343b2a99fe8bdf98b1d5a63da9876753a8dcb2a6bbd86a91dcc95e3d14349854

Analysis

max time kernel
31s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

343b2a99fe8bdf98b1d5a63da9876753a8dcb2a6bbd86a91dcc95e3d14349854.exe
Size

2.7MB
MD5

a8599ef3bc6d0ee99ee2a8197ff4fe05
SHA1

807eb7ee954cb9c755bca9a4ea3db506220cc64f
SHA256

343b2a99fe8bdf98b1d5a63da9876753a8dcb2a6bbd86a91dcc95e3d14349854
SHA512

7b4cf3c9a29a9384a0cd087cd0eac6b288b2dcdb875ce1eba53470313213397fde0753fd5936fd419c5ffbcbde54dfb2f085a1690cae278bd15bb6a0a5852fbe
SSDEEP

49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlNaYrZvAE:c+8X9G3vP3AMHao+E

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Program crash 47 IoCs

pid	pid_target	Process	procid_target
2660	2824	WerFault.exe	85
4160	5004	WerFault.exe	93
4448	1188	WerFault.exe	102
2536	3564	WerFault.exe	100
3336	3676	WerFault.exe	112
4004	2836	WerFault.exe	109
4568	3636	WerFault.exe	121
456	3948	WerFault.exe	118
3900	1116	WerFault.exe	131
4292	3644	WerFault.exe	128
1564	4268	WerFault.exe	138
228	3768	WerFault.exe	146
4412	4648	WerFault.exe	144
1528	3312	WerFault.exe	155
3268	3952	WerFault.exe	152
1272	4640	WerFault.exe	164
1984	1508	WerFault.exe	161
3580	220	WerFault.exe	173
1516	3192	WerFault.exe	170
1624	3292	WerFault.exe	181
2824	796	WerFault.exe	179
3280	3532	WerFault.exe	190
4044	1528	WerFault.exe	187
3392	4832	WerFault.exe	196
2832	756	WerFault.exe	204
3960	4152	WerFault.exe	202
1036	3804	WerFault.exe	213
1536	3396	WerFault.exe	210
1752	4928	WerFault.exe	219
2184	5108	WerFault.exe	227
2108	2912	WerFault.exe	225
3352	1616	WerFault.exe	233
4404	2360	WerFault.exe	241
3724	1516	WerFault.exe	239
968	3608	WerFault.exe	247
3412	1984	WerFault.exe	255
4308	3304	WerFault.exe	253
3164	4888	WerFault.exe	264
116	3768	WerFault.exe	261
3832	3776	WerFault.exe	273
3876	796	WerFault.exe	270
3160	3676	WerFault.exe	279
3776	3748	WerFault.exe	280
5116	3464	WerFault.exe	290
3160	1844	WerFault.exe	288
1928	3088	WerFault.exe	299
1320	1968	WerFault.exe	296

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	Process not Found

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{240909E9-3405-49F0-BAF2-1EA6CBDD9AA8}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{C4EDEA63-823A-4C88-9A9F-02078F1DE2A2}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	2824	explorer.exe
Token: SeCreatePagefilePrivilege	2824	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	5004	explorer.exe
Token: SeCreatePagefilePrivilege	5004	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe
Token: SeShutdownPrivilege	3564	explorer.exe
Token: SeCreatePagefilePrivilege	3564	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
2824	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe
2836	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3720	StartMenuExperienceHost.exe
3964	StartMenuExperienceHost.exe
3928	StartMenuExperienceHost.exe
1188	Process not Found
5028	StartMenuExperienceHost.exe
3676	SearchApp.exe
3464	Process not Found
3636	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\343b2a99fe8bdf98b1d5a63da9876753a8dcb2a6bbd86a91dcc95e3d14349854.exe
"C:\Users\Admin\AppData\Local\Temp\343b2a99fe8bdf98b1d5a63da9876753a8dcb2a6bbd86a91dcc95e3d14349854.exe"
1⤵
PID:3752

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2824 -s 6224
  2⤵
  - Program crash
  PID:2660

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3720

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 2824 -ip 2824
1⤵
PID:2412

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5004 -s 6020
  2⤵
  - Program crash
  PID:4160

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 5004 -ip 5004
1⤵
PID:5000

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3564 -s 7428
  2⤵
  - Program crash
  PID:2536

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3928

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1188 -s 3672
  2⤵
  - Program crash
  PID:4448

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 584 -p 1188 -ip 1188
1⤵
PID:2284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 3564 -ip 3564
1⤵
PID:4176

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2836 -s 6220
  2⤵
  - Program crash
  PID:4004

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3676 -s 3580
  2⤵
  - Program crash
  PID:3336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 3676 -ip 3676
1⤵
PID:4776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 2836 -ip 2836
1⤵
PID:4012

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:3948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3948 -s 5880
  2⤵
  - Program crash
  PID:456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3464

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3636 -s 3572
  2⤵
  - Program crash
  PID:4568

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 3636 -ip 3636
1⤵
PID:5064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 3948 -ip 3948
1⤵
PID:3192

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:3644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3644 -s 5972
  2⤵
  - Program crash
  PID:4292

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4404

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1116 -s 3632
  2⤵
  - Program crash
  PID:3900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 1116 -ip 1116
1⤵
PID:1944

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 3644 -ip 3644
1⤵
PID:512

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4268 -s 5912
  2⤵
  - Program crash
  PID:1564

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3412

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 4268 -ip 4268
1⤵
PID:3268

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4648 -s 5828
  2⤵
  - Program crash
  PID:4412

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2136

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3768 -s 3576
  2⤵
  - Program crash
  PID:228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 3768 -ip 3768
1⤵
PID:4612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4648 -ip 4648
1⤵
PID:4676

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3952 -s 5956
  2⤵
  - Program crash
  PID:3268

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3620

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3312 -s 3520
  2⤵
  - Program crash
  PID:1528

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 592 -p 3312 -ip 3312
1⤵
PID:2184

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 3952 -ip 3952
1⤵
PID:4724

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1508 -s 1104
  2⤵
  - Program crash
  PID:1984

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:352

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4640 -s 3576
  2⤵
  - Program crash
  PID:1272

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 4640 -ip 4640
1⤵
PID:2940

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 1508 -ip 1508
1⤵
PID:2428

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3192 -s 5848
  2⤵
  - Program crash
  PID:1516

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3528

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 220 -s 3532
  2⤵
  - Program crash
  PID:3580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 220 -ip 220
1⤵
PID:3244

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 3192 -ip 3192
1⤵
PID:3632

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 796 -s 7456
  2⤵
  - Program crash
  PID:2824

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4648

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3292 -s 3576
  2⤵
  - Program crash
  PID:1624

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 640 -p 3292 -ip 3292
1⤵
PID:3096

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 796 -ip 796
1⤵
PID:4428

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1528 -s 7544
  2⤵
  - Program crash
  PID:4044

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:968

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3532
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3532 -s 3500
  2⤵
  - Program crash
  PID:3280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 3532 -ip 3532
1⤵
PID:2180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 592 -p 1528 -ip 1528
1⤵
PID:4472

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4832 -s 5880
  2⤵
  - Program crash
  PID:3392

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:4284

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4152 -s 7224
  2⤵
  - Program crash
  PID:3960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 756 -s 3600
  2⤵
  - Program crash
  PID:2832

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 756 -ip 756
1⤵
PID:4084

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4152 -ip 4152
1⤵
PID:4920

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3396 -s 5936
  2⤵
  - Program crash
  PID:1536

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3168

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3804 -s 3648
  2⤵
  - Program crash
  PID:1036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 3804 -ip 3804
1⤵
PID:4808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 3396 -ip 3396
1⤵
PID:3620

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4928 -s 5992
  2⤵
  - Program crash
  PID:1752

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 4928 -ip 4928
1⤵
PID:1052

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 7512
  2⤵
  - Program crash
  PID:2108

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4728

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5108 -s 3540
  2⤵
  - Program crash
  PID:2184

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 5108 -ip 5108
1⤵
PID:4464

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 2912 -ip 2912
1⤵
PID:2868

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1616 -s 5992
  2⤵
  - Program crash
  PID:3352

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 1616 -ip 1616
1⤵
PID:2084

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1516
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1516 -s 7468
  2⤵
  - Program crash
  PID:3724

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 3540
  2⤵
  - Program crash
  PID:4404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 2360 -ip 2360
1⤵
PID:4648

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 1516 -ip 1516
1⤵
PID:5100

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3608 -s 5964
  2⤵
  - Program crash
  PID:968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 3608 -ip 3608
1⤵
PID:3268

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3304 -s 7364
  2⤵
  - Program crash
  PID:4308

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4180

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1984 -s 3588
  2⤵
  - Program crash
  PID:3412

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 1984 -ip 1984
1⤵
PID:3988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 652 -p 3304 -ip 3304
1⤵
PID:1824

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3768 -s 7416
  2⤵
  - Program crash
  PID:116

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2212

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4888
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4888 -s 3600
  2⤵
  - Program crash
  PID:3164

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4888 -ip 4888
1⤵
PID:2916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 3768 -ip 3768
1⤵
PID:3412

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 796 -s 6048
  2⤵
  - Program crash
  PID:3876

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4836

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3776 -s 3596
  2⤵
  - Program crash
  PID:3832

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 3776 -ip 3776
1⤵
PID:4120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 796 -ip 796
1⤵
PID:2100

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3676 -s 3944
  2⤵
  - Program crash
  PID:3160

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3748 -s 6040
  2⤵
  - Program crash
  PID:3776

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 3676 -ip 3676
1⤵
PID:2544

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 3748 -ip 3748
1⤵
PID:4900

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1844 -s 7360
  2⤵
  - Program crash
  PID:3160

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4048

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3464 -s 3560
  2⤵
  - Program crash
  PID:5116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 3464 -ip 3464
1⤵
PID:1444

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 1844 -ip 1844
1⤵
PID:1936

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 3384
  2⤵
  - Program crash
  PID:1320

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3088 -s 3544
  2⤵
  - Program crash
  PID:1928

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 3088 -ip 3088
1⤵
PID:4116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 1968 -ip 1968
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
471B

MD5
55b54ec631500ac8345b4fe65b933cd7

SHA1
443f0e75a709e94b7f962f7257ab700cf0970675

SHA256
add338c3176b99772b6e9daec0259fcc5d4a5a23bc60dfd062f99f199a5ebef9

SHA512
79d4045bb0afb67302b9676d09433945923c73529289507ac1699e6d7b55212667a6279f4e672dbba2c19edb7f3c43b9bb0292bda7e66b24300184fa7654c384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
412B

MD5
9ae4e0752d8c047d2459ef0a6e741b82

SHA1
8862a5fdfe280c44ef0b5a63a41a7bc015d461b5

SHA256
4256b0c6622bf179542d9af55aaa6ac32856d87179d467e0a62567f8fbfc7739

SHA512
8a41cdd9db9873e42eaef3acc994796652e8a543dacb900e5867d51f66979b90a9525a2c724700bb57f5073154517d75c3e17e5b667d5b6ebf6b97256fcd91b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml

Filesize
97B

MD5
54cad9840e798ef7844e4c78d3fed195

SHA1
adf97c182735b5657366615ed62d86d269e09630

SHA256
f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac

SHA512
c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc

Download Submit
memory/220-178-0x00000211D0E00000-0x00000211D0E20000-memory.dmp

Filesize
128KB

Download
memory/220-180-0x00000211D1200000-0x00000211D1220000-memory.dmp

Filesize
128KB

Download
memory/220-175-0x00000211D0E40000-0x00000211D0E60000-memory.dmp

Filesize
128KB

Download
memory/756-245-0x000001A6DC1A0000-0x000001A6DC1C0000-memory.dmp

Filesize
128KB

Download
memory/756-249-0x000001A6DC570000-0x000001A6DC590000-memory.dmp

Filesize
128KB

Download
memory/756-247-0x000001A6DC160000-0x000001A6DC180000-memory.dmp

Filesize
128KB

Download
memory/796-190-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/1116-90-0x0000025AD1680000-0x0000025AD16A0000-memory.dmp

Filesize
128KB

Download
memory/1116-87-0x0000025AD1060000-0x0000025AD1080000-memory.dmp

Filesize
128KB

Download
memory/1116-84-0x0000025AD10A0000-0x0000025AD10C0000-memory.dmp

Filesize
128KB

Download
memory/1188-15-0x0000029DA2190000-0x0000029DA21B0000-memory.dmp

Filesize
128KB

Download
memory/1188-17-0x0000029DA2150000-0x0000029DA2170000-memory.dmp

Filesize
128KB

Download
memory/1188-19-0x0000029DA2800000-0x0000029DA2820000-memory.dmp

Filesize
128KB

Download
memory/1508-144-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1516-307-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/1528-214-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/1984-342-0x0000024FF2770000-0x0000024FF2790000-memory.dmp

Filesize
128KB

Download
memory/1984-341-0x0000024FF2360000-0x0000024FF2380000-memory.dmp

Filesize
128KB

Download
memory/1984-339-0x0000024FF23A0000-0x0000024FF23C0000-memory.dmp

Filesize
128KB

Download
memory/2360-317-0x000001E925500000-0x000001E925520000-memory.dmp

Filesize
128KB

Download
memory/2360-319-0x000001E925910000-0x000001E925930000-memory.dmp

Filesize
128KB

Download
memory/2360-315-0x000001E925540000-0x000001E925560000-memory.dmp

Filesize
128KB

Download
memory/2836-30-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/2912-285-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/3192-167-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/3292-198-0x000001B196B90000-0x000001B196BB0000-memory.dmp

Filesize
128KB

Download
memory/3292-200-0x000001B196B50000-0x000001B196B70000-memory.dmp

Filesize
128KB

Download
memory/3292-202-0x000001B196F60000-0x000001B196F80000-memory.dmp

Filesize
128KB

Download
memory/3304-331-0x0000000004010000-0x0000000004011000-memory.dmp

Filesize
4KB

Download
memory/3312-134-0x0000023644860000-0x0000023644880000-memory.dmp

Filesize
128KB

Download
memory/3312-131-0x0000023644250000-0x0000023644270000-memory.dmp

Filesize
128KB

Download
memory/3312-128-0x0000023644290000-0x00000236442B0000-memory.dmp

Filesize
128KB

Download
memory/3396-260-0x0000000002C80000-0x0000000002C81000-memory.dmp

Filesize
4KB

Download
memory/3532-224-0x000002CDC7B20000-0x000002CDC7B40000-memory.dmp

Filesize
128KB

Download
memory/3532-221-0x000002CDC7B60000-0x000002CDC7B80000-memory.dmp

Filesize
128KB

Download
memory/3532-228-0x000002CDC7F20000-0x000002CDC7F40000-memory.dmp

Filesize
128KB

Download
memory/3564-8-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/3636-63-0x000001F3ECDC0000-0x000001F3ECDE0000-memory.dmp

Filesize
128KB

Download
memory/3636-61-0x000001F3ED000000-0x000001F3ED020000-memory.dmp

Filesize
128KB

Download
memory/3636-67-0x000001F3ED410000-0x000001F3ED430000-memory.dmp

Filesize
128KB

Download
memory/3644-76-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/3676-42-0x0000016A7D8A0000-0x0000016A7D8C0000-memory.dmp

Filesize
128KB

Download
memory/3676-40-0x0000016A7D290000-0x0000016A7D2B0000-memory.dmp

Filesize
128KB

Download
memory/3676-38-0x0000016A7D2D0000-0x0000016A7D2F0000-memory.dmp

Filesize
128KB

Download
memory/3768-354-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/3768-114-0x0000019416680000-0x00000194166A0000-memory.dmp

Filesize
128KB

Download
memory/3768-110-0x0000019416070000-0x0000019416090000-memory.dmp

Filesize
128KB

Download
memory/3768-108-0x00000194160B0000-0x00000194160D0000-memory.dmp

Filesize
128KB

Download
memory/3804-270-0x0000011ED6C80000-0x0000011ED6CA0000-memory.dmp

Filesize
128KB

Download
memory/3804-271-0x0000011ED7090000-0x0000011ED70B0000-memory.dmp

Filesize
128KB

Download
memory/3804-268-0x0000011ED6CC0000-0x0000011ED6CE0000-memory.dmp

Filesize
128KB

Download
memory/3948-53-0x0000000004190000-0x0000000004191000-memory.dmp

Filesize
4KB

Download
memory/3952-120-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/4152-237-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/4640-154-0x000001DFF6720000-0x000001DFF6740000-memory.dmp

Filesize
128KB

Download
memory/4640-156-0x000001DFF6B30000-0x000001DFF6B50000-memory.dmp

Filesize
128KB

Download
memory/4640-152-0x000001DFF6760000-0x000001DFF6780000-memory.dmp

Filesize
128KB

Download
memory/4640-143-0x00007FFB032B0000-0x00007FFB032DE000-memory.dmp

Filesize
184KB

Download
memory/4648-100-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/4888-364-0x000001D5E5620000-0x000001D5E5640000-memory.dmp

Filesize
128KB

Download
memory/4888-362-0x000001D5E5660000-0x000001D5E5680000-memory.dmp

Filesize
128KB

Download
memory/5108-294-0x000001E475620000-0x000001E475640000-memory.dmp

Filesize
128KB

Download
memory/5108-292-0x000001E475660000-0x000001E475680000-memory.dmp

Filesize
128KB

Download
memory/5108-298-0x000001E475A30000-0x000001E475A50000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads