2220-273-0x0000029849E90000-0x0000029849EB0000-memory.dmp

Filesize
128KB

Download
memory/2220-270-0x0000029849A80000-0x0000029849AA0000-memory.dmp

Filesize
128KB

Download
memory/2228-450-0x000002916ECC0000-0x000002916ECE0000-memory.dmp

Filesize
128KB

Download
memory/2228-454-0x000002916F2A0000-0x000002916F2C0000-memory.dmp

Filesize
128KB

Download
memory/2228-452-0x000002916EC80000-0x000002916ECA0000-memory.dmp

Filesize
128KB

Download
memory/2748-235-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/3004-223-0x000001E6D4020000-0x000001E6D4040000-memory.dmp

Filesize
128KB

Download
memory/3004-220-0x000001E6D4060000-0x000001E6D4080000-memory.dmp

Filesize
128KB

Download
memory/3004-225-0x000001E6D4430000-0x000001E6D4450000-memory.dmp

Filesize
128KB

Download
memory/3100-175-0x0000029C8C020000-0x0000029C8C040000-memory.dmp

Filesize
128KB

Download
memory/3100-177-0x0000029C8C430000-0x0000029C8C450000-memory.dmp

Filesize
128KB

Download
memory/3100-172-0x0000029C8C060000-0x0000029C8C080000-memory.dmp

Filesize
128KB

Download
memory/3268-353-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/3400-190-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/3908-316-0x000002B96D900000-0x000002B96D920000-memory.dmp

Filesize
128KB

Download
memory/3908-314-0x000002B96D940000-0x000002B96D960000-memory.dmp

Filesize
128KB

Download
memory/3908-318-0x000002B96DD00000-0x000002B96DD20000-memory.dmp

Filesize
128KB

Download
memory/3952-212-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/4016-246-0x0000025F42020000-0x0000025F42040000-memory.dmp

Filesize
128KB

Download
memory/4016-243-0x0000025F42060000-0x0000025F42080000-memory.dmp

Filesize
128KB

Download
memory/4016-250-0x0000025F42430000-0x0000025F42450000-memory.dmp

Filesize
128KB

Download
memory/4076-399-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/4136-411-0x000001C037E80000-0x000001C037EA0000-memory.dmp

Filesize
128KB

Download
memory/4136-407-0x000001C0378B0000-0x000001C0378D0000-memory.dmp

Filesize
128KB

Download
memory/4136-409-0x000001C037870000-0x000001C037890000-memory.dmp

Filesize
128KB

Download
memory/4268-477-0x000001D5A24A0000-0x000001D5A24C0000-memory.dmp

Filesize
128KB

Download
memory/4268-475-0x000001D5A1E90000-0x000001D5A1EB0000-memory.dmp

Filesize
128KB

Download
memory/4268-473-0x000001D5A1ED0000-0x000001D5A1EF0000-memory.dmp

Filesize
128KB

Download
memory/4368-376-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download
memory/4380-419-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download
memory/4388-488-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/4564-391-0x0000026BACA10000-0x0000026BACA30000-memory.dmp

Filesize
128KB

Download
memory/4564-384-0x0000026BAC640000-0x0000026BAC660000-memory.dmp

Filesize
128KB

Download
memory/4564-386-0x0000026BAC600000-0x0000026BAC620000-memory.dmp

Filesize
128KB

Download
memory/4604-294-0x0000023B838C0000-0x0000023B838E0000-memory.dmp

Filesize
128KB

Download
memory/4604-292-0x0000023B832A0000-0x0000023B832C0000-memory.dmp

Filesize
128KB

Download
memory/4604-290-0x0000023B832E0000-0x0000023B83300000-memory.dmp

Filesize
128KB

Download
memory/4652-197-0x00000277A36A0000-0x00000277A36C0000-memory.dmp

Filesize
128KB

Download
memory/4652-200-0x00000277A3660000-0x00000277A3680000-memory.dmp

Filesize
128KB

Download
memory/4652-204-0x00000277A3A70000-0x00000277A3A90000-memory.dmp

Filesize
128KB

Download
memory/4668-260-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/4688-307-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/4804-141-0x0000000004170000-0x0000000004171000-memory.dmp

Filesize
4KB

Download
memory/4988-164-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads