Overview

overview

10

Static

static

3

f8143ea8f6...d9.dll

windows7-x64

10

f8143ea8f6...d9.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    20s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2025 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f8143ea8f659ef91ca5aa037687269adec8ce5259f9ac531edde2735234521d9.dll

  • Size

    608KB

  • MD5

    f18239626382b405bdebd360e1d956dc

  • SHA1

    486f6e4037f8b77cdd2b16bb2b3a21874aaa01b4

  • SHA256

    f8143ea8f659ef91ca5aa037687269adec8ce5259f9ac531edde2735234521d9

  • SHA512

    1051db04b59f1db601e51bee911a1cecea93c1b9ff5d99fe060bc5468857a1487eb6043ebf57178e543165166245021050d46de6c7197ccf36ac4c237e3bbf69

  • SSDEEP

    6144:HpwKfEqXZYHYQ3Z6NJoqcHkJY1TBvVxfMe4rMb60+RVTzzikEfmIhVYmp/82Vo:DfExZ0ohJVxft4P0sDCJrYm3C

Score
10/10
dridexbotnetdiscoveryevasionloaderpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex family
    dridex
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8143ea8f659ef91ca5aa037687269adec8ce5259f9ac531edde2735234521d9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8143ea8f659ef91ca5aa037687269adec8ce5259f9ac531edde2735234521d9.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2584
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1412
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5028
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4844
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4432
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:540
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:780
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:992
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3380
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2608
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4200
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4332
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1296
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4600
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:2344
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3896
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1468
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4308
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:780
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:1112
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:384
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3736
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1384
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2736
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:2960
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1704
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:1196
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3960
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4500
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4144
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2372
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:852
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:8
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2912
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3272
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2024
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3492
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1820
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4832
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3896
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3084
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1948
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4940
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2596
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:1256
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1112
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4436
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:4928
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1460
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:3864
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4716
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4072
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:4776
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:1616
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3240
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3068
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4836
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:396
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3848
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:4640
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3328
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1336
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4600
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2012
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:1892
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3940
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:5056
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:3884
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:3052
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:720
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:4996
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4960
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:2636
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:4284
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:4248
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:4068
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4992
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:4892
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2460
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:372
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:2372
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:3848
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:4220
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:436
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:3140
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4512
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3972
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3960
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2272
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1952
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4572
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:464
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4196
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1212
                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4048
                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4172
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4928
                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5060
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3896
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4272
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3080
                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:2184
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4088
                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:3932
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1072
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2812
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:916
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5028
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2024
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:856
                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3124
                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3036
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3504
                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:3600
                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:3968

                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    471B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    b72ad0845c65fb0923e559d9f8f7d280

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    9161c7562ff7ccbbdda6f17916238a6fc2cc219b

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    caf7703f66a4291cfaa99b8a4667759c5cf3630435c2bbcec2dad82d5c52b67c

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    4200d0f0ccf842bf60f10bc2264761931e4cb490645f7b8a25fd832c54d60ee486ccd1eb81de427743ad1c5759def4024f71b6f71ffbd592c3e089af7ad3c56d

                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    412B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    21b8723aa4e752b38819fe151e493bf3

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    18520747905c14cd3094608f0243dd51595f03a4

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    a29866849ea47579f8797c778100050070debafac3ab1c3ef0c7b08edfc22a8e

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    a427642ff1a183401fb621eb2348d0bf2de16fd4a105a4fca1d813c5aef1f9f83991c82495801dc0b8e2311278a8a527f83c92b092bab8386a88f577740d8f30

                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    eeb7701cc55d1c4e94597b909eb22706

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    e557203aa32b95e10ac7b1aec29d66288146f6fa

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    98cba458329816a6efa6114e4eb9b18e3127e49d0d477e09f96ab0981c7cb208

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    0940852e34ab5d43c58f980cfb876d66bd57ee6c5e30d7333abbfaf33e95f5def8132cd98b311aac989e10b68170af6cb551baa1de9a033f292232e2ace72f93

                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2C1DWAXK\microsoft.windows[1].xml
                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    96B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    e348d00fe7b19d8e8f6efc5cd8f3be59

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    de85b87da07da2e4b4215ef312d318f1b329ca6e

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    4ee26da36e3b7d5c9f14f2ed8d6c75c10434acec949dc6e550f176b9acb84dd7

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    a0a9a671e08cb35904098426cf1b50a11d6a0c7be57f684f9808f5c953ac2732dd1f090c3d12260870056a1ee5f9097ad9872715c798fba196d7212a536afcbe

                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                  • memory/540-14-0x00000000046D0000-0x00000000046D1000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-492-0x00000216CE4E0000-0x00000216CE500000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-458-0x00000216CD000000-0x00000216CD100000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-1111-0x00000232A2BD0000-0x00000232A2BF0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-1087-0x00000232A27C0000-0x00000232A27E0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-1079-0x00000232A2800000-0x00000232A2820000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-1075-0x00000232A1700000-0x00000232A1800000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-1074-0x00000232A1700000-0x00000232A1800000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-463-0x00000216CDF00000-0x00000216CDF20000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-474-0x00000216CDEC0000-0x00000216CDEE0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/1112-460-0x00000216CD000000-0x00000216CD100000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2024-860-0x000002893BCE0000-0x000002893BD00000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2024-837-0x000002893B700000-0x000002893B720000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2024-848-0x000002893B6C0000-0x000002893B6E0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2584-0-0x00000000006C0000-0x00000000006C6000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2584-11-0x00000000006C0000-0x00000000006C6000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2584-10-0x00000000751E0000-0x0000000075278000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    608KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2584-1-0x00000000751E0000-0x0000000075278000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    608KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2596-1072-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2912-829-0x0000000002F00000-0x0000000002F01000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2960-578-0x0000015577A00000-0x0000015577B00000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2960-594-0x0000015578900000-0x0000015578920000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2960-607-0x0000015578F20000-0x0000015578F40000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2960-583-0x0000015578940000-0x0000015578960000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/2960-579-0x0000015577A00000-0x0000015577B00000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3084-958-0x0000021126CC0000-0x0000021126CE0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3084-954-0x0000021125D60000-0x0000021125E60000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3084-983-0x0000021126C80000-0x0000021126CA0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3084-990-0x00000211272A0000-0x00000211272C0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3084-953-0x0000021125D60000-0x0000021125E60000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3084-955-0x0000021125D60000-0x0000021125E60000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3380-164-0x00000000041A0000-0x00000000041A1000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3736-576-0x0000000002E30000-0x0000000002E31000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3896-320-0x00000235EDCD0000-0x00000235EDCF0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3896-352-0x00000235EE2A0000-0x00000235EE2C0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3896-328-0x00000235EDC90000-0x00000235EDCB0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/3960-713-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4144-715-0x000002496EF00000-0x000002496F000000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4144-716-0x000002496EF00000-0x000002496F000000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4144-751-0x000002496FF80000-0x000002496FFA0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4144-752-0x0000024970390000-0x00000249703B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4144-720-0x000002496FFC0000-0x000002496FFE0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4200-180-0x000001AC2CF00000-0x000001AC2CF20000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4200-194-0x000001AC2D310000-0x000001AC2D330000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4200-166-0x000001AC2BE00000-0x000001AC2BF00000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4200-165-0x000001AC2BE00000-0x000001AC2BF00000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4200-170-0x000001AC2CF40000-0x000001AC2CF60000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4244-51-0x00000253C2B70000-0x00000253C2B90000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4244-33-0x00000253C2760000-0x00000253C2780000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4244-20-0x00000253C27A0000-0x00000253C27C0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4244-16-0x00000253C1760000-0x00000253C1860000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4244-15-0x00000253C1760000-0x00000253C1860000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4308-456-0x0000000004390000-0x0000000004391000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4600-314-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                  • memory/4832-951-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    Download