d0ab953a0f660a0460a7d08f8ace489b562eb62fe70e57474d8e986edc5eccca

Analysis

max time kernel
34s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ab953a0f660a0460a7d08f8ace489b562eb62fe70e57474d8e986edc5eccca.exe
Size

2.8MB
MD5

59934f85b84466da833a24bb7ebefc31
SHA1

8c9c2cc9000851f194f6749c9f4e30d274b605ea
SHA256

d0ab953a0f660a0460a7d08f8ace489b562eb62fe70e57474d8e986edc5eccca
SHA512

8de7fc96fd2d1336067524a672e74714c1939098e4df06ddc3236114ca4f71ac8fd604fce4ef1b2019261466a920c8dd2fc1c4b8ead2e56b6ef8c54a546a6465
SSDEEP

49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlcN2Smc1TJpCbf:c+8X9G3vP3AMKrmi4bf

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Program crash 46 IoCs

pid	pid_target	Process	procid_target
4444	1388	WerFault.exe	86
3052	2872	WerFault.exe	94
4148	2772	WerFault.exe	103
3300	3548	WerFault.exe	101
3268	4024	WerFault.exe	112
4948	2448	WerFault.exe	110
1872	924	WerFault.exe	120
2180	988	WerFault.exe	118
4364	4260	WerFault.exe	127
2708	2136	WerFault.exe	134
2036	3196	WerFault.exe	132
4040	4852	WerFault.exe	142
4900	4460	WerFault.exe	140
4600	4548	WerFault.exe	148
2592	1864	WerFault.exe	155
3740	1000	WerFault.exe	153
8	4776	WerFault.exe	161
3588	2584	WerFault.exe	168
4648	3784	WerFault.exe	166
2364	2012	WerFault.exe	175
3264	3904	WerFault.exe	182
1240	3980	WerFault.exe	180
4832	1652	WerFault.exe	190
4420	2944	WerFault.exe	188
3628	1616	WerFault.exe	198
1704	1376	WerFault.exe	196
4456	4824	WerFault.exe	204
1872	4812	WerFault.exe	211
3788	436	WerFault.exe	209
2180	1456	WerFault.exe	219
3524	5064	WerFault.exe	217
1248	1192	WerFault.exe	227
664	4256	WerFault.exe	225
5012	3212	WerFault.exe	233
1760	2712	WerFault.exe	240
3768	1168	WerFault.exe	238
536	1352	WerFault.exe	246
760	3524	WerFault.exe	253
4904	1496	WerFault.exe	251
1960	1224	WerFault.exe	261
3616	4108	WerFault.exe	259
3268	2264	WerFault.exe	269
708	4480	WerFault.exe	267
1352	3592	WerFault.exe	277
376	3908	WerFault.exe	275
3836	4172	WerFault.exe	283

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-618519468-4027732583-1827558364-1000\{BACCE8E9-C20C-4471-BB5B-6ECC2F6721AE}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-618519468-4027732583-1827558364-1000\{26D790F2-AE10-4265-831C-C0D916EFE35C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-618519468-4027732583-1827558364-1000\{CB8DD43F-6838-45B9-BB75-07812707E612}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	WerFault.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-618519468-4027732583-1827558364-1000\{E5BC8CF0-8EA7-44E2-BCCE-2EF89CAE9674}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	1388	explorer.exe
Token: SeCreatePagefilePrivilege	1388	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	explorer.exe
Token: SeCreatePagefilePrivilege	2872	explorer.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	2872	WerFault.exe
Token: SeCreatePagefilePrivilege	2872	WerFault.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe
Token: SeShutdownPrivilege	3548	explorer.exe
Token: SeCreatePagefilePrivilege	3548	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
1388	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	WerFault.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
3548	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1772	StartMenuExperienceHost.exe
4384	StartMenuExperienceHost.exe
4772	StartMenuExperienceHost.exe
2772	SearchApp.exe
4084	StartMenuExperienceHost.exe
4024	SearchApp.exe
3544	StartMenuExperienceHost.exe
924	SearchApp.exe
2968	StartMenuExperienceHost.exe

C:\Users\Admin\AppData\Local\Temp\d0ab953a0f660a0460a7d08f8ace489b562eb62fe70e57474d8e986edc5eccca.exe
"C:\Users\Admin\AppData\Local\Temp\d0ab953a0f660a0460a7d08f8ace489b562eb62fe70e57474d8e986edc5eccca.exe"
1⤵
PID:5028

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1388 -s 6136
  2⤵
  - Program crash
  PID:4444

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 1388 -ip 1388
1⤵
PID:1704

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 6132
  2⤵
  - Program crash
  PID:3052

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 2872 -ip 2872
1⤵
PID:3300

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3548 -s 5092
  2⤵
  - Program crash
  PID:3300

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4772

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2772 -s 3768
  2⤵
  - Program crash
  PID:4148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 2772 -ip 2772
1⤵
PID:2700

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 3548 -ip 3548
1⤵
PID:3592

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2448 -s 7304
  2⤵
  - Program crash
  PID:4948

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4084

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4024 -s 3528
  2⤵
  - Program crash
  PID:3268

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 4024 -ip 4024
1⤵
PID:1764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 2448 -ip 2448
1⤵
PID:2196

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 988 -s 7584
  2⤵
  - Program crash
  PID:2180

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3544

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 924 -s 3524
  2⤵
  - Program crash
  PID:1872

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 924 -ip 924
1⤵
PID:1864

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 988 -ip 988
1⤵
PID:1120

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:4260
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4260 -s 5784
  2⤵
  - Program crash
  PID:4364

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 4260 -ip 4260
1⤵
PID:2692

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
PID:3196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3196 -s 7704
  2⤵
  - Program crash
  PID:2036

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1268

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 3588
  2⤵
  - Program crash
  PID:2708

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 2136 -ip 2136
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2872

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3196 -ip 3196
1⤵
PID:932

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4460 -s 7332
  2⤵
  - Program crash
  PID:4900

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1248

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4852 -s 3480
  2⤵
  - Program crash
  PID:4040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4852 -ip 4852
1⤵
PID:3344

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 4460 -ip 4460
1⤵
PID:4996

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4548 -s 5800
  2⤵
  - Program crash
  PID:4600

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4548 -ip 4548
1⤵
PID:3012

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1000 -s 5832
  2⤵
  - Program crash
  PID:3740

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4136

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1864 -s 3564
  2⤵
  - Program crash
  PID:2592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 1864 -ip 1864
1⤵
PID:2580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 1000 -ip 1000
1⤵
PID:2944

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4776 -s 5944
  2⤵
  - Program crash
  PID:8

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 4776 -ip 4776
1⤵
PID:4548

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3784 -s 4336
  2⤵
  - Program crash
  PID:4648

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2480

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2584
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2584 -s 3648
  2⤵
  - Program crash
  PID:3588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 2584 -ip 2584
1⤵
PID:1956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 3784 -ip 3784
1⤵
PID:1596

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2012 -s 5880
  2⤵
  - Program crash
  PID:2364

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 2012 -ip 2012
1⤵
PID:1688

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3980 -s 7400
  2⤵
  - Program crash
  PID:1240

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3432

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3904 -s 3608
  2⤵
  - Program crash
  PID:3264

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 3904 -ip 3904
1⤵
PID:5056

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 3980 -ip 3980
1⤵
PID:4980

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2944 -s 6020
  2⤵
  - Program crash
  PID:4420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1504

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1652 -s 3568
  2⤵
  - Program crash
  PID:4832

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 364 -p 1652 -ip 1652
1⤵
PID:3376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 2944 -ip 2944
1⤵
PID:2000

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1376 -s 4104
  2⤵
  - Program crash
  PID:1704

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1348

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1616 -s 3600
  2⤵
  - Program crash
  PID:3628

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 592 -p 1616 -ip 1616
1⤵
PID:3692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 1376 -ip 1376
1⤵
PID:3428

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4824 -s 5860
  2⤵
  - Program crash
  PID:4456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4824 -ip 4824
1⤵
PID:3384

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 436 -s 6044
  2⤵
  - Program crash
  PID:3788

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3776

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4812 -s 3600
  2⤵
  - Program crash
  PID:1872

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 4812 -ip 4812
1⤵
PID:3336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 388 -p 436 -ip 436
1⤵
PID:2512

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5064 -s 5996
  2⤵
  - Program crash
  PID:3524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2344

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1456
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1456 -s 3576
  2⤵
  - Program crash
  PID:2180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 1456 -ip 1456
1⤵
PID:2584

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 5064 -ip 5064
1⤵
PID:3644

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4256 -s 7412
  2⤵
  - Program crash
  PID:664

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 3540
  2⤵
  - Program crash
  PID:1248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1192 -ip 1192
1⤵
PID:1688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 4256 -ip 4256
1⤵
PID:1816

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3212 -s 5972
  2⤵
  - Program crash
  PID:5012

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2264

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 3212 -ip 3212
1⤵
PID:4244

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1168 -s 7464
  2⤵
  - Program crash
  PID:3768

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:780

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2712 -s 3600
  2⤵
  - Program crash
  PID:1760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 2712 -ip 2712
1⤵
PID:2288

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 1168 -ip 1168
1⤵
PID:3856

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1352 -s 6340
  2⤵
  - Program crash
  PID:536

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 1352 -ip 1352
1⤵
PID:2084

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1496 -s 4644
  2⤵
  - Program crash
  PID:4904

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1600

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3524 -s 3568
  2⤵
  - Program crash
  PID:760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 3524 -ip 3524
1⤵
PID:3064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 1496 -ip 1496
1⤵
PID:4624

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4108 -s 6208
  2⤵
  - Program crash
  PID:3616

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4700

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1224 -s 3952
  2⤵
  - Program crash
  PID:1960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 1224 -ip 1224
1⤵
PID:4276

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 4108 -ip 4108
1⤵
PID:3724

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4480
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4480 -s 5732
  2⤵
  - Program crash
  PID:708

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3992

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2264 -s 3560
  2⤵
  - Program crash
  PID:3268

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 2264 -ip 2264
1⤵
PID:4696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4480 -ip 4480
1⤵
PID:436

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3908 -s 7572
  2⤵
  - Program crash
  PID:376

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1816

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3592 -s 3604
  2⤵
  - Program crash
  PID:1352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 3592 -ip 3592
1⤵
PID:4152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 656 -p 3908 -ip 3908
1⤵
PID:3240

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4172 -s 5828
  2⤵
  - Program crash
  PID:3836

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 660 -p 4172 -ip 4172
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
af5a8d4c269f24b03b8f67a9e12bd794

SHA1
14f868109a220fd221bda78d3ef22295b40ccbb1

SHA256
8ff8ca05a08b79e99a170760e8dbee4a650b4c6edc04a8da2d23b21507266152

SHA512
80ca0a7b0f1042771afe25fcf90d626c50fe9eee16341c63fe65878dfc56ae55b871d4158b06dec540d2eecf66163e65bc48ebf4f9c394407c3556c5b80b1e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
404B

MD5
9508c60db00e4120bafc6913a155a7c2

SHA1
55724e589ba07aefed4624d07a720e63ff37d297

SHA256
8967ff3eec823463f6781cade8a6d3be75a3892b7f11ccd36890eef7ffd009a5

SHA512
4442ee5d1cdc33628a3890fb50dad85ec61d0f51bdc000e92a942486fa0946c9e740ec1796f4af1a0091ef856d1f024e9483cfadce842c7464ac9b60b67fdcc9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\30S018WW\microsoft.windows[1].xml

Filesize
97B

MD5
bc0c3d8c7fd2d9e4c1cac28f314c2f28

SHA1
413955a43a3b93b642d86cc9eaea2068044dff26

SHA256
7844128387d5a78488ec57155f5a3ceb3beb4a2925d13dc715b911bc1353a225

SHA512
88dc028bdf120f442c380d13f4f3ea8800833ea276e37f8a6266603b3529ab149a4d353cf9de899e35e95bf0553dc689c44da1f14246167fcfe144c0f66d270f

Download Submit
memory/436-240-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/924-67-0x0000021942C40000-0x0000021942C60000-memory.dmp

Filesize
128KB

Download
memory/924-62-0x0000021942870000-0x0000021942890000-memory.dmp

Filesize
128KB

Download
memory/924-64-0x0000021942830000-0x0000021942850000-memory.dmp

Filesize
128KB

Download
memory/988-54-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/1000-125-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/1168-310-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/1192-296-0x0000027724170000-0x0000027724190000-memory.dmp

Filesize
128KB

Download
memory/1192-294-0x00000277241B0000-0x00000277241D0000-memory.dmp

Filesize
128KB

Download
memory/1192-298-0x0000027724580000-0x00000277245A0000-memory.dmp

Filesize
128KB

Download
memory/1224-366-0x0000016433BA0000-0x0000016433BC0000-memory.dmp

Filesize
128KB

Download
memory/1224-364-0x0000016433790000-0x00000164337B0000-memory.dmp

Filesize
128KB

Download
memory/1224-362-0x00000164337D0000-0x00000164337F0000-memory.dmp

Filesize
128KB

Download
memory/1376-220-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/1456-273-0x0000024CDE8D0000-0x0000024CDE8F0000-memory.dmp

Filesize
128KB

Download
memory/1456-271-0x0000024CDE910000-0x0000024CDE930000-memory.dmp

Filesize
128KB

Download
memory/1456-275-0x0000024CDEEE0000-0x0000024CDEF00000-memory.dmp

Filesize
128KB

Download
memory/1496-331-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/1616-229-0x00000151CA370000-0x00000151CA390000-memory.dmp

Filesize
128KB

Download
memory/1616-231-0x00000151CA780000-0x00000151CA7A0000-memory.dmp

Filesize
128KB

Download
memory/1616-227-0x00000151CA3B0000-0x00000151CA3D0000-memory.dmp

Filesize
128KB

Download
memory/1652-210-0x00000201AE5D0000-0x00000201AE5F0000-memory.dmp

Filesize
128KB

Download
memory/1652-204-0x00000201AE200000-0x00000201AE220000-memory.dmp

Filesize
128KB

Download
memory/1652-206-0x00000201AE1C0000-0x00000201AE1E0000-memory.dmp

Filesize
128KB

Download
memory/1864-140-0x000001A41E140000-0x000001A41E160000-memory.dmp

Filesize
128KB

Download
memory/1864-136-0x000001A41DD30000-0x000001A41DD50000-memory.dmp

Filesize
128KB

Download
memory/1864-133-0x000001A41DD70000-0x000001A41DD90000-memory.dmp

Filesize
128KB

Download
memory/2136-89-0x000001D829DC0000-0x000001D829DE0000-memory.dmp

Filesize
128KB

Download
memory/2136-86-0x000001D829E00000-0x000001D829E20000-memory.dmp

Filesize
128KB

Download
memory/2136-91-0x000001D82A1D0000-0x000001D82A1F0000-memory.dmp

Filesize
128KB

Download
memory/2448-30-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2584-161-0x00000179C8160000-0x00000179C8180000-memory.dmp

Filesize
128KB

Download
memory/2584-157-0x00000179C7D90000-0x00000179C7DB0000-memory.dmp

Filesize
128KB

Download
memory/2584-159-0x00000179C7D50000-0x00000179C7D70000-memory.dmp

Filesize
128KB

Download
memory/2712-320-0x0000015F98720000-0x0000015F98740000-memory.dmp

Filesize
128KB

Download
memory/2712-323-0x0000015F98B20000-0x0000015F98B40000-memory.dmp

Filesize
128KB

Download
memory/2712-318-0x0000015F98760000-0x0000015F98780000-memory.dmp

Filesize
128KB

Download
memory/2772-19-0x0000029D9D030000-0x0000029D9D050000-memory.dmp

Filesize
128KB

Download
memory/2772-17-0x0000029D9CC20000-0x0000029D9CC40000-memory.dmp

Filesize
128KB

Download
memory/2772-15-0x0000029D9CC60000-0x0000029D9CC80000-memory.dmp

Filesize
128KB

Download
memory/2944-196-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/3196-78-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/3524-339-0x000001EC23CF0000-0x000001EC23D10000-memory.dmp

Filesize
128KB

Download
memory/3524-341-0x000001EC23CB0000-0x000001EC23CD0000-memory.dmp

Filesize
128KB

Download
memory/3524-344-0x000001EC242C0000-0x000001EC242E0000-memory.dmp

Filesize
128KB

Download
memory/3548-8-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3784-150-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/3904-185-0x0000028CA6E40000-0x0000028CA6E60000-memory.dmp

Filesize
128KB

Download
memory/3904-183-0x0000028CA6A30000-0x0000028CA6A50000-memory.dmp

Filesize
128KB

Download
memory/3904-181-0x0000028CA6A70000-0x0000028CA6A90000-memory.dmp

Filesize
128KB

Download
memory/3980-173-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/4024-40-0x000001B54C020000-0x000001B54C040000-memory.dmp

Filesize
128KB

Download
memory/4024-38-0x000001B54C060000-0x000001B54C080000-memory.dmp

Filesize
128KB

Download
memory/4024-43-0x000001B54C430000-0x000001B54C450000-memory.dmp

Filesize
128KB

Download
memory/4108-355-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download
memory/4256-286-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/4460-101-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/4812-250-0x000001FADCC20000-0x000001FADCC40000-memory.dmp

Filesize
128KB

Download
memory/4812-248-0x000001FADCC60000-0x000001FADCC80000-memory.dmp

Filesize
128KB

Download
memory/4812-253-0x000001FADD030000-0x000001FADD050000-memory.dmp

Filesize
128KB

Download
memory/4852-111-0x00000252C2240000-0x00000252C2260000-memory.dmp

Filesize
128KB

Download
memory/4852-113-0x00000252C2650000-0x00000252C2670000-memory.dmp

Filesize
128KB

Download
memory/4852-109-0x00000252C2280000-0x00000252C22A0000-memory.dmp

Filesize
128KB

Download
memory/5064-264-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads