267bb6a7bc081806f5a8b5dc43f80a3c4bf0273bfc85197281c4abe097a346b8

Analysis

max time kernel
20s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

267bb6a7bc081806f5a8b5dc43f80a3c4bf0273bfc85197281c4abe097a346b8.exe
Size

3.3MB
MD5

4070650580ae6c8adb62ed2197a60db0
SHA1

508a2b44755932d0229e04a6e3c711320d8692f6
SHA256

267bb6a7bc081806f5a8b5dc43f80a3c4bf0273bfc85197281c4abe097a346b8
SHA512

964fea00cc71d3e7c54874381d455ec32c6a1e4d1794d2f1fac1e10c820531939e4533880f2849b978d35682f5aae1ba9e3f56b013dd75512187eee41c2b8ad8
SSDEEP

49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTl9IxQKfT/9MLrSomDxXWGC:Q+8X9G3vP3AMDohMLrSomDEv

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Program crash 36 IoCs

pid	pid_target	Process	procid_target
4756	4688	WerFault.exe	83
4900	4024	WerFault.exe	90
3404	4008	WerFault.exe	98
4204	2916	WerFault.exe	96
1260	3308	WerFault.exe	109
1572	1340	WerFault.exe	104
1544	1912	WerFault.exe	116
2380	3736	WerFault.exe	119
4240	2272	WerFault.exe	128
1084	224	WerFault.exe	125
1912	3188	WerFault.exe	134
3252	1176	WerFault.exe	138
2332	3148	WerFault.exe	147
3736	1636	WerFault.exe	144
5044	4268	WerFault.exe	156
2924	3904	WerFault.exe	153
3276	3308	WerFault.exe	165
4052	520	WerFault.exe	162
5000	4284	WerFault.exe	171
3384	2864	WerFault.exe	174
2556	3392	WerFault.exe	183
1828	4160	WerFault.exe	180
4548	3520	WerFault.exe	189
2588	940	WerFault.exe	197
2648	3940	WerFault.exe	195
1972	4424	WerFault.exe	203
4384	1432	WerFault.exe	210
3204	3772	WerFault.exe	208
3940	2224	WerFault.exe	218
4444	4168	WerFault.exe	216
4344	3868	WerFault.exe	226
944	1216	WerFault.exe	224
1760	2940	WerFault.exe	234
4584	4112	WerFault.exe	232
4776	2720	WerFault.exe	240
3216	3228	WerFault.exe	242

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\MuiCache	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-642304425-1816607141-2958861556-1000\{BA8E3DC4-1F19-480E-8693-2644064A1247}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-642304425-1816607141-2958861556-1000\{4D9D854E-627F-4BBA-9B54-2A07DA904B43}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-642304425-1816607141-2958861556-1000\{A5719F8E-C2A7-40EE-9BF5-D778E80A557A}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4688	explorer.exe
Token: SeCreatePagefilePrivilege	4688	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	4024	explorer.exe
Token: SeCreatePagefilePrivilege	4024	explorer.exe
Token: SeShutdownPrivilege	2916	explorer.exe
Token: SeCreatePagefilePrivilege	2916	explorer.exe
Token: SeShutdownPrivilege	2916	explorer.exe
Token: SeCreatePagefilePrivilege	2916	explorer.exe
Token: SeShutdownPrivilege	2916	explorer.exe
Token: SeCreatePagefilePrivilege	2916	explorer.exe
Token: SeShutdownPrivilege	2916	explorer.exe
Token: SeCreatePagefilePrivilege	2916	explorer.exe
Token: SeShutdownPrivilege	2916	explorer.exe
Token: SeCreatePagefilePrivilege	2916	explorer.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4688	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
4024	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
852	StartMenuExperienceHost.exe
4160	explorer.exe

C:\Users\Admin\AppData\Local\Temp\267bb6a7bc081806f5a8b5dc43f80a3c4bf0273bfc85197281c4abe097a346b8.exe
"C:\Users\Admin\AppData\Local\Temp\267bb6a7bc081806f5a8b5dc43f80a3c4bf0273bfc85197281c4abe097a346b8.exe"
1⤵
PID:4916

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4688 -s 5864
  2⤵
  - Program crash
  PID:4756

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4688 -ip 4688
1⤵
PID:1236

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4024 -s 5996
  2⤵
  - Program crash
  PID:4900

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 4024 -ip 4024
1⤵
PID:1228

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 7328
  2⤵
  - Program crash
  PID:4204

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4000

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4008 -s 3996
  2⤵
  - Program crash
  PID:3404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4008 -ip 4008
1⤵
PID:3452

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 2916 -ip 2916
1⤵
PID:4864

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1340 -s 7048
  2⤵
  - Program crash
  PID:1572

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1644

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3308 -s 3548
  2⤵
  - Program crash
  PID:1260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 3308 -ip 3308
1⤵
PID:4976

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 1340 -ip 1340
1⤵
PID:3124

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1912 -s 4756
  2⤵
  - Program crash
  PID:1544

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3736 -s 3568
  2⤵
  - Program crash
  PID:2380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 3736 -ip 3736
1⤵
PID:2452

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 1912 -ip 1912
1⤵
PID:972

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 224 -s 7420
  2⤵
  - Program crash
  PID:1084

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4804

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2272 -s 3564
  2⤵
  - Program crash
  PID:4240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 2272 -ip 2272
1⤵
PID:3380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 584 -p 224 -ip 224
1⤵
PID:4124

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3188 -s 7336
  2⤵
  - Program crash
  PID:1912

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3140

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1176
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1176 -s 3584
  2⤵
  - Program crash
  PID:3252

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 592 -p 1176 -ip 1176
1⤵
PID:3204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 3188 -ip 3188
1⤵
PID:4704

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1636 -s 940
  2⤵
  - Program crash
  PID:3736

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3476

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3148 -s 3608
  2⤵
  - Program crash
  PID:2332

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 3148 -ip 3148
1⤵
PID:3196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 1636 -ip 1636
1⤵
PID:2064

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3904 -s 7420
  2⤵
  - Program crash
  PID:2924

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3556

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4268 -s 3564
  2⤵
  - Program crash
  PID:5044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 672 -p 4268 -ip 4268
1⤵
PID:2236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 3904 -ip 3904
1⤵
PID:3144

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 520 -s 7256
  2⤵
  - Program crash
  PID:4052

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2344

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3308 -s 3588
  2⤵
  - Program crash
  PID:3276

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 3308 -ip 3308
1⤵
PID:4464

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 724 -p 520 -ip 520
1⤵
PID:3176

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4284 -s 3884
  2⤵
  - Program crash
  PID:5000

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2864 -s 3592
  2⤵
  - Program crash
  PID:3384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 668 -p 2864 -ip 2864
1⤵
PID:4900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 712 -p 4284 -ip 4284
1⤵
PID:1572

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4160 -s 7340
  2⤵
  - Program crash
  PID:1828

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3480

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3392 -s 3556
  2⤵
  - Program crash
  PID:2556

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 3392 -ip 3392
1⤵
PID:4268

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 4160 -ip 4160
1⤵
PID:1168

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3520 -s 6132
  2⤵
  - Program crash
  PID:4548

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:492

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 676 -p 3520 -ip 3520
1⤵
PID:5092

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3940 -s 7432
  2⤵
  - Program crash
  PID:2648

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1016

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 940 -s 3616
  2⤵
  - Program crash
  PID:2588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 660 -p 940 -ip 940
1⤵
PID:1544

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 728 -p 3940 -ip 3940
1⤵
PID:3000

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4424 -s 6340
  2⤵
  - Program crash
  PID:1972

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 624 -p 4424 -ip 4424
1⤵
PID:2280

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3772 -s 7556
  2⤵
  - Program crash
  PID:3204

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4224

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1432
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1432 -s 3564
  2⤵
  - Program crash
  PID:4384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 664 -p 1432 -ip 1432
1⤵
PID:1724

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 3772 -ip 3772
1⤵
PID:2168

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4168 -s 3320
  2⤵
  - Program crash
  PID:4444

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2072

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 3576
  2⤵
  - Program crash
  PID:3940

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 2224 -ip 2224
1⤵
PID:4088

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 4168 -ip 4168
1⤵
PID:3476

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1216 -s 3476
  2⤵
  - Program crash
  PID:944

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3868 -s 3556
  2⤵
  - Program crash
  PID:4344

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 3868 -ip 3868
1⤵
PID:3540

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 1216 -ip 1216
1⤵
PID:264

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4112 -s 7680
  2⤵
  - Program crash
  PID:4584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:548

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2940 -s 3612
  2⤵
  - Program crash
  PID:1760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 2940 -ip 2940
1⤵
PID:2280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 708 -p 4112 -ip 4112
1⤵
PID:368

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2720 -s 7432
  2⤵
  - Program crash
  PID:4776

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1080

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3228 -s 3568
  2⤵
  - Program crash
  PID:3216

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 3228 -ip 3228
1⤵
PID:3964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 2720 -ip 2720
1⤵
PID:536

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9MMQKADY\microsoft.windows[1].xml

Filesize
97B

MD5
50122c9e0c7ae885ba5a0321fba1de7e

SHA1
71501e981c12fd157110356da7b700c4cb609d21

SHA256
40e6a53b3c08bb8230f98e3c69cbbc9fb9dcedda4f6e19752255844a61b2f809

SHA512
f507b487e9749462e51e71122bd2a64358d63b39666d30f43bbc96d996a16d1573a1a631c55cb91ce27e62c4e04ddc7f7835fc43ff2ffb12260c60b85441ab25

Download Submit
memory/224-71-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/520-163-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/940-237-0x00000143D4EF0000-0x00000143D4F10000-memory.dmp

Filesize
128KB

Download
memory/940-239-0x00000143D4EB0000-0x00000143D4ED0000-memory.dmp

Filesize
128KB

Download
memory/940-241-0x00000143D54C0000-0x00000143D54E0000-memory.dmp

Filesize
128KB

Download
memory/1176-107-0x00000211786E0000-0x0000021178700000-memory.dmp

Filesize
128KB

Download
memory/1176-101-0x0000021178320000-0x0000021178340000-memory.dmp

Filesize
128KB

Download
memory/1176-104-0x0000021177FD0000-0x0000021177FF0000-memory.dmp

Filesize
128KB

Download
memory/1216-299-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/1340-25-0x00000000046F0000-0x00000000046F1000-memory.dmp

Filesize
4KB

Download
memory/1432-261-0x00000215BA9C0000-0x00000215BA9E0000-memory.dmp

Filesize
128KB

Download
memory/1432-264-0x00000215BA980000-0x00000215BA9A0000-memory.dmp

Filesize
128KB

Download
memory/1432-267-0x00000215BAF90000-0x00000215BAFB0000-memory.dmp

Filesize
128KB

Download
memory/1636-116-0x00000000042A0000-0x00000000042A1000-memory.dmp

Filesize
4KB

Download
memory/1912-48-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/2224-284-0x0000022A8D510000-0x0000022A8D530000-memory.dmp

Filesize
128KB

Download
memory/2224-286-0x0000022A8D4D0000-0x0000022A8D4F0000-memory.dmp

Filesize
128KB

Download
memory/2224-289-0x0000022A8DB20000-0x0000022A8DB40000-memory.dmp

Filesize
128KB

Download
memory/2272-83-0x000001D41BE10000-0x000001D41BE30000-memory.dmp

Filesize
128KB

Download
memory/2272-78-0x000001D41BA40000-0x000001D41BA60000-memory.dmp

Filesize
128KB

Download
memory/2272-80-0x000001D41BA00000-0x000001D41BA20000-memory.dmp

Filesize
128KB

Download
memory/2720-339-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/2864-193-0x00000161D1660000-0x00000161D1680000-memory.dmp

Filesize
128KB

Download
memory/2864-197-0x00000161D1AF0000-0x00000161D1B10000-memory.dmp

Filesize
128KB

Download
memory/2864-195-0x00000161D1620000-0x00000161D1640000-memory.dmp

Filesize
128KB

Download
memory/2916-3-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/2940-327-0x0000025971DC0000-0x0000025971DE0000-memory.dmp

Filesize
128KB

Download
memory/2940-331-0x0000025972190000-0x00000259721B0000-memory.dmp

Filesize
128KB

Download
memory/2940-329-0x0000025971D80000-0x0000025971DA0000-memory.dmp

Filesize
128KB

Download
memory/3148-126-0x0000024D054C0000-0x0000024D054E0000-memory.dmp

Filesize
128KB

Download
memory/3148-124-0x0000024D05500000-0x0000024D05520000-memory.dmp

Filesize
128KB

Download
memory/3148-128-0x0000024D05B80000-0x0000024D05BA0000-memory.dmp

Filesize
128KB

Download
memory/3188-94-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/3228-351-0x0000024D65600000-0x0000024D65620000-memory.dmp

Filesize
128KB

Download
memory/3228-353-0x0000024D65A10000-0x0000024D65A30000-memory.dmp

Filesize
128KB

Download
memory/3228-347-0x0000024D65640000-0x0000024D65660000-memory.dmp

Filesize
128KB

Download
memory/3308-170-0x000002413B3A0000-0x000002413B3C0000-memory.dmp

Filesize
128KB

Download
memory/3308-33-0x000002231DED0000-0x000002231DEF0000-memory.dmp

Filesize
128KB

Download
memory/3308-173-0x000002413B360000-0x000002413B380000-memory.dmp

Filesize
128KB

Download
memory/3308-174-0x000002413B770000-0x000002413B790000-memory.dmp

Filesize
128KB

Download
memory/3308-39-0x000002231E4A0000-0x000002231E4C0000-memory.dmp

Filesize
128KB

Download
memory/3308-36-0x000002231DE90000-0x000002231DEB0000-memory.dmp

Filesize
128KB

Download
memory/3392-220-0x000001CCBC9E0000-0x000001CCBCA00000-memory.dmp

Filesize
128KB

Download
memory/3392-217-0x000001CCBC3D0000-0x000001CCBC3F0000-memory.dmp

Filesize
128KB

Download
memory/3392-213-0x000001CCBC620000-0x000001CCBC640000-memory.dmp

Filesize
128KB

Download
memory/3736-62-0x000002288F000000-0x000002288F020000-memory.dmp

Filesize
128KB

Download
memory/3736-58-0x000002288EBB0000-0x000002288EBD0000-memory.dmp

Filesize
128KB

Download
memory/3736-56-0x000002288EBF0000-0x000002288EC10000-memory.dmp

Filesize
128KB

Download
memory/3772-253-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/3868-310-0x000001B933040000-0x000001B933060000-memory.dmp

Filesize
128KB

Download
memory/3868-307-0x000001B933080000-0x000001B9330A0000-memory.dmp

Filesize
128KB

Download
memory/3868-313-0x000001B933020000-0x000001B933040000-memory.dmp

Filesize
128KB

Download
memory/3904-139-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3940-230-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/4008-10-0x000002054AA40000-0x000002054AA60000-memory.dmp

Filesize
128KB

Download
memory/4008-13-0x000002054AA00000-0x000002054AA20000-memory.dmp

Filesize
128KB

Download
memory/4008-16-0x000002054AE10000-0x000002054AE30000-memory.dmp

Filesize
128KB

Download
memory/4112-320-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/4160-206-0x00000000040E0000-0x00000000040E1000-memory.dmp

Filesize
4KB

Download
memory/4168-276-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4268-154-0x00000207161E0000-0x0000020716200000-memory.dmp

Filesize
128KB

Download
memory/4268-147-0x0000020715E20000-0x0000020715E40000-memory.dmp

Filesize
128KB

Download
memory/4268-151-0x0000020715E00000-0x0000020715E20000-memory.dmp

Filesize
128KB

Download
memory/4284-185-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads