Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
1915522fda424cf177b72830025aec0b6af1dd812768553d429f8e54d0131279.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
1915522fda424cf177b72830025aec0b6af1dd812768553d429f8e54d0131279.exe
Resource
win10v2004-20230703-en
General
-
Target
1915522fda424cf177b72830025aec0b6af1dd812768553d429f8e54d0131279.exe
-
Size
3.0MB
-
MD5
b5df562a6a46653fdc7b1021627f291d
-
SHA1
81e5d74c9065ef4ae126eb142a4074457408d36b
-
SHA256
1915522fda424cf177b72830025aec0b6af1dd812768553d429f8e54d0131279
-
SHA512
78ecad9368c2ca8a012f961aeda82b0a16a30299d09c9e406e928153a26941548d994b08075ad93d1d6b1640730599dab5198664717fc34bd2722b115e88e0fb
-
SSDEEP
49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlAw4SNNk5soINjPUb:Q+8X9G3vP3AMC5SQ672
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Program crash 41 IoCs
pid pid_target Process procid_target 1056 3308 WerFault.exe 87 3376 2528 WerFault.exe 97 3584 2660 WerFault.exe 105 4108 3736 WerFault.exe 102 4972 3756 WerFault.exe 111 1320 4124 WerFault.exe 118 2996 760 WerFault.exe 116 2724 3708 WerFault.exe 127 4204 1864 WerFault.exe 125 848 4248 WerFault.exe 135 3448 1572 WerFault.exe 133 3720 4208 WerFault.exe 143 740 3924 WerFault.exe 141 1136 3824 WerFault.exe 149 4960 5092 WerFault.exe 156 3396 1336 WerFault.exe 154 2216 3476 WerFault.exe 162 5004 4904 WerFault.exe 169 2056 2984 WerFault.exe 167 3608 1300 WerFault.exe 177 3672 5084 WerFault.exe 175 4656 2180 WerFault.exe 183 3240 3300 WerFault.exe 190 1068 4924 WerFault.exe 188 3240 1204 WerFault.exe 198 3260 4300 WerFault.exe 196 3824 3216 WerFault.exe 206 4860 4204 WerFault.exe 204 3472 4848 WerFault.exe 214 2384 1404 WerFault.exe 212 2096 4724 WerFault.exe 220 912 1580 WerFault.exe 227 3276 2844 WerFault.exe 225 4140 3388 WerFault.exe 235 3828 5088 WerFault.exe 233 2416 2384 WerFault.exe 243 4752 3216 WerFault.exe 241 4960 2752 WerFault.exe 249 3096 4120 WerFault.exe 250 3732 3472 WerFault.exe 257 3204 3648 WerFault.exe 264 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 40 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4176143399-3250363947-192774652-1000\{04B814B3-EB2E-464D-9B62-B050867C8FFB} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4176143399-3250363947-192774652-1000\{939DBB29-41E8-44C6-967C-B33C7464DA05} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 WerFault.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\MuiCache explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WerFault.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4176143399-3250363947-192774652-1000\{712A6CFD-A036-4B62-9D52-FFD9BE1706C0} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3308 explorer.exe Token: SeCreatePagefilePrivilege 3308 explorer.exe Token: SeShutdownPrivilege 3308 explorer.exe Token: SeCreatePagefilePrivilege 3308 explorer.exe Token: SeShutdownPrivilege 3308 explorer.exe Token: SeCreatePagefilePrivilege 3308 explorer.exe Token: SeShutdownPrivilege 3308 explorer.exe Token: SeCreatePagefilePrivilege 3308 explorer.exe Token: SeShutdownPrivilege 3308 explorer.exe Token: SeCreatePagefilePrivilege 3308 explorer.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 3308 WerFault.exe Token: SeCreatePagefilePrivilege 3308 WerFault.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 2528 explorer.exe Token: SeCreatePagefilePrivilege 2528 explorer.exe Token: SeShutdownPrivilege 3736 explorer.exe Token: SeCreatePagefilePrivilege 3736 explorer.exe Token: SeShutdownPrivilege 3736 explorer.exe Token: SeCreatePagefilePrivilege 3736 explorer.exe Token: SeShutdownPrivilege 3736 explorer.exe Token: SeCreatePagefilePrivilege 3736 explorer.exe Token: SeShutdownPrivilege 3736 explorer.exe Token: SeCreatePagefilePrivilege 3736 explorer.exe Token: SeShutdownPrivilege 3736 explorer.exe Token: SeCreatePagefilePrivilege 3736 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 explorer.exe 3308 WerFault.exe 3308 WerFault.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 2528 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe 3736 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3784 StartMenuExperienceHost.exe 1864 explorer.exe 4940 StartMenuExperienceHost.exe 2660 SearchApp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1915522fda424cf177b72830025aec0b6af1dd812768553d429f8e54d0131279.exe"C:\Users\Admin\AppData\Local\Temp\1915522fda424cf177b72830025aec0b6af1dd812768553d429f8e54d0131279.exe"1⤵PID:4808
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3308 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3308 -s 61762⤵
- Program crash
PID:1056
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3784
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 3308 -ip 33081⤵PID:3872
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2528 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2528 -s 60882⤵
- Program crash
PID:3376
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1864
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 2528 -ip 25281⤵PID:3212
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3736 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3736 -s 73642⤵
- Program crash
PID:4108
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4940
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2660 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2660 -s 39802⤵
- Program crash
PID:3584
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 2660 -ip 26601⤵PID:2628
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 416 -p 3736 -ip 37361⤵PID:2776
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3756
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3756 -s 61602⤵
- Program crash
PID:4972
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:752
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 3756 -ip 37561⤵PID:1996
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:760
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 760 -s 74842⤵
- Program crash
PID:2996
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3672
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4124
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4124 -s 35922⤵
- Program crash
PID:1320
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 4124 -ip 41241⤵PID:2232
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 760 -ip 7601⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3308
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1864 -s 44922⤵
- Program crash
PID:4204
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2268
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3708
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3708 -s 35802⤵
- Program crash
PID:2724
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 3708 -ip 37081⤵PID:4856
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 1864 -ip 18641⤵PID:4284
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1572
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1572 -s 73522⤵
- Program crash
PID:3448
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2080
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4248
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4248 -s 35562⤵
- Program crash
PID:848
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 4248 -ip 42481⤵PID:1712
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 1572 -ip 15721⤵PID:4144
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3924
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3924 -s 75362⤵
- Program crash
PID:740
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4996
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4208
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4208 -s 35482⤵
- Program crash
PID:3720
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 4208 -ip 42081⤵PID:2724
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 576 -p 3924 -ip 39241⤵PID:1068
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3824
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3824 -s 60442⤵
- Program crash
PID:1136
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1996
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 552 -p 3824 -ip 38241⤵PID:4924
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1336
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1336 -s 73322⤵
- Program crash
PID:3396
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3420
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5092
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5092 -s 29362⤵
- Program crash
PID:4960
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 5092 -ip 50921⤵PID:3872
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 1336 -ip 13361⤵PID:3788
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3476
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3476 -s 58882⤵
- Program crash
PID:2216
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:872
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 3476 -ip 34761⤵PID:4964
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2984
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2984 -s 33642⤵
- Program crash
PID:2056
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1768
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4904
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4904 -s 35602⤵
- Program crash
PID:5004
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 584 -p 4904 -ip 49041⤵PID:4912
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 540 -p 2984 -ip 29841⤵PID:3224
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5084
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5084 -s 11362⤵
- Program crash
PID:3672
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1300
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1300 -s 36082⤵
- Program crash
PID:3608
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 616 -p 1300 -ip 13001⤵PID:2892
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 5084 -ip 50841⤵PID:4904
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2180
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2180 -s 59402⤵
- Program crash
PID:4656
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4864
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 588 -p 2180 -ip 21801⤵PID:5100
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4924
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4924 -s 33922⤵
- Program crash
PID:1068
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3720
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3300
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3300 -s 35842⤵
- Program crash
PID:3240
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 3300 -ip 33001⤵PID:3208
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4924 -ip 49241⤵PID:4144
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4300
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4300 -s 60842⤵
- Program crash
PID:3260
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4848
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1204
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1204 -s 36202⤵
- Program crash
PID:3240
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 508 -p 1204 -ip 12041⤵PID:3412
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 668 -p 4300 -ip 43001⤵PID:1124
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4204
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4204 -s 36162⤵
- Program crash
PID:4860
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:376
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3216
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3216 -s 35682⤵
- Program crash
PID:3824
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 632 -p 3216 -ip 32161⤵PID:4792
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 584 -p 4204 -ip 42041⤵PID:1188
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1404
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1404 -s 76762⤵
- Program crash
PID:2384
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3252
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4848
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4848 -s 35642⤵
- Program crash
PID:3472
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 584 -p 4848 -ip 48481⤵PID:3656
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 688 -p 1404 -ip 14041⤵PID:4076
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4724
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4724 -s 60002⤵
- Program crash
PID:2096
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3872
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 4724 -ip 47241⤵PID:3080
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2844
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2844 -s 34042⤵
- Program crash
PID:3276
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4388
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1580
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1580 -s 25562⤵
- Program crash
PID:912
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 1580 -ip 15801⤵PID:2776
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 2844 -ip 28441⤵PID:2216
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5088
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5088 -s 11482⤵
- Program crash
PID:3828
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2476
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3388
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3388 -s 35722⤵
- Program crash
PID:4140
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 660 -p 3388 -ip 33881⤵PID:3252
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 5088 -ip 50881⤵PID:3400
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3216
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3216 -s 36482⤵
- Program crash
PID:4752
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1148
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2384
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2384 -s 35682⤵
- Program crash
PID:2416
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 2384 -ip 23841⤵PID:1232
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 3216 -ip 32161⤵PID:3268
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2752
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2752 -s 39642⤵
- Program crash
PID:4960
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4120
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4120 -s 76522⤵
- Program crash
PID:3096
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3044
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 416 -p 2752 -ip 27521⤵PID:1000
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 4120 -ip 41201⤵PID:2540
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3472
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3472 -s 58322⤵
- Program crash
PID:3732
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2652
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 3472 -ip 34721⤵PID:2280
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:388
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:752
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3648
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3648 -s 35562⤵
- Program crash
PID:3204
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 688 -p 3648 -ip 36481⤵PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize1KB
MD529ca2a9bfe32d2d0032f9b9f23c21f95
SHA11956973c843d2977ce300d78cb39b7674d7672b1
SHA2568571fcfed52bd8df54184d5808a24f8a8a356acfcfc3276de2e34c541f452799
SHA5125facceb938caeb0e7e12215eaae36684c516ca97f82ccc7816df8712b3067b65e9b08889f92ee3aeb6fe3686eee5a0cbe95da9b33f0e58d26384f943bd7d4e0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize404B
MD53e00b6c3b2611ee52fcd896485295d33
SHA145b07b78e96f39cd775d8aba44e23b7e872f88a5
SHA256168f554c078c8b9e5997b70515928536ee0b5f1d1bd2562cfc8f3048f4416f32
SHA512d1b87f68e328965a53532a9e5229813dc1a835a87f673ab559bacc2c4c5fb7f677324c03dc9d71df457d33a2ff20756f7c7b2941a5d60ccdfb12c2d93077f85e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
Filesize97B
MD575fdba27ae111f9312c9b243a5e22d02
SHA10bbbf13546b05600dbeb285609adcff5e12c2e24
SHA25662198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89
SHA512855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c