Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
22s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
40c0043ce18949abdfe9e5f74990b629fb6179195240196047c4fba44e60ed7f.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
40c0043ce18949abdfe9e5f74990b629fb6179195240196047c4fba44e60ed7f.exe
Resource
win10v2004-20230703-en
General
-
Target
40c0043ce18949abdfe9e5f74990b629fb6179195240196047c4fba44e60ed7f.exe
-
Size
2.9MB
-
MD5
70d68dffa8231271a8b5f6c8ba684b3f
-
SHA1
0781376d108c707cb47d7d691e6a9ce198931c86
-
SHA256
40c0043ce18949abdfe9e5f74990b629fb6179195240196047c4fba44e60ed7f
-
SHA512
e249f977035bee8d3bf97396f321a28c37986b28fc39cfe329da84f84b86af3c9c4ee01480bf33461f37460ff19f777c0ee72896133fb0e34f98f0e8963a179f
-
SSDEEP
49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlziqCNkNpioNeia:Q+8X9G3vP3AM1nCNGpBNc
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Program crash 49 IoCs
pid pid_target Process procid_target 4684 3000 WerFault.exe 86 3328 1976 WerFault.exe 94 4600 4428 WerFault.exe 103 2780 3428 WerFault.exe 101 3000 668 WerFault.exe 110 2872 2780 WerFault.exe 117 3980 1416 WerFault.exe 115 3468 5112 WerFault.exe 125 1228 3612 WerFault.exe 123 3288 3892 WerFault.exe 132 404 3028 WerFault.exe 139 4256 3236 WerFault.exe 137 3732 3640 WerFault.exe 147 3524 3848 WerFault.exe 145 4596 2928 WerFault.exe 155 4756 3256 WerFault.exe 153 4836 4744 WerFault.exe 161 372 2680 WerFault.exe 168 4416 4036 WerFault.exe 166 3288 2784 WerFault.exe 176 3980 3744 WerFault.exe 174 3376 3612 WerFault.exe 182 3960 3968 WerFault.exe 189 3896 3620 WerFault.exe 187 4408 928 WerFault.exe 197 1044 3140 WerFault.exe 195 4740 372 WerFault.exe 205 3216 448 WerFault.exe 203 4820 4560 WerFault.exe 213 4344 4908 WerFault.exe 211 3392 4804 WerFault.exe 221 4936 4828 WerFault.exe 219 228 4056 WerFault.exe 229 1668 1560 WerFault.exe 227 3516 3092 WerFault.exe 237 404 3820 WerFault.exe 235 1796 3304 WerFault.exe 243 1060 1696 WerFault.exe 250 4468 3864 WerFault.exe 248 1848 3300 WerFault.exe 258 1492 3228 WerFault.exe 256 180 1608 WerFault.exe 264 2968 1972 WerFault.exe 269 4456 2108 WerFault.exe 270 3744 2012 WerFault.exe 275 4912 1692 WerFault.exe 284 3272 4320 WerFault.exe 282 4732 3024 WerFault.exe 292 3288 228 WerFault.exe 290 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 WerFault.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{71CC311B-6397-48D6-8C3E-23980C75A27F} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{2E4F36AB-731C-4650-9751-EF707ED05AEC} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings WerFault.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{B4027ACB-9F41-49B5-96A3-ABD8C3A4D2EE} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{2ACCF871-DCA4-44E9-98B6-75F5587D7FD3} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3000 explorer.exe Token: SeCreatePagefilePrivilege 3000 explorer.exe Token: SeShutdownPrivilege 3000 explorer.exe Token: SeCreatePagefilePrivilege 3000 explorer.exe Token: SeShutdownPrivilege 3000 explorer.exe Token: SeCreatePagefilePrivilege 3000 explorer.exe Token: SeShutdownPrivilege 3000 explorer.exe Token: SeCreatePagefilePrivilege 3000 explorer.exe Token: SeShutdownPrivilege 3000 explorer.exe Token: SeCreatePagefilePrivilege 3000 explorer.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 3000 WerFault.exe Token: SeCreatePagefilePrivilege 3000 WerFault.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 1976 explorer.exe Token: SeCreatePagefilePrivilege 1976 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe Token: SeShutdownPrivilege 3428 explorer.exe Token: SeCreatePagefilePrivilege 3428 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 explorer.exe 3000 WerFault.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 explorer.exe 3428 WerFault.exe 3428 WerFault.exe 3428 WerFault.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 1416 explorer.exe 1416 explorer.exe 1416 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1492 StartMenuExperienceHost.exe 4036 explorer.exe 4728 StartMenuExperienceHost.exe 4428 SearchApp.exe 4036 explorer.exe 4088 StartMenuExperienceHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c0043ce18949abdfe9e5f74990b629fb6179195240196047c4fba44e60ed7f.exe"C:\Users\Admin\AppData\Local\Temp\40c0043ce18949abdfe9e5f74990b629fb6179195240196047c4fba44e60ed7f.exe"1⤵PID:4572
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3000 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3000 -s 61522⤵
- Program crash
PID:4684
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1492
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 3000 -ip 30001⤵PID:2924
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1976 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1976 -s 60362⤵
- Program crash
PID:3328
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4036
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 1976 -ip 19761⤵PID:3532
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3428 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3428 -s 57922⤵
- Program crash
PID:2780
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4728
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4428 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4428 -s 37962⤵
- Program crash
PID:4600
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4428 -ip 44281⤵PID:404
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 3428 -ip 34281⤵PID:384
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:668 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 668 -s 60242⤵
- Program crash
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3000
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4036
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 668 -ip 6681⤵PID:1796
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:1416 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1416 -s 59402⤵
- Program crash
PID:3980
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4088
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2780 -s 35842⤵
- Program crash
PID:2872
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 568 -p 2780 -ip 27801⤵PID:708
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 600 -p 1416 -ip 14161⤵PID:3960
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3612
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3612 -s 56162⤵
- Program crash
PID:1228
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4000
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5112
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5112 -s 36162⤵
- Program crash
PID:3468
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 564 -p 5112 -ip 51121⤵PID:708
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 576 -p 3612 -ip 36121⤵PID:4208
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3892
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3892 -s 59842⤵
- Program crash
PID:3288
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1388
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 3892 -ip 38921⤵PID:3488
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3236
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3236 -s 59842⤵
- Program crash
PID:4256
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4224
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3028
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3028 -s 35682⤵
- Program crash
PID:404
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 576 -p 3028 -ip 30281⤵PID:1092
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 3236 -ip 32361⤵PID:4528
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3848
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3848 -s 58762⤵
- Program crash
PID:3524
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3640
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3640 -s 36002⤵
- Program crash
PID:3732
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 572 -p 3640 -ip 36401⤵PID:2264
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 3848 -ip 38481⤵PID:2396
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3256
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3256 -s 75002⤵
- Program crash
PID:4756
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1432
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2928
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2928 -s 25722⤵
- Program crash
PID:4596
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 2928 -ip 29281⤵PID:664
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 3256 -ip 32561⤵PID:5116
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4744
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4744 -s 58482⤵
- Program crash
PID:4836
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3164
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 4744 -ip 47441⤵PID:2460
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4036 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4036 -s 74722⤵
- Program crash
PID:4416
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3896
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2680
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2680 -s 35762⤵
- Program crash
PID:372
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 2680 -ip 26801⤵PID:3620
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 4036 -ip 40361⤵PID:504
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3744
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3744 -s 35242⤵
- Program crash
PID:3980
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2280
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2784
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2784 -s 35442⤵
- Program crash
PID:3288
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 2784 -ip 27841⤵PID:4888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 3744 -ip 37441⤵PID:528
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3612
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3612 -s 59362⤵
- Program crash
PID:3376
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4388
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 488 -p 3612 -ip 36121⤵PID:3896
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3620
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3620 -s 57682⤵
- Program crash
PID:3896
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4328
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3968
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3968 -s 36042⤵
- Program crash
PID:3960
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 552 -p 3968 -ip 39681⤵PID:3280
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 3620 -ip 36201⤵PID:4588
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3140
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3140 -s 59082⤵
- Program crash
PID:1044
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5028
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:928
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 928 -s 35842⤵
- Program crash
PID:4408
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 928 -ip 9281⤵PID:4484
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 488 -p 3140 -ip 31401⤵PID:5108
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:448
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 448 -s 72322⤵
- Program crash
PID:3216
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:824
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:372
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 372 -s 36202⤵
- Program crash
PID:4740
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 372 -ip 3721⤵PID:2256
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 576 -p 448 -ip 4481⤵PID:1260
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4908
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4908 -s 34082⤵
- Program crash
PID:4344
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4624
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4560
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4560 -s 35322⤵
- Program crash
PID:4820
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 596 -p 4560 -ip 45601⤵PID:1696
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 4908 -ip 49081⤵PID:3532
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4828
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4828 -s 74162⤵
- Program crash
PID:4936
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4804
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4804 -s 35882⤵
- Program crash
PID:3392
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 4804 -ip 48041⤵
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:3428
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 588 -p 4828 -ip 48281⤵PID:3404
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1560
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1560 -s 74562⤵
- Program crash
PID:1668
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4500
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4056
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4056 -s 36082⤵
- Program crash
PID:228
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 4056 -ip 40561⤵PID:3884
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 588 -p 1560 -ip 15601⤵PID:1592
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3820
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3820 -s 74602⤵
- Program crash
PID:404
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3092
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3092 -s 35122⤵
- Program crash
PID:3516
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 3092 -ip 30921⤵PID:1828
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 384 -p 3820 -ip 38201⤵PID:620
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3304
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3304 -s 60002⤵
- Program crash
PID:1796
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:616
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 552 -p 3304 -ip 33041⤵PID:4072
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3864
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3864 -s 61562⤵
- Program crash
PID:4468
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4876
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1696
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1696 -s 36082⤵
- Program crash
PID:1060
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 588 -p 1696 -ip 16961⤵PID:3652
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 588 -p 3864 -ip 38641⤵PID:3960
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3228
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3228 -s 74002⤵
- Program crash
PID:1492
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1804
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3300
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3300 -s 35802⤵
- Program crash
PID:1848
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 3300 -ip 33001⤵PID:676
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 3228 -ip 32281⤵PID:3884
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1608
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1608 -s 46602⤵
- Program crash
PID:180
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1852
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 572 -p 1608 -ip 16081⤵PID:3504
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1972
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1972 -s 59602⤵
- Program crash
PID:2968
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2108
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2108 -s 40242⤵
- Program crash
PID:4456
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1328
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 1972 -ip 19721⤵PID:448
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2012
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2012 -s 43442⤵
- Program crash
PID:3744
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4292
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 384 -p 2108 -ip 21081⤵PID:1448
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 2012 -ip 20121⤵PID:664
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4320
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4320 -s 73522⤵
- Program crash
PID:3272
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4132
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1692
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1692 -s 35682⤵
- Program crash
PID:4912
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 1692 -ip 16921⤵PID:2372
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 4320 -ip 43201⤵PID:1812
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:228
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 228 -s 74602⤵
- Program crash
PID:3288
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5044
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3024
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3024 -s 35882⤵
- Program crash
PID:4732
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 3024 -ip 30241⤵PID:4308
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 384 -p 228 -ip 2281⤵PID:4644
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1052
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:508
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize471B
MD555b54ec631500ac8345b4fe65b933cd7
SHA1443f0e75a709e94b7f962f7257ab700cf0970675
SHA256add338c3176b99772b6e9daec0259fcc5d4a5a23bc60dfd062f99f199a5ebef9
SHA51279d4045bb0afb67302b9676d09433945923c73529289507ac1699e6d7b55212667a6279f4e672dbba2c19edb7f3c43b9bb0292bda7e66b24300184fa7654c384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize412B
MD5e59800a377f1bccc6a6206d32abf2842
SHA1299a1767098502433e05cd40a1f16d1b3312e976
SHA25658dd20e1fa17bb25e2b096945373243b05c265c5e58e4d249024aa6fd3fddce3
SHA512eef209930bab0dfb9ee02f826adc633a3c45917f48b22d6b605134518d093b878884c63333a74361801d142fded847af3fa62e84651e620c21f82db512045f31
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc