260b8d98ddf0386276d15c2823db26a48d946e2befc0e57bdb25d7c793a9a578

Analysis

max time kernel
146s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

298f3f739806fe4e73c04aa1fa1e52ef.exe
Size

124KB
MD5

298f3f739806fe4e73c04aa1fa1e52ef
SHA1

6c10c4eef0175548436ae6a6496f9e6830660456
SHA256

260b8d98ddf0386276d15c2823db26a48d946e2befc0e57bdb25d7c793a9a578
SHA512

5073ec9517188323795e32c4514072a00d2ff61166eae70cad3c1a8ffc5e5e3ec9a332ac6f560f1f1acabb3ead50f5e6f3e950e198215f5f3ed431d5a2c24275
SSDEEP

3072:0uzSPwq7BFkErHRGHUl3t9VhRZZo9gMJNoYzwj2XErF:0uzEVFkYx399ZZO9jYSwjH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2476	298f3f739806fe4e73c04aa1fa1e52ef.exe
2476	298f3f739806fe4e73c04aa1fa1e52ef.exe
2476	298f3f739806fe4e73c04aa1fa1e52ef.exe
2476	298f3f739806fe4e73c04aa1fa1e52ef.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3596	Explorer.EXE
Token: SeCreatePagefilePrivilege	3596	Explorer.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3596	2476	298f3f739806fe4e73c04aa1fa1e52ef.exe	48

C:\Users\Admin\AppData\Local\Temp\298f3f739806fe4e73c04aa1fa1e52ef.exe
"C:\Users\Admin\AppData\Local\Temp\298f3f739806fe4e73c04aa1fa1e52ef.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4972

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1044

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3844

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4228

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1996

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:512

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4496

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1904

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2080

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1292

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4360

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1564

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2528

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2532

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3036

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4332

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4316

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1164

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3276

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5044

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2684

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2072

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5116

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1380

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:4988

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:368

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1292

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1380

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1596

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4444

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4176

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1016

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2252

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4184

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1764

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2560

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5100

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4748

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2236

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4964

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2560

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2316

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2380

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4528

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4300

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1208

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3376

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2916

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1328

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:388

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3096

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3152

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4348

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4432

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1368

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:224

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1208

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1380

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5032

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1124

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2732

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1944

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2072

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4104

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4488

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1640

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:220

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4180

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3480

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4980

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4424

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3644

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1064

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4352

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4872

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2144

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Filesize
2KB

MD5
a400215331d68c4e4e014eada6278fbc

SHA1
f2839871af1ebe220f27e7b692d7d8051f3e3cee

SHA256
d45b0340212a1f5aa447451caa140a447c35f89cfbd7956cdc9321623fa913af

SHA512
7fb2852425dd94e16bbbbc4529646756f1950b3919b4376c06586de0337fdacaf58b7bf898bfae2500d94230766aa890a74f7bf09c1f309f1b7177e2c7754ab5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BHN90SAO\microsoft.windows[1].xml

Filesize
97B

MD5
a49784c6007e88174d13fd2a1d1603c8

SHA1
96351722a846ad8a396b7cd3285ac30a8edf3768

SHA256
bf97a280596c60fa7130725b7426e7cd5ccfb759c909b5ef0b1575df2654ca91

SHA512
b0c5f6550c560e3bee33be9261bee95a006cd63a57d56b3a4b6c3c8f9ca2c6f222bfd2e8933e663f4b644457b48eb638160c8b9a6814b47a3fd4760f74f825ec

Download Submit
memory/512-18-0x000001AB391E0000-0x000001AB39200000-memory.dmp

Filesize
128KB

Download
memory/512-20-0x000001AB39630000-0x000001AB39650000-memory.dmp

Filesize
128KB

Download
memory/512-16-0x000001AB39220000-0x000001AB39240000-memory.dmp

Filesize
128KB

Download
memory/1164-106-0x00000237B5B60000-0x00000237B5B80000-memory.dmp

Filesize
128KB

Download
memory/1164-110-0x00000237B5F30000-0x00000237B5F50000-memory.dmp

Filesize
128KB

Download
memory/1164-108-0x00000237B5B20000-0x00000237B5B40000-memory.dmp

Filesize
128KB

Download
memory/1292-44-0x000001DBC65F0000-0x000001DBC6610000-memory.dmp

Filesize
128KB

Download
memory/1292-42-0x000001DBC5FE0000-0x000001DBC6000000-memory.dmp

Filesize
128KB

Download
memory/1292-40-0x000001DBC6220000-0x000001DBC6240000-memory.dmp

Filesize
128KB

Download
memory/1380-210-0x00000211C8300000-0x00000211C8320000-memory.dmp

Filesize
128KB

Download
memory/1380-214-0x00000211C88E0000-0x00000211C8900000-memory.dmp

Filesize
128KB

Download
memory/1380-212-0x00000211C82C0000-0x00000211C82E0000-memory.dmp

Filesize
128KB

Download
memory/1920-10-0x0000000004010000-0x0000000004011000-memory.dmp

Filesize
4KB

Download
memory/2072-202-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/2080-32-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/2528-60-0x0000023C36370000-0x0000023C36390000-memory.dmp

Filesize
128KB

Download
memory/2528-64-0x0000023C36740000-0x0000023C36760000-memory.dmp

Filesize
128KB

Download
memory/2528-62-0x0000023C36330000-0x0000023C36350000-memory.dmp

Filesize
128KB

Download
memory/2532-76-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/2684-160-0x00000220852D0000-0x00000220852F0000-memory.dmp

Filesize
128KB

Download
memory/2684-162-0x0000022085290000-0x00000220852B0000-memory.dmp

Filesize
128KB

Download
memory/2684-164-0x00000220858A0000-0x00000220858C0000-memory.dmp

Filesize
128KB

Download
memory/3036-83-0x0000027321C60000-0x0000027321C80000-memory.dmp

Filesize
128KB

Download
memory/3036-85-0x0000027321C20000-0x0000027321C40000-memory.dmp

Filesize
128KB

Download
memory/3036-87-0x0000027322030000-0x0000027322050000-memory.dmp

Filesize
128KB

Download
memory/3276-152-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/3276-224-0x00007FF8E3505000-0x00007FF8E3507000-memory.dmp

Filesize
8KB

Download
memory/3596-1-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/3596-0-0x0000000002EA0000-0x0000000002EA9000-memory.dmp

Filesize
36KB

Download
memory/4260-185-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-183-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-149-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-148-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-146-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-144-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-142-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-141-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-138-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-150-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-137-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-136-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-135-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-133-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-147-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-145-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-143-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-132-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-130-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-129-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-127-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-124-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-123-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-122-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-121-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-172-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-175-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-178-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-181-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-180-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-139-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-192-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-194-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-197-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-201-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-200-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-199-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-198-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-196-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-191-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-190-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-189-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-188-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-187-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-186-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-184-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-134-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-151-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-182-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-177-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-176-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-174-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-131-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-125-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-120-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-173-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-358-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-227-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-234-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-237-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-236-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-244-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-249-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-243-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-233-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-228-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-226-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-225-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-279-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-286-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-290-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-289-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-285-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-296-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-298-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-301-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-305-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-303-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-308-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-307-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-299-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-294-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-278-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-310-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-317-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-320-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-332-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-327-0x0000021B5B620000-0x0000021B5B630000-memory.dmp

Filesize
64KB

Download
memory/4260-326-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-319-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-316-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-364-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4260-359-0x0000021B5B600000-0x0000021B5B610000-memory.dmp

Filesize
64KB

Download
memory/4332-98-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/4360-53-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download