da406f8c1dae24a6fc01e44fe6c1e6b6051c20a621b4670e0f498aa27922f011

Analysis

max time kernel
42s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da406f8c1dae24a6fc01e44fe6c1e6b6051c20a621b4670e0f498aa27922f011.exe
Size

3.1MB
MD5

6f15cc9e67dfe29a549dad137af83bac
SHA1

d7cbd9330efec75e4b092eeea8e6c0bd0118c23d
SHA256

da406f8c1dae24a6fc01e44fe6c1e6b6051c20a621b4670e0f498aa27922f011
SHA512

ec9117ac0f4713e351ecc2a7d8d1f0cbac77a8b4850cd585ae99984809c658cf8a59ff9db65bdb8dbd2df7409f208e435bbdd7413bb49fe0ce7449a858207b63
SSDEEP

49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlbdn89dbMOm:Q+8X9G3vP3AMldngd6

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Program crash 45 IoCs

pid	pid_target	Process	procid_target
5108	4132	WerFault.exe	87
2152	180	WerFault.exe	98
4556	792	WerFault.exe	96
4480	4184	WerFault.exe	107
4772	2844	WerFault.exe	115
552	5032	WerFault.exe	113
468	3748	WerFault.exe	124
5028	4360	WerFault.exe	122
1416	3488	WerFault.exe	132
3516	2788	WerFault.exe	130
1716	3264	WerFault.exe	138
436	4092	WerFault.exe	143
2408	2468	WerFault.exe	150
3656	1568	WerFault.exe	148
4196	1272	WerFault.exe	158
4808	4568	WerFault.exe	156
1564	2152	WerFault.exe	164
2268	4760	WerFault.exe	171
4588	2844	WerFault.exe	169
4668	4940	WerFault.exe	177
880	3968	WerFault.exe	182
4056	4840	WerFault.exe	189
3916	2540	WerFault.exe	187
4136	2144	WerFault.exe	196
392	8	WerFault.exe	203
3808	3436	WerFault.exe	201
436	4912	WerFault.exe	209
1900	4804	WerFault.exe	214
3844	2904	WerFault.exe	221
2024	2896	WerFault.exe	219
3820	3036	WerFault.exe	229
3520	3444	WerFault.exe	227
3828	2240	WerFault.exe	237
2124	1360	WerFault.exe	235
1328	3672	WerFault.exe	243
1680	1940	WerFault.exe	250
3504	320	WerFault.exe	248
4456	4596	WerFault.exe	257
3912	404	WerFault.exe	256
1988	1944	WerFault.exe	262
3968	3796	WerFault.exe	271
4320	3452	WerFault.exe	269
1696	4088	WerFault.exe	279
3060	3768	WerFault.exe	277
1056	208	WerFault.exe	285

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\GPU	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{BDF0798A-BFF4-4CEE-B62F-BEDC772A4494}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{9F2A9F47-DEA1-4E0D-BE4D-BF8832129738}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{FFC766AA-8F2F-4E27-8CED-CC1BF5284698}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{678A6F55-A8E6-43FC-91F8-2F46A8239A7E}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{B7FEA7CF-BE5E-44F1-8648-A86A87D19F88}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	4132	explorer.exe
Token: SeCreatePagefilePrivilege	4132	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	792	explorer.exe
Token: SeCreatePagefilePrivilege	792	explorer.exe
Token: SeShutdownPrivilege	4184	explorer.exe
Token: SeCreatePagefilePrivilege	4184	explorer.exe
Token: SeShutdownPrivilege	4184	explorer.exe
Token: SeCreatePagefilePrivilege	4184	explorer.exe
Token: SeShutdownPrivilege	4184	explorer.exe
Token: SeCreatePagefilePrivilege	4184	explorer.exe
Token: SeShutdownPrivilege	4184	explorer.exe
Token: SeCreatePagefilePrivilege	4184	explorer.exe
Token: SeShutdownPrivilege	4184	explorer.exe
Token: SeCreatePagefilePrivilege	4184	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
792	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
4184	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1280	StartMenuExperienceHost.exe
4960	StartMenuExperienceHost.exe
180	SearchApp.exe
2168	StartMenuExperienceHost.exe
452	StartMenuExperienceHost.exe
2844	explorer.exe
388	StartMenuExperienceHost.exe
3748	SearchApp.exe
2200	StartMenuExperienceHost.exe
3488	Process not Found

C:\Users\Admin\AppData\Local\Temp\da406f8c1dae24a6fc01e44fe6c1e6b6051c20a621b4670e0f498aa27922f011.exe
"C:\Users\Admin\AppData\Local\Temp\da406f8c1dae24a6fc01e44fe6c1e6b6051c20a621b4670e0f498aa27922f011.exe"
1⤵
PID:2672

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4132 -s 6016
  2⤵
  - Program crash
  PID:5108

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4132 -ip 4132
1⤵
PID:1572

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 792 -s 7400
  2⤵
  - Program crash
  PID:4556

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 180 -s 3932
  2⤵
  - Program crash
  PID:2152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 180 -ip 180
1⤵
PID:4916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 792 -ip 792
1⤵
PID:4356

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4184 -s 5804
  2⤵
  - Program crash
  PID:4480

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 4184 -ip 4184
1⤵
PID:4084

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:5032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5032 -s 7360
  2⤵
  - Program crash
  PID:552

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:452

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2844 -s 3520
  2⤵
  - Program crash
  PID:4772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 2844 -ip 2844
1⤵
PID:2256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 5032 -ip 5032
1⤵
PID:3048

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:4360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4360 -s 6184
  2⤵
  - Program crash
  PID:5028

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:388

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3748 -s 3564
  2⤵
  - Program crash
  PID:468

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 3748 -ip 3748
1⤵
PID:4024

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 4360 -ip 4360
1⤵
PID:2528

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:2788
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2788 -s 7576
  2⤵
  - Program crash
  PID:3516

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3488 -s 3568
  2⤵
  - Program crash
  PID:1416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 388 -p 3488 -ip 3488
1⤵
PID:4504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 2788 -ip 2788
1⤵
PID:8

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3264 -s 5944
  2⤵
  - Program crash
  PID:1716

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1276

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 3264 -ip 3264
1⤵
PID:2492

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4092 -s 6208
  2⤵
  - Program crash
  PID:436

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 4092 -ip 4092
1⤵
PID:3768

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1568 -s 2248
  2⤵
  - Program crash
  PID:3656

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2240

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2468
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2468 -s 3588
  2⤵
  - Program crash
  PID:2408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 2468 -ip 2468
1⤵
PID:1672

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 1568 -ip 1568
1⤵
PID:2752

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4568 -s 7388
  2⤵
  - Program crash
  PID:4808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1272 -s 3600
  2⤵
  - Program crash
  PID:4196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 364 -p 1272 -ip 1272
1⤵
PID:1140

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 4568 -ip 4568
1⤵
PID:1824

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 5900
  2⤵
  - Program crash
  PID:1564

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5048

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 2152 -ip 2152
1⤵
PID:4272

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2844 -s 5924
  2⤵
  - Program crash
  PID:4588

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:388

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4760 -s 3580
  2⤵
  - Program crash
  PID:2268

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 4760 -ip 4760
1⤵
PID:4852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 2844 -ip 2844
1⤵
PID:2204

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4940 -s 6100
  2⤵
  - Program crash
  PID:4668

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:792

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4940 -ip 4940
1⤵
PID:4952

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3968 -s 5912
  2⤵
  - Program crash
  PID:880

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 3968 -ip 3968
1⤵
PID:4760

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2540 -s 7476
  2⤵
  - Program crash
  PID:3916

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4464

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4840 -s 3620
  2⤵
  - Program crash
  PID:4056

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 4840 -ip 4840
1⤵
PID:3208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 388 -p 2540 -ip 2540
1⤵
PID:4108

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2144
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2144 -s 4016
  2⤵
  - Program crash
  PID:4136

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4568

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 2144 -ip 2144
1⤵
PID:4552

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3436 -s 3488
  2⤵
  - Program crash
  PID:3808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1368

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 8 -s 3588
  2⤵
  - Program crash
  PID:392

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 8 -ip 8
1⤵
PID:2712

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 3436 -ip 3436
1⤵
PID:1508

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4912 -s 6028
  2⤵
  - Program crash
  PID:436

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1456

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 4912 -ip 4912
1⤵
PID:4404

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4804 -s 5920
  2⤵
  - Program crash
  PID:1900

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 4804 -ip 4804
1⤵
PID:2940

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2896 -s 7532
  2⤵
  - Program crash
  PID:2024

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1368

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2904 -s 3576
  2⤵
  - Program crash
  PID:3844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 2904 -ip 2904
1⤵
PID:3704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 2896 -ip 2896
1⤵
PID:4792

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3444 -s 7412
  2⤵
  - Program crash
  PID:3520

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3508

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3036 -s 3636
  2⤵
  - Program crash
  PID:3820

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 3036 -ip 3036
1⤵
PID:4920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 3444 -ip 3444
1⤵
PID:3580

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1360 -s 5988
  2⤵
  - Program crash
  PID:2124

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2528

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 3604
  2⤵
  - Program crash
  PID:3828

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 2240 -ip 2240
1⤵
PID:1224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 1360 -ip 1360
1⤵
PID:3212

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3672 -s 5824
  2⤵
  - Program crash
  PID:1328

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 3672 -ip 3672
1⤵
PID:3904

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 320 -s 6036
  2⤵
  - Program crash
  PID:3504

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4016

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1940 -s 3492
  2⤵
  - Program crash
  PID:1680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 1940 -ip 1940
1⤵
PID:4952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 320 -ip 320
1⤵
PID:4524

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 404 -s 3936
  2⤵
  - Program crash
  PID:3912

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4596 -s 6040
  2⤵
  - Program crash
  PID:4456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3652

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 4596 -ip 4596
1⤵
PID:3532

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1944 -s 3184
  2⤵
  - Program crash
  PID:1988

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 404 -ip 404
1⤵
PID:4664

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 1944 -ip 1944
1⤵
PID:4580

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3452 -s 3392
  2⤵
  - Program crash
  PID:4320

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1672

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3796 -s 3488
  2⤵
  - Program crash
  PID:3968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 3796 -ip 3796
1⤵
PID:3908

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 3452 -ip 3452
1⤵
PID:4156

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3768 -s 5908
  2⤵
  - Program crash
  PID:3060

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4088 -s 3592
  2⤵
  - Program crash
  PID:1696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 4088 -ip 4088
1⤵
PID:2016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 3768 -ip 3768
1⤵
PID:2844

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 208 -s 6196
  2⤵
  - Program crash
  PID:1056

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 388 -p 208 -ip 208
1⤵
PID:2304

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
a8aa1c60d38c789a67a56dbc3d648f65

SHA1
7e599999f77cff90f3d310d98ba64617ff7bc94b

SHA256
5439433c8562a4ccaa0f46bff247912e496dbcaee4a90e760320c321c067304b

SHA512
9466d8644bb11ad63942ffd43ee1b72241379a48b82e083960f627f32cf40943d209c5744e2eec810147547f853b6d678d88fceffffb74340ea2a9e19568d2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
404B

MD5
8c831abd7d10a328be0dd781f9a54184

SHA1
9cab68e22459fc661c26a34811397ce1564b78ab

SHA256
fffcdc57f70b18f03c7aba1f61c98a3c601d1b9122e1f93a187329ed47d5e31c

SHA512
4c08464e34cad50d47664febe2da0352806528799629570b5cf1e92b75507ccd694a15985ee10ffaad0adf08b277cc38cd36c14d20778702b474e39581228b79

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml

Filesize
97B

MD5
fe944d229104fea0759b99572bfec403

SHA1
70c6bf4e77dd02eacd2858d7f94487ff93b2489d

SHA256
c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

SHA512
ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

Download Submit
memory/8-339-0x0000018B1E6F0000-0x0000018B1E710000-memory.dmp

Filesize
128KB

Download
memory/8-335-0x0000018B1E320000-0x0000018B1E340000-memory.dmp

Filesize
128KB

Download
memory/8-337-0x0000018B1DFE0000-0x0000018B1E000000-memory.dmp

Filesize
128KB

Download
memory/180-154-0x0000019FB6D30000-0x0000019FB6D50000-memory.dmp

Filesize
128KB

Download
memory/180-150-0x0000019FB68E0000-0x0000019FB6900000-memory.dmp

Filesize
128KB

Download
memory/180-147-0x0000019FB6920000-0x0000019FB6940000-memory.dmp

Filesize
128KB

Download
memory/320-422-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/404-466-0x00000245D46F0000-0x00000245D4710000-memory.dmp

Filesize
128KB

Download
memory/404-461-0x00000245D4320000-0x00000245D4340000-memory.dmp

Filesize
128KB

Download
memory/404-464-0x00000245D42E0000-0x00000245D4300000-memory.dmp

Filesize
128KB

Download
memory/792-140-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1272-265-0x0000016AE0D90000-0x0000016AE0DB0000-memory.dmp

Filesize
128KB

Download
memory/1272-267-0x0000016AE0D50000-0x0000016AE0D70000-memory.dmp

Filesize
128KB

Download
memory/1272-269-0x0000016AE1160000-0x0000016AE1180000-memory.dmp

Filesize
128KB

Download
memory/1360-398-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/1568-234-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1940-432-0x0000028674990000-0x00000286749B0000-memory.dmp

Filesize
128KB

Download
memory/1940-435-0x0000028674DA0000-0x0000028674DC0000-memory.dmp

Filesize
128KB

Download
memory/1940-430-0x00000286749D0000-0x00000286749F0000-memory.dmp

Filesize
128KB

Download
memory/1944-451-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/2240-411-0x0000026ECCD90000-0x0000026ECCDB0000-memory.dmp

Filesize
128KB

Download
memory/2240-407-0x0000026ECC980000-0x0000026ECC9A0000-memory.dmp

Filesize
128KB

Download
memory/2240-406-0x0000026ECC9C0000-0x0000026ECC9E0000-memory.dmp

Filesize
128KB

Download
memory/2468-244-0x0000020B1FA80000-0x0000020B1FAA0000-memory.dmp

Filesize
128KB

Download
memory/2468-242-0x0000020B1FAC0000-0x0000020B1FAE0000-memory.dmp

Filesize
128KB

Download
memory/2468-246-0x0000020B1FE90000-0x0000020B1FEB0000-memory.dmp

Filesize
128KB

Download
memory/2540-304-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/2788-209-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/2844-279-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/2844-175-0x0000016AE7440000-0x0000016AE7460000-memory.dmp

Filesize
128KB

Download
memory/2844-173-0x00000162E5E30000-0x00000162E5E50000-memory.dmp

Filesize
128KB

Download
memory/2844-171-0x00000162E5E70000-0x00000162E5E90000-memory.dmp

Filesize
128KB

Download
memory/2896-352-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/2904-360-0x0000026CCF820000-0x0000026CCF840000-memory.dmp

Filesize
128KB

Download
memory/2904-362-0x0000026CCF5E0000-0x0000026CCF600000-memory.dmp

Filesize
128KB

Download
memory/2904-365-0x0000026CCFBF0000-0x0000026CCFC10000-memory.dmp

Filesize
128KB

Download
memory/3036-383-0x00000234FB820000-0x00000234FB840000-memory.dmp

Filesize
128KB

Download
memory/3036-385-0x00000234FB5E0000-0x00000234FB600000-memory.dmp

Filesize
128KB

Download
memory/3036-387-0x00000234FBBF0000-0x00000234FBC10000-memory.dmp

Filesize
128KB

Download
memory/3436-327-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/3444-375-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/3452-481-0x0000000002F90000-0x0000000002F91000-memory.dmp

Filesize
4KB

Download
memory/3488-220-0x000001672E980000-0x000001672E9A0000-memory.dmp

Filesize
128KB

Download
memory/3488-222-0x000001672ED90000-0x000001672EDB0000-memory.dmp

Filesize
128KB

Download
memory/3488-217-0x000001672E9C0000-0x000001672E9E0000-memory.dmp

Filesize
128KB

Download
memory/3748-194-0x0000028B34700000-0x0000028B34720000-memory.dmp

Filesize
128KB

Download
memory/3748-196-0x0000028B343B0000-0x0000028B343D0000-memory.dmp

Filesize
128KB

Download
memory/3748-198-0x0000028B34AC0000-0x0000028B34AE0000-memory.dmp

Filesize
128KB

Download
memory/3768-503-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/3796-490-0x00000287F5C60000-0x00000287F5C80000-memory.dmp

Filesize
128KB

Download
memory/3796-488-0x00000287F5CA0000-0x00000287F5CC0000-memory.dmp

Filesize
128KB

Download
memory/3796-492-0x00000287F6070000-0x00000287F6090000-memory.dmp

Filesize
128KB

Download
memory/4088-514-0x00000250A0D90000-0x00000250A0DB0000-memory.dmp

Filesize
128KB

Download
memory/4088-512-0x00000250A0980000-0x00000250A09A0000-memory.dmp

Filesize
128KB

Download
memory/4088-510-0x00000250A09C0000-0x00000250A09E0000-memory.dmp

Filesize
128KB

Download
memory/4360-186-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/4568-257-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

Filesize
4KB

Download
memory/4760-292-0x0000017BE1C60000-0x0000017BE1C80000-memory.dmp

Filesize
128KB

Download
memory/4760-288-0x0000017BE1650000-0x0000017BE1670000-memory.dmp

Filesize
128KB

Download
memory/4760-286-0x0000017BE1690000-0x0000017BE16B0000-memory.dmp

Filesize
128KB

Download
memory/4840-315-0x000001F9592E0000-0x000001F959300000-memory.dmp

Filesize
128KB

Download
memory/4840-313-0x000001F157BD0000-0x000001F157BF0000-memory.dmp

Filesize
128KB

Download
memory/4840-311-0x000001F157F20000-0x000001F157F40000-memory.dmp

Filesize
128KB

Download
memory/5032-163-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads