0ba0990a3523ed2d97a8c5d11eb35aaec0ed1213b9843c8f707a39aadf02f9dd

Analysis

max time kernel
32s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ba0990a3523ed2d97a8c5d11eb35aaec0ed1213b9843c8f707a39aadf02f9dd.exe
Size

2.7MB
MD5

aee611e2e1b004f6722d8de5de70a088
SHA1

cc204f23f7bb614ee9d9ca2097e6ba97a83fae0a
SHA256

0ba0990a3523ed2d97a8c5d11eb35aaec0ed1213b9843c8f707a39aadf02f9dd
SHA512

ffc7152af82d24981f1f444f6d01d3b5ee660cff254d9f6d93068c0f5ff782ab573f8646e7d67d33350387233d3ae9469df9cf5e6a6b705dd379f20d0329f0ab
SSDEEP

49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlthnvj15f4hubnany:c+8X9G3vP3AMHhnvj15fTngy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Active Setup\Installed Components	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Active Setup\Installed Components	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	WerFault.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	WerFault.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	WerFault.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	WerFault.exe

Program crash 51 IoCs

pid	pid_target	Process	procid_target
3664	4848	WerFault.exe	87
1832	1408	WerFault.exe	96
1888	4244	WerFault.exe	105
4476	3244	WerFault.exe	102
4016	1036	WerFault.exe	114
3780	3360	WerFault.exe	111
3872	4864	WerFault.exe	123
4672	1292	WerFault.exe	120
4000	4352	WerFault.exe	133
3288	2208	WerFault.exe	130
3620	1560	WerFault.exe	139
4044	4256	WerFault.exe	147
3964	2152	WerFault.exe	145
1192	3776	WerFault.exe	156
2980	1924	WerFault.exe	153
3632	3764	WerFault.exe	162
3712	4252	WerFault.exe	170
2884	4152	WerFault.exe	168
1828	772	WerFault.exe	176
560	3836	WerFault.exe	184
3288	4496	WerFault.exe	182
5012	916	WerFault.exe	193
2964	3592	WerFault.exe	190
4808	4124	WerFault.exe	202
320	4784	WerFault.exe	199
3800	3236	WerFault.exe	211
4840	884	WerFault.exe	208
4788	2008	WerFault.exe	220
2964	3540	WerFault.exe	217
4676	3860	WerFault.exe	229
1416	3552	WerFault.exe	226
560	1736	WerFault.exe	235
3680	1492	WerFault.exe	243
2140	2172	WerFault.exe	241
392	4476	WerFault.exe	249
3408	4772	WerFault.exe	256
1760	4228	WerFault.exe	254
2804	4392	WerFault.exe	265
3780	3720	WerFault.exe	263
3960	1548	WerFault.exe	273
4624	1036	WerFault.exe	271
3908	320	WerFault.exe	279
1888	4376	WerFault.exe	286
3584	4488	WerFault.exe	284
1076	4648	WerFault.exe	293
1716	3024	WerFault.exe	290
4244	2600	WerFault.exe	298
4672	2304	WerFault.exe	307
4404	2184	WerFault.exe	305
2236	4460	WerFault.exe	313
2828	2536	WerFault.exe	320

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\GPU	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{23910CC7-CC92-43D2-AB79-12E754BDBC03}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{9DD06B32-D65C-400D-914A-6185F20585FE}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{3D31032B-1473-41F5-9CB0-82F3B425CE33}	WerFault.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	WerFault.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	WerFault.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WerFault.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	1408	explorer.exe
Token: SeCreatePagefilePrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe
Token: SeShutdownPrivilege	3244	explorer.exe
Token: SeCreatePagefilePrivilege	3244	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
4848	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
1408	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3244	explorer.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe
3360	WerFault.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3784	StartMenuExperienceHost.exe
1380	StartMenuExperienceHost.exe
5008	StartMenuExperienceHost.exe
4244	StartMenuExperienceHost.exe
3032	StartMenuExperienceHost.exe
1036	SearchApp.exe
1220	Process not Found
4864	SearchApp.exe
3448	StartMenuExperienceHost.exe
4352	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\0ba0990a3523ed2d97a8c5d11eb35aaec0ed1213b9843c8f707a39aadf02f9dd.exe
"C:\Users\Admin\AppData\Local\Temp\0ba0990a3523ed2d97a8c5d11eb35aaec0ed1213b9843c8f707a39aadf02f9dd.exe"
1⤵
PID:796

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4848 -s 6004
  2⤵
  - Program crash
  PID:3664

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 4848 -ip 4848
1⤵
PID:2536

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1408 -s 5860
  2⤵
  - Program crash
  PID:1832

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 1408 -ip 1408
1⤵
PID:4968

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3244 -s 7240
  2⤵
  - Program crash
  PID:4476

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4244 -s 3956
  2⤵
  - Program crash
  PID:1888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 4244 -ip 4244
1⤵
PID:4196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 3244 -ip 3244
1⤵
PID:2720

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3360 -s 5860
  2⤵
  - Program crash
  PID:3780

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1036 -s 3592
  2⤵
  - Program crash
  PID:4016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 1036 -ip 1036
1⤵
PID:3824

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 3360 -ip 3360
1⤵
PID:2040

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:1292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1292 -s 7344
  2⤵
  - Program crash
  PID:4672

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1220

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4864 -s 3620
  2⤵
  - Program crash
  PID:3872

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4864 -ip 4864
1⤵
PID:1224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 1292 -ip 1292
1⤵
PID:4424

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 7408
  2⤵
  - Program crash
  PID:3288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4352 -s 3604
  2⤵
  - Program crash
  PID:4000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 4352 -ip 4352
1⤵
PID:3536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 2208 -ip 2208
1⤵
PID:3648

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1560 -s 5992
  2⤵
  - Program crash
  PID:3620

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3724

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 1560 -ip 1560
1⤵
PID:544

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 7444
  2⤵
  - Program crash
  PID:3964

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1748

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4256 -s 2372
  2⤵
  - Program crash
  PID:4044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 4256 -ip 4256
1⤵
PID:2136

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 2152 -ip 2152
1⤵
PID:560

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 7584
  2⤵
  - Program crash
  PID:2980

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3776 -s 2276
  2⤵
  - Program crash
  PID:1192

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 3776 -ip 3776
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:3360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 1924 -ip 1924
1⤵
PID:560

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3764 -s 5832
  2⤵
  - Program crash
  PID:3632

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3568

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 3764 -ip 3764
1⤵
PID:4776

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4152 -s 1140
  2⤵
  - Program crash
  PID:2884

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1816

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4252 -s 3528
  2⤵
  - Program crash
  PID:3712

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 4252 -ip 4252
1⤵
PID:4960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 4152 -ip 4152
1⤵
PID:3836

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 772 -s 5796
  2⤵
  - Program crash
  PID:1828

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4244

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 772 -ip 772
1⤵
PID:3568

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4496 -s 7336
  2⤵
  - Program crash
  PID:3288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2616

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3836 -s 3588
  2⤵
  - Program crash
  PID:560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 3836 -ip 3836
1⤵
PID:216

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 4496 -ip 4496
1⤵
PID:5112

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3592 -s 6132
  2⤵
  - Program crash
  PID:2964

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4116

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 916 -s 3564
  2⤵
  - Program crash
  PID:5012

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 916 -ip 916
1⤵
PID:3908

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 3592 -ip 3592
1⤵
PID:2536

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4784 -s 6000
  2⤵
  - Program crash
  PID:320

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2020

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4124 -s 3556
  2⤵
  - Program crash
  PID:4808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 4124 -ip 4124
1⤵
PID:2828

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 4784 -ip 4784
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:2208

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 884 -s 4800
  2⤵
  - Program crash
  PID:4840

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:212

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3236 -s 3584
  2⤵
  - Program crash
  PID:3800

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 3236 -ip 3236
1⤵
PID:3688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 884 -ip 884
1⤵
PID:1356

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3540 -s 5976
  2⤵
  - Program crash
  PID:2964

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1740

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 3596
  2⤵
  - Program crash
  PID:4788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 2008 -ip 2008
1⤵
PID:3356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 3540 -ip 3540
1⤵
PID:3380

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3552
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3552 -s 7384
  2⤵
  - Program crash
  PID:1416

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3168

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3860 -s 3496
  2⤵
  - Program crash
  PID:4676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 3860 -ip 3860
1⤵
PID:4784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 3552 -ip 3552
1⤵
PID:4780

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 5860
  2⤵
  - Program crash
  PID:560

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 1736 -ip 1736
1⤵
PID:216

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 7300
  2⤵
  - Program crash
  PID:2140

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2980

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1492 -s 3604
  2⤵
  - Program crash
  PID:3680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 1492 -ip 1492
1⤵
PID:4072

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2172 -ip 2172
1⤵
PID:3380

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4476 -s 5956
  2⤵
  - Program crash
  PID:392

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 4476 -ip 4476
1⤵
PID:3868

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4228 -s 7232
  2⤵
  - Program crash
  PID:1760

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4744

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4772 -s 3612
  2⤵
  - Program crash
  PID:3408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 4772 -ip 4772
1⤵
PID:1484

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 4228 -ip 4228
1⤵
PID:4608

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3720 -s 5988
  2⤵
  - Program crash
  PID:3780

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3796

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4392 -s 3560
  2⤵
  - Program crash
  PID:2804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 4392 -ip 4392
1⤵
PID:1908

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 3720 -ip 3720
1⤵
PID:2704

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1036 -s 7288
  2⤵
  - Program crash
  PID:4624

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4576

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1548 -s 3544
  2⤵
  - Program crash
  PID:3960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 1548 -ip 1548
1⤵
PID:1716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 1036 -ip 1036
1⤵
PID:1084

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 320 -s 5016
  2⤵
  - Program crash
  PID:3908

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3488

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 320 -ip 320
1⤵
PID:3240

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4488 -s 6196
  2⤵
  - Program crash
  PID:3584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:632

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4376 -s 3496
  2⤵
  - Program crash
  PID:1888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 4376 -ip 4376
1⤵
PID:4692

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 3880
  2⤵
  - Program crash
  PID:1716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 4488 -ip 4488
1⤵
PID:4476

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4648 -s 5908
  2⤵
  - Program crash
  PID:1076

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 4648 -ip 4648
1⤵
PID:2828

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2600
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2600 -s 5924
  2⤵
  - Program crash
  PID:4244

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 3024 -ip 3024
1⤵
PID:3720

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2600 -ip 2600
1⤵
PID:3832

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 7472
  2⤵
  - Program crash
  PID:4404

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3860

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2304 -s 3552
  2⤵
  - Program crash
  PID:4672

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 2304 -ip 2304
1⤵
PID:2804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2184 -ip 2184
1⤵
PID:3708

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4460 -s 4528
  2⤵
  - Program crash
  PID:2236

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 4460 -ip 4460
1⤵
PID:3772

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1316

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2640

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 3584
  2⤵
  - Program crash
  PID:2828

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 2536 -ip 2536
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
af5a8d4c269f24b03b8f67a9e12bd794

SHA1
14f868109a220fd221bda78d3ef22295b40ccbb1

SHA256
8ff8ca05a08b79e99a170760e8dbee4a650b4c6edc04a8da2d23b21507266152

SHA512
80ca0a7b0f1042771afe25fcf90d626c50fe9eee16341c63fe65878dfc56ae55b871d4158b06dec540d2eecf66163e65bc48ebf4f9c394407c3556c5b80b1e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
404B

MD5
38ea371c96a8b80bad50d757a736d330

SHA1
82e3e894df22f5ef252d33b3cebc19f7ec6b0247

SHA256
a3c83a3b300fc9b1d5670d1332d85de9a086de1c8ae88f609ab15b5d5f51f23e

SHA512
42088faa5851b694625626897789c40140215ff0f7435a7db6b567a9c2f73be27d271fa50852f9f49fc8c0e4401734b9a1ffafba0a917bc01d8c009fd53c78c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K9G5AECL\microsoft.windows[1].xml

Filesize
97B

MD5
6b3c7df657dac84939df4efdd1a1c4c1

SHA1
570cdd50e12f70ec5ee6e6da38f88f6eb7682733

SHA256
2a975e69f7fb0acf7ca4c5af0c8704effb0fee770b91634b20d383f3122b8198

SHA512
79c02cda377d14c0b966b385e9a6f0357bfc9060a987cf0a181c41deb32c752f2768a073c5477379de94476379af189c296172cbe8621ac36cf045a04d7d16b0

Download Submit
memory/884-235-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/916-203-0x000001A9063D0000-0x000001A9063F0000-memory.dmp

Filesize
128KB

Download
memory/916-200-0x000001A906620000-0x000001A906640000-memory.dmp

Filesize
128KB

Download
memory/916-206-0x000001A9069E0000-0x000001A906A00000-memory.dmp

Filesize
128KB

Download
memory/1036-42-0x0000019B92230000-0x0000019B92250000-memory.dmp

Filesize
128KB

Download
memory/1036-40-0x0000019B91E20000-0x0000019B91E40000-memory.dmp

Filesize
128KB

Download
memory/1036-38-0x0000019B91E60000-0x0000019B91E80000-memory.dmp

Filesize
128KB

Download
memory/1292-54-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/1492-313-0x0000023677F20000-0x0000023677F40000-memory.dmp

Filesize
128KB

Download
memory/1492-315-0x0000023677BD0000-0x0000023677BF0000-memory.dmp

Filesize
128KB

Download
memory/1492-317-0x00000236782E0000-0x0000023678300000-memory.dmp

Filesize
128KB

Download
memory/1924-121-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/2008-268-0x0000025E05BD0000-0x0000025E05BF0000-memory.dmp

Filesize
128KB

Download
memory/2008-270-0x0000025E061E0000-0x0000025E06200000-memory.dmp

Filesize
128KB

Download
memory/2008-266-0x0000025E05C10000-0x0000025E05C30000-memory.dmp

Filesize
128KB

Download
memory/2152-98-0x00000000040C0000-0x00000000040C1000-memory.dmp

Filesize
4KB

Download
memory/2172-305-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/2208-74-0x00000000046E0000-0x00000000046E1000-memory.dmp

Filesize
4KB

Download
memory/3236-245-0x0000020085DC0000-0x0000020085DE0000-memory.dmp

Filesize
128KB

Download
memory/3236-248-0x00000200863D0000-0x00000200863F0000-memory.dmp

Filesize
128KB

Download
memory/3236-243-0x0000020086000000-0x0000020086020000-memory.dmp

Filesize
128KB

Download
memory/3244-8-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/3360-30-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/3540-258-0x0000000004620000-0x0000000004621000-memory.dmp

Filesize
4KB

Download
memory/3552-281-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/3592-192-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/3720-349-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/3776-129-0x00000195BA460000-0x00000195BA480000-memory.dmp

Filesize
128KB

Download
memory/3776-132-0x00000195BA420000-0x00000195BA440000-memory.dmp

Filesize
128KB

Download
memory/3776-135-0x00000195BA830000-0x00000195BA850000-memory.dmp

Filesize
128KB

Download
memory/3836-179-0x00000244D5E40000-0x00000244D5E60000-memory.dmp

Filesize
128KB

Download
memory/3836-181-0x00000244D6250000-0x00000244D6270000-memory.dmp

Filesize
128KB

Download
memory/3836-177-0x00000244D5E80000-0x00000244D5EA0000-memory.dmp

Filesize
128KB

Download
memory/3860-294-0x00000194BDE80000-0x00000194BDEA0000-memory.dmp

Filesize
128KB

Download
memory/3860-292-0x00000194BD870000-0x00000194BD890000-memory.dmp

Filesize
128KB

Download
memory/3860-289-0x00000194BD8B0000-0x00000194BD8D0000-memory.dmp

Filesize
128KB

Download
memory/4124-222-0x00000202637B0000-0x00000202637D0000-memory.dmp

Filesize
128KB

Download
memory/4124-220-0x0000020263B00000-0x0000020263B20000-memory.dmp

Filesize
128KB

Download
memory/4124-224-0x0000020263EC0000-0x0000020263EE0000-memory.dmp

Filesize
128KB

Download
memory/4152-145-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/4228-329-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/4244-20-0x000002657E500000-0x000002657E520000-memory.dmp

Filesize
128KB

Download
memory/4244-17-0x000002657E100000-0x000002657E120000-memory.dmp

Filesize
128KB

Download
memory/4244-15-0x000002657E140000-0x000002657E160000-memory.dmp

Filesize
128KB

Download
memory/4252-153-0x000001FD12400000-0x000001FD12420000-memory.dmp

Filesize
128KB

Download
memory/4252-155-0x000001FD123C0000-0x000001FD123E0000-memory.dmp

Filesize
128KB

Download
memory/4252-157-0x000001FD127D0000-0x000001FD127F0000-memory.dmp

Filesize
128KB

Download
memory/4256-106-0x000001F4680D0000-0x000001F4680F0000-memory.dmp

Filesize
128KB

Download
memory/4256-111-0x000001F4684A0000-0x000001F4684C0000-memory.dmp

Filesize
128KB

Download
memory/4256-108-0x000001F468090000-0x000001F4680B0000-memory.dmp

Filesize
128KB

Download
memory/4352-84-0x000002F410420000-0x000002F410440000-memory.dmp

Filesize
128KB

Download
memory/4352-82-0x000002F410460000-0x000002F410480000-memory.dmp

Filesize
128KB

Download
memory/4352-86-0x000002F410830000-0x000002F410850000-memory.dmp

Filesize
128KB

Download
memory/4392-359-0x000002452CA00000-0x000002452CA20000-memory.dmp

Filesize
128KB

Download
memory/4392-357-0x000002452CA40000-0x000002452CA60000-memory.dmp

Filesize
128KB

Download
memory/4392-361-0x000002452CE10000-0x000002452CE30000-memory.dmp

Filesize
128KB

Download
memory/4496-169-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/4772-337-0x000002C41C820000-0x000002C41C840000-memory.dmp

Filesize
128KB

Download
memory/4772-339-0x000002C41C5E0000-0x000002C41C600000-memory.dmp

Filesize
128KB

Download
memory/4772-341-0x000002C41CBF0000-0x000002C41CC10000-memory.dmp

Filesize
128KB

Download
memory/4784-212-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/4864-62-0x0000021BD6D60000-0x0000021BD6D80000-memory.dmp

Filesize
128KB

Download
memory/4864-64-0x0000021BD6D20000-0x0000021BD6D40000-memory.dmp

Filesize
128KB

Download
memory/4864-66-0x0000021BD7130000-0x0000021BD7150000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads