4b038d0b8346c2298b41efae66ac0cb52257ea39e97ba4514dfba623e9d4ee6f

Analysis

max time kernel
22s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b038d0b8346c2298b41efae66ac0cb52257ea39e97ba4514dfba623e9d4ee6f.exe
Size

2.8MB
MD5

92506027c704a473d8f7d4c73e5bfc09
SHA1

e492ad63b0cd92ff0c43a44e7b86cbe0c1adfc24
SHA256

4b038d0b8346c2298b41efae66ac0cb52257ea39e97ba4514dfba623e9d4ee6f
SHA512

2fc96d9f51b91949e18ea24a35f48dc81648e9e24cf4edd132cc8df338594123648c301a5698d5e59067a034758c64c22fb55385de78b9b024c69bcd906fb13f
SSDEEP

49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlpl43veWjPUOG:c+8X9G3vP3AMfW3GkPZG

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	StartMenuExperienceHost.exe

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	StartMenuExperienceHost.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	StartMenuExperienceHost.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Program crash 52 IoCs

pid	pid_target	Process	procid_target
4384	3640	WerFault.exe	87
3976	4856	WerFault.exe	95
3948	4764	WerFault.exe	104
1488	3592	WerFault.exe	102
3284	1408	WerFault.exe	111
2800	3188	WerFault.exe	118
2792	1964	WerFault.exe	116
3824	4700	WerFault.exe	124
3312	1924	WerFault.exe	131
4784	4148	WerFault.exe	129
3292	4548	WerFault.exe	138
3848	4952	WerFault.exe	145
4432	1924	WerFault.exe	143
3180	4680	WerFault.exe	151
4880	3780	WerFault.exe	158
4448	2240	WerFault.exe	156
2160	5056	WerFault.exe	166
2888	2132	WerFault.exe	164
3776	3640	WerFault.exe	172
4960	2208	WerFault.exe	179
3776	2196	WerFault.exe	177
2524	4944	WerFault.exe	185
2060	3396	WerFault.exe	192
2752	3168	WerFault.exe	190
1880	540	WerFault.exe	200
1468	4440	WerFault.exe	198
3376	3920	WerFault.exe	208
3368	3220	WerFault.exe	206
3088	2808	WerFault.exe	214
3704	1040	WerFault.exe	221
4600	3356	WerFault.exe	219
1856	2196	WerFault.exe	229
4868	4864	WerFault.exe	227
1696	3352	WerFault.exe	238
3768	1308	WerFault.exe	236
3228	4036	WerFault.exe	246
4888	3312	WerFault.exe	244
3064	2128	WerFault.exe	252
1992	2252	WerFault.exe	259
3960	3924	WerFault.exe	257
2204	5092	WerFault.exe	267
4680	4532	WerFault.exe	265
2240	4088	WerFault.exe	273
4352	840	WerFault.exe	280
4288	1504	WerFault.exe	278
5048	4860	WerFault.exe	287
1304	4972	WerFault.exe	286
4696	832	WerFault.exe	296
3396	4900	WerFault.exe	294
1092	388	WerFault.exe	302
2356	2160	WerFault.exe	309
3292	3448	WerFault.exe	307

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{C5F2E956-1C85-450D-8EB0-E860537111AC}	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{6D914D88-45ED-4D76-BFB3-AE6C2CAF1B76}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{1FE792CF-32C2-41ED-8294-3356AB41C8F1}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WerFault.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	4856	explorer.exe
Token: SeCreatePagefilePrivilege	4856	explorer.exe
Token: SeShutdownPrivilege	3592	explorer.exe
Token: SeCreatePagefilePrivilege	3592	explorer.exe
Token: SeShutdownPrivilege	3592	explorer.exe
Token: SeCreatePagefilePrivilege	3592	explorer.exe
Token: SeShutdownPrivilege	3592	explorer.exe
Token: SeCreatePagefilePrivilege	3592	explorer.exe
Token: SeShutdownPrivilege	3592	explorer.exe
Token: SeCreatePagefilePrivilege	3592	explorer.exe
Token: SeShutdownPrivilege	3592	explorer.exe
Token: SeCreatePagefilePrivilege	3592	explorer.exe
Token: SeShutdownPrivilege	3592	WerFault.exe
Token: SeCreatePagefilePrivilege	3592	WerFault.exe
Token: SeShutdownPrivilege	3592	WerFault.exe
Token: SeCreatePagefilePrivilege	3592	WerFault.exe
Token: SeShutdownPrivilege	3592	WerFault.exe
Token: SeCreatePagefilePrivilege	3592	WerFault.exe
Token: SeShutdownPrivilege	3592	WerFault.exe
Token: SeCreatePagefilePrivilege	3592	WerFault.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
4856	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	explorer.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
3592	WerFault.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1408	StartMenuExperienceHost.exe
1964	explorer.exe
1964	explorer.exe
1964	explorer.exe
1964	explorer.exe
1964	explorer.exe
1964	explorer.exe
1964	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1372	StartMenuExperienceHost.exe
1536	StartMenuExperienceHost.exe
756	Process not Found
4764	Process not Found
2576	StartMenuExperienceHost.exe
3008	StartMenuExperienceHost.exe
3188	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\4b038d0b8346c2298b41efae66ac0cb52257ea39e97ba4514dfba623e9d4ee6f.exe
"C:\Users\Admin\AppData\Local\Temp\4b038d0b8346c2298b41efae66ac0cb52257ea39e97ba4514dfba623e9d4ee6f.exe"
1⤵
PID:1740

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3640 -s 6152
  2⤵
  - Program crash
  PID:4384

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 3640 -ip 3640
1⤵
PID:4104

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4856 -s 5924
  2⤵
  - Program crash
  PID:3976

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 4856 -ip 4856
1⤵
PID:3356

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3592 -s 4236
  2⤵
  - Program crash
  PID:1488

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:756

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4764 -s 3988
  2⤵
  - Program crash
  PID:3948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 4764 -ip 4764
1⤵
PID:2228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 3592 -ip 3592
1⤵
PID:4048

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1408 -s 5840
  2⤵
  - Program crash
  PID:3284

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 1408 -ip 1408
1⤵
PID:4628

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 7504
  2⤵
  - Program crash
  PID:2792

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3188 -s 2548
  2⤵
  - Program crash
  PID:2800

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 3188 -ip 3188
1⤵
PID:4480

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 1964 -ip 1964
1⤵
PID:4740

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4700 -s 6040
  2⤵
  - Program crash
  PID:3824

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4700 -ip 4700
1⤵
PID:3328

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4148 -s 3640
  2⤵
  - Program crash
  PID:4784

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3384

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 3548
  2⤵
  - Program crash
  PID:3312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 1924 -ip 1924
1⤵
PID:3196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 4148 -ip 4148
1⤵
PID:4532

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4548 -s 5860
  2⤵
  - Program crash
  PID:3292

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 4548 -ip 4548
1⤵
PID:4956

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 3432
  2⤵
  - Program crash
  PID:4432

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3952

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4952 -s 3560
  2⤵
  - Program crash
  PID:3848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4952 -ip 4952
1⤵
PID:1408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 1924 -ip 1924
1⤵
PID:1516

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4680 -s 5932
  2⤵
  - Program crash
  PID:3180

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 4680 -ip 4680
1⤵
PID:1688

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 7336
  2⤵
  - Program crash
  PID:4448

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3748

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3780 -s 3580
  2⤵
  - Program crash
  PID:4880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 3780 -ip 3780
1⤵
PID:1428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 2240 -ip 2240
1⤵
PID:3976

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2132 -s 4480
  2⤵
  - Program crash
  PID:2888

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:1408

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5056 -s 3500
  2⤵
  - Program crash
  PID:2160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 5056 -ip 5056
1⤵
PID:3952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 2132 -ip 2132
1⤵
PID:1364

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3640 -s 5948
  2⤵
  - Program crash
  PID:3776

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 3640 -ip 3640
1⤵
PID:3804

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 7400
  2⤵
  - Program crash
  PID:3776

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 3604
  2⤵
  - Program crash
  PID:4960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 2208 -ip 2208
1⤵
PID:3340

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 2196 -ip 2196
1⤵
PID:1336

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4944 -s 6040
  2⤵
  - Program crash
  PID:2524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4052

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 4944 -ip 4944
1⤵
PID:4936

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3168 -s 5708
  2⤵
  - Program crash
  PID:2752

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3252

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3396 -s 3592
  2⤵
  - Program crash
  PID:2060

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 3396 -ip 3396
1⤵
PID:2244

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 3168 -ip 3168
1⤵
PID:3140

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4440
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4440 -s 5940
  2⤵
  - Program crash
  PID:1468

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3596

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 540 -s 3568
  2⤵
  - Program crash
  PID:1880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 540 -ip 540
1⤵
PID:4500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 4440 -ip 4440
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3592

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3220 -s 7356
  2⤵
  - Program crash
  PID:3368

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3920
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3920 -s 3584
  2⤵
  - Program crash
  PID:3376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 3920 -ip 3920
1⤵
PID:4936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 3220 -ip 3220
1⤵
PID:3748

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2808 -s 6012
  2⤵
  - Program crash
  PID:3088

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 2808 -ip 2808
1⤵
PID:4600

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3356 -s 5072
  2⤵
  - Program crash
  PID:4600

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2804

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1040 -s 3620
  2⤵
  - Program crash
  PID:3704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 1040 -ip 1040
1⤵
PID:4808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3356 -ip 3356
1⤵
PID:4940

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4864 -s 7400
  2⤵
  - Program crash
  PID:4868

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4116

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 2940
  2⤵
  - Program crash
  PID:1856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 2196 -ip 2196
1⤵
PID:2384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 4864 -ip 4864
1⤵
PID:3160

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1308 -s 7332
  2⤵
  - Program crash
  PID:3768

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2584

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3352 -s 3552
  2⤵
  - Program crash
  PID:1696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 3352 -ip 3352
1⤵
PID:3344

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 1308 -ip 1308
1⤵
PID:4248

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3312 -s 4124
  2⤵
  - Program crash
  PID:4888

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:748

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4036 -s 3592
  2⤵
  - Program crash
  PID:3228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 4036 -ip 4036
1⤵
PID:3876

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 3312 -ip 3312
1⤵
PID:3536

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 6116
  2⤵
  - Program crash
  PID:3064

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 2128 -ip 2128
1⤵
PID:2396

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3924 -s 5732
  2⤵
  - Program crash
  PID:3960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3228

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 3580
  2⤵
  - Program crash
  PID:1992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 2252 -ip 2252
1⤵
PID:3420

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 3924 -ip 3924
1⤵
PID:3352

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4532
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4532 -s 7272
  2⤵
  - Program crash
  PID:4680

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4292

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5092 -s 3600
  2⤵
  - Program crash
  PID:2204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 5092 -ip 5092
1⤵
PID:3312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 4532 -ip 4532
1⤵
PID:948

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4088 -s 6024
  2⤵
  - Program crash
  PID:2240

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 4088 -ip 4088
1⤵
PID:4664

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1504 -s 7604
  2⤵
  - Program crash
  PID:4288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4400

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 840 -s 3576
  2⤵
  - Program crash
  PID:4352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 840 -ip 840
1⤵
PID:4148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 584 -p 1504 -ip 1504
1⤵
PID:3392

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4972 -s 7336
  2⤵
  - Program crash
  PID:1304

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4860 -s 3944
  2⤵
  - Program crash
  PID:5048

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 4860 -ip 4860
1⤵
PID:4540

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 4972 -ip 4972
1⤵
PID:3936

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4900 -s 5720
  2⤵
  - Program crash
  PID:3396

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2396

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 832 -s 3592
  2⤵
  - Program crash
  PID:4696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 832 -ip 832
1⤵
PID:3560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 4900 -ip 4900
1⤵
PID:3360

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 388 -s 4984
  2⤵
  - Program crash
  PID:1092

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 388 -ip 388
1⤵
PID:3384

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3448 -s 6076
  2⤵
  - Program crash
  PID:3292

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3440

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2160 -s 3596
  2⤵
  - Program crash
  PID:2356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 2160 -ip 2160
1⤵
PID:2788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 3448 -ip 3448
1⤵
PID:2892

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
516581c13994c7610e9baf3be548909b

SHA1
21e0edb2993d6764cf5e292511089565ae3445f0

SHA256
a77ac4115bf539d2979d13b895b2a3e2a307fdaef7a8217ea0d3e630481b3d02

SHA512
2fe3dade9175f4481f6e9d003a3dd39e63f7789936032a7fda4750bc14cb57563712e1053992928414c3ce3618876e86d5f2b2650599e2e612e383b960ba6708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
404B

MD5
4a16dce1b0dea8828d0dfbd527dadfa3

SHA1
783eefc16c7f46160dbfb840b5dd7f5de9731813

SHA256
a2d279bf974adebe40d713ae4cd8bcb6a8015c56d051e6034e9aaa1446662b17

SHA512
6e846e8d93a39ffe026056b8cf3aff6b882dfd834ee5269cebee2d6cf8f1ab4aff1e249f9b349d7a167bd3d1fbcaa811e10511e618c577eb583d3ddd120ce951

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
memory/540-207-0x0000016586B80000-0x0000016586BA0000-memory.dmp

Filesize
128KB

Download
memory/540-205-0x0000016586BC0000-0x0000016586BE0000-memory.dmp

Filesize
128KB

Download
memory/540-209-0x0000016586F90000-0x0000016586FB0000-memory.dmp

Filesize
128KB

Download
memory/1040-256-0x000001FA6BC60000-0x000001FA6BC80000-memory.dmp

Filesize
128KB

Download
memory/1040-252-0x000001FA6B690000-0x000001FA6B6B0000-memory.dmp

Filesize
128KB

Download
memory/1040-254-0x000001FA6B650000-0x000001FA6B670000-memory.dmp

Filesize
128KB

Download
memory/1308-291-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/1924-66-0x000001C6FCA20000-0x000001C6FCA40000-memory.dmp

Filesize
128KB

Download
memory/1924-68-0x000001C6FCE30000-0x000001C6FCE50000-memory.dmp

Filesize
128KB

Download
memory/1924-79-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/1924-63-0x000001C6FCA60000-0x000001C6FCA80000-memory.dmp

Filesize
128KB

Download
memory/1964-31-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/2132-127-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/2196-275-0x000001DA77070000-0x000001DA77090000-memory.dmp

Filesize
128KB

Download
memory/2196-280-0x000001DA77440000-0x000001DA77460000-memory.dmp

Filesize
128KB

Download
memory/2196-277-0x000001DA77030000-0x000001DA77050000-memory.dmp

Filesize
128KB

Download
memory/2196-150-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/2208-158-0x000002A7BA700000-0x000002A7BA720000-memory.dmp

Filesize
128KB

Download
memory/2208-162-0x000002A7BACE0000-0x000002A7BAD00000-memory.dmp

Filesize
128KB

Download
memory/2208-160-0x000002A7BA6C0000-0x000002A7BA6E0000-memory.dmp

Filesize
128KB

Download
memory/2240-103-0x00000000049E0000-0x00000000049E1000-memory.dmp

Filesize
4KB

Download
memory/2252-348-0x00000178542A0000-0x00000178542C0000-memory.dmp

Filesize
128KB

Download
memory/2252-342-0x0000017853CC0000-0x0000017853CE0000-memory.dmp

Filesize
128KB

Download
memory/2252-344-0x0000017853C80000-0x0000017853CA0000-memory.dmp

Filesize
128KB

Download
memory/3168-174-0x0000000004210000-0x0000000004211000-memory.dmp

Filesize
4KB

Download
memory/3188-41-0x000002B373B70000-0x000002B373B90000-memory.dmp

Filesize
128KB

Download
memory/3188-39-0x000002B373BB0000-0x000002B373BD0000-memory.dmp

Filesize
128KB

Download
memory/3188-43-0x000002B373F80000-0x000002B373FA0000-memory.dmp

Filesize
128KB

Download
memory/3220-220-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/3312-313-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/3352-298-0x00000292056D0000-0x00000292056F0000-memory.dmp

Filesize
128KB

Download
memory/3352-301-0x0000029205690000-0x00000292056B0000-memory.dmp

Filesize
128KB

Download
memory/3352-305-0x0000029205CA0000-0x0000029205CC0000-memory.dmp

Filesize
128KB

Download
memory/3356-244-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/3396-184-0x000001D692040000-0x000001D692060000-memory.dmp

Filesize
128KB

Download
memory/3396-187-0x000001D692450000-0x000001D692470000-memory.dmp

Filesize
128KB

Download
memory/3396-182-0x000001D692080000-0x000001D6920A0000-memory.dmp

Filesize
128KB

Download
memory/3592-9-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/3780-113-0x00000261745A0000-0x00000261745C0000-memory.dmp

Filesize
128KB

Download
memory/3780-115-0x00000261749B0000-0x00000261749D0000-memory.dmp

Filesize
128KB

Download
memory/3780-111-0x00000261745E0000-0x0000026174600000-memory.dmp

Filesize
128KB

Download
memory/3920-228-0x00000266516D0000-0x00000266516F0000-memory.dmp

Filesize
128KB

Download
memory/3920-230-0x0000026651690000-0x00000266516B0000-memory.dmp

Filesize
128KB

Download
memory/3920-232-0x0000026651CA0000-0x0000026651CC0000-memory.dmp

Filesize
128KB

Download
memory/3924-334-0x0000000004580000-0x0000000004581000-memory.dmp

Filesize
4KB

Download
memory/4036-321-0x0000023C34770000-0x0000023C34790000-memory.dmp

Filesize
128KB

Download
memory/4036-323-0x0000023C34730000-0x0000023C34750000-memory.dmp

Filesize
128KB

Download
memory/4036-326-0x0000023C34B40000-0x0000023C34B60000-memory.dmp

Filesize
128KB

Download
memory/4148-55-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/4440-197-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

Filesize
4KB

Download
memory/4532-358-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4764-15-0x0000016E06910000-0x0000016E06930000-memory.dmp

Filesize
128KB

Download
memory/4764-18-0x0000016E068D0000-0x0000016E068F0000-memory.dmp

Filesize
128KB

Download
memory/4764-20-0x0000016E06CE0000-0x0000016E06D00000-memory.dmp

Filesize
128KB

Download
memory/4864-267-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/4952-89-0x000001F646260000-0x000001F646280000-memory.dmp

Filesize
128KB

Download
memory/4952-87-0x000001F6462A0000-0x000001F6462C0000-memory.dmp

Filesize
128KB

Download
memory/4952-91-0x000001F646670000-0x000001F646690000-memory.dmp

Filesize
128KB

Download
memory/5056-134-0x0000026A9E2F0000-0x0000026A9E310000-memory.dmp

Filesize
128KB

Download
memory/5056-136-0x0000026A9E2B0000-0x0000026A9E2D0000-memory.dmp

Filesize
128KB

Download
memory/5056-139-0x0000026A9E8C0000-0x0000026A9E8E0000-memory.dmp

Filesize
128KB

Download
memory/5092-365-0x0000026BE5840000-0x0000026BE5860000-memory.dmp

Filesize
128KB

Download
memory/5092-367-0x0000026BE5800000-0x0000026BE5820000-memory.dmp

Filesize
128KB

Download
memory/5092-369-0x0000026BE5C00000-0x0000026BE5C20000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads