Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

c2d5aeeaf4...7b.exe

windows7-x64

8

c2d5aeeaf4...7b.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2023, 10:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c2d5aeeaf4d5c2aeacd4fda26942d12d0091bb16bcde6b2b43a15b8ca6276b7b.exe

  • Size

    3.3MB

  • MD5

    c0277acb0caa58340326dc9fbcd7c205

  • SHA1

    10f47ed06be917f77b6b85f20078318cd832aa28

  • SHA256

    c2d5aeeaf4d5c2aeacd4fda26942d12d0091bb16bcde6b2b43a15b8ca6276b7b

  • SHA512

    52067b78cf3f7f36a90e6342f503d5a7853dcad535d9f32b993633abcc845317682ca31022c7501128bb9b85605c5d3a6f8eff477704a10349e3f29ac8fcacfc

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTljKwSrHsg8ninh9NF:Q+8X9G3vP3AMJKvrHsg+ih9X

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2d5aeeaf4d5c2aeacd4fda26942d12d0091bb16bcde6b2b43a15b8ca6276b7b.exe
    "C:\Users\Admin\AppData\Local\Temp\c2d5aeeaf4d5c2aeacd4fda26942d12d0091bb16bcde6b2b43a15b8ca6276b7b.exe"
    1⤵
      PID:608
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2460
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2084
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4848
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3824
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4960
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:1244
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4964
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3660
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2020
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3312
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4868
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\cfc7198b7b70401ca3b027a82bfad100 /t 4960 /p 3104
      1⤵
        PID:2140
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4544
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1712
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1116
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1796
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1272
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        PID:3820
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3812
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2000
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2776
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4848
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:532
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2684
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3416
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1904
                      • C:\Windows\system32\werfault.exe
                        werfault.exe /hc /shared Global\6081e5fb30ae4d88bbd6bb46663a414c /t 4544 /p 3316
                        1⤵
                          PID:2016
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2660
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4188
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4088
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3096
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3824
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4956
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2968
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4824
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:2180
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3180
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3912
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:772
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4952
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:316
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3508
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3716
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4824
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2276
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:932
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2316
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:2300
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3616
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:5092
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4144
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4956
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4364
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4824
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:4380
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3596
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2432
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:2776
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4892
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:2820
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3228
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:3608
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:2000
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2600
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:4852

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                      Filesize

                                                                                                      471B

                                                                                                      MD5

                                                                                                      d46dc26bcc4435a635020a7d4c4bf0a7

                                                                                                      SHA1

                                                                                                      bef86b12967f0423f8fd06d1f94d8331b290594c

                                                                                                      SHA256

                                                                                                      98f64514ccece5ace0c6a26fbf6477a7393135ee6e2ee2593944e7cb795ff4a3

                                                                                                      SHA512

                                                                                                      bc2d592b71eecfb59f7a5d0df259cc2b4f8006c9b33e4929aafa0d9145eefaed0718bffdd7a185e2e5109333eb1daa95f82f48a46d4ed009d4b2cb0a5dab3f97

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                      Filesize

                                                                                                      412B

                                                                                                      MD5

                                                                                                      2b07057a6c55a3597d5b762241818740

                                                                                                      SHA1

                                                                                                      4f17dd93358971b201d58e1c23a56cc46e5e00d4

                                                                                                      SHA256

                                                                                                      2fe13525df544e313002c86e7280fe4664a46b415f39bbf9dd5775e070384514

                                                                                                      SHA512

                                                                                                      dd8c9a3dc08254c0ee6ebf8e5660036b8109798ec2f68b17ec55aa5bc64c841d9d3579b72c356d26ff7ae1e76cfe82cde1b858bfdb9942c9d789307b5c500e7d

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      08e988cf9ba89661e30c9a88dcfd71d1

                                                                                                      SHA1

                                                                                                      c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                                                                                                      SHA256

                                                                                                      dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                                                                                                      SHA512

                                                                                                      aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                                                                                                      Download Submit

                                                                                                    • memory/316-176-0x000001E2D0D10000-0x000001E2D0D30000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/316-181-0x000001E2D12E0000-0x000001E2D1300000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/316-179-0x000001E2D0CD0000-0x000001E2D0CF0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/532-95-0x0000000002620000-0x0000000002621000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/772-168-0x00000000040A0000-0x00000000040A1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/932-202-0x00000166248E0000-0x0000016624900000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/932-199-0x00000166242C0000-0x00000166242E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/932-197-0x0000016624300000-0x0000016624320000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1116-48-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/1272-61-0x000001BD80AA0000-0x000001BD80AC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1272-58-0x000001BD80690000-0x000001BD806B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1272-55-0x000001BD806D0000-0x000001BD806F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1712-39-0x0000029BB8870000-0x0000029BB8890000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1712-46-0x0000029BB8810000-0x0000029BB8830000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1712-41-0x0000029BB8830000-0x0000029BB8850000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/2000-71-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2000-285-0x0000000004300000-0x0000000004301000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2180-151-0x000001F7FF220000-0x000001F7FF240000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/2180-153-0x000001F7FEFE0000-0x000001F7FF000000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/2180-156-0x000001F7FF5F0000-0x000001F7FF610000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/2820-262-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2968-143-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/3096-133-0x0000020B5BB70000-0x0000020B5BB90000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3096-130-0x0000020B5B760000-0x0000020B5B780000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3096-127-0x0000020B5B7A0000-0x0000020B5B7C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3416-104-0x000002E95B690000-0x000002E95B6B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3416-102-0x000002E95B6D0000-0x000002E95B6F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3416-106-0x000002E95BCA0000-0x000002E95BCC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3608-272-0x000001DD11740000-0x000001DD11760000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3608-270-0x000001DD11780000-0x000001DD117A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3608-274-0x000001DD11E00000-0x000001DD11E20000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3616-214-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4144-222-0x00000274D9B10000-0x00000274D9B30000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4144-229-0x00000274DA0E0000-0x00000274DA100000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4144-225-0x00000274D9AD0000-0x00000274D9AF0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4188-119-0x0000000004390000-0x0000000004391000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4824-189-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4824-247-0x00000181B4960000-0x00000181B4980000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4824-249-0x00000181B4D70000-0x00000181B4D90000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4824-245-0x00000181B49A0000-0x00000181B49C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4848-79-0x00000149C85E0000-0x00000149C8600000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4848-81-0x00000149C85A0000-0x00000149C85C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4848-84-0x00000149C8BB0000-0x00000149C8BD0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4848-8-0x00000000046C0000-0x00000000046C1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4852-293-0x00000255F3CC0000-0x00000255F3CE0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4852-295-0x00000255F3C80000-0x00000255F3CA0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4852-298-0x00000255F4090000-0x00000255F40B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4868-31-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4956-237-0x00000000045E0000-0x00000000045E1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4960-19-0x000002571C550000-0x000002571C570000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4960-16-0x000002571C140000-0x000002571C160000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4960-14-0x000002571C180000-0x000002571C1A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download