Analysis
-
max time kernel
164s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 07:14
Static task
static1
Behavioral task
behavioral1
Sample
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
Resource
win10v2004-en-20220113
General
-
Target
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
-
Size
54KB
-
MD5
86de4891b15f1e5288809ad893ff83d3
-
SHA1
b67fffd9e2f076b2990e41f4e7bd57036f9e558c
-
SHA256
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b
-
SHA512
cb96daa8d0c76ffc43f5ec477d33f6b8544d248ba3f07ad7c09517e4694cdd14a63136102e69a06740d9b234be6533524630f3caf952c26c2c869090fde4c70c
Malware Config
Extracted
C:\how_to_back_files.html
http-equiv="Content-Type"
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1388 created 4348 1388 WerFault.exe SearchApp.exe PID 3740 created 1536 3740 WerFault.exe SearchApp.exe PID 4864 created 4424 4864 WerFault.exe SearchApp.exe PID 3988 created 4880 3988 WerFault.exe SearchApp.exe PID 4280 created 3276 4280 WerFault.exe SearchApp.exe -
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exedescription ioc process File renamed C:\Users\Admin\Pictures\NewBackup.crw => C:\Users\Admin\Pictures\NewBackup.crw.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Pictures\RedoMove.tiff 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\RequestDebug.raw => C:\Users\Admin\Pictures\RequestDebug.raw.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\SubmitRemove.raw => C:\Users\Admin\Pictures\SubmitRemove.raw.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Pictures\EnterCheckpoint.tiff 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Pictures\InstallDismount.tiff 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\InstallDismount.tiff => C:\Users\Admin\Pictures\InstallDismount.tiff.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\RedoMove.tiff => C:\Users\Admin\Pictures\RedoMove.tiff.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\RegisterStart.tif => C:\Users\Admin\Pictures\RegisterStart.tif.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\UpdateMeasure.crw => C:\Users\Admin\Pictures\UpdateMeasure.crw.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\ConvertToStop.crw => C:\Users\Admin\Pictures\ConvertToStop.crw.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\DismountRead.png => C:\Users\Admin\Pictures\DismountRead.png.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File renamed C:\Users\Admin\Pictures\EnterCheckpoint.tiff => C:\Users\Admin\Pictures\EnterCheckpoint.tiff.ONYX 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe" 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe -
Drops desktop.ini file(s) 23 IoCs
Processes:
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exedescription ioc process File opened for modification C:\Users\Admin\Videos\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Music\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Music\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Videos\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Documents\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Links\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2292 4348 WerFault.exe SearchApp.exe 3676 1536 WerFault.exe SearchApp.exe 4960 4424 WerFault.exe SearchApp.exe 396 4880 WerFault.exe SearchApp.exe 1652 3276 WerFault.exe SearchApp.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 18 IoCs
Processes:
SearchApp.exeSearchApp.exeWerFault.exeSearchApp.exeSearchApp.exeWerFault.exeWerFault.exeWerFault.exeSearchApp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 64 IoCs
Processes:
SearchApp.exeSearchApp.exeSearchApp.exeSearchApp.exeSearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4496" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6301" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8106" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "22" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6301" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8106" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4496" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2691" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "22" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4496" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8106" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2292 WerFault.exe 2292 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 396 WerFault.exe 396 WerFault.exe 1652 WerFault.exe 1652 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exeTiWorker.exedescription pid process Token: SeShutdownPrivilege 1972 svchost.exe Token: SeCreatePagefilePrivilege 1972 svchost.exe Token: SeShutdownPrivilege 1972 svchost.exe Token: SeCreatePagefilePrivilege 1972 svchost.exe Token: SeShutdownPrivilege 1972 svchost.exe Token: SeCreatePagefilePrivilege 1972 svchost.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
SearchApp.exeSearchApp.exeSearchApp.exeSearchApp.exeSearchApp.exepid process 4348 SearchApp.exe 1536 SearchApp.exe 4424 SearchApp.exe 4880 SearchApp.exe 3276 SearchApp.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1388 wrote to memory of 4348 1388 WerFault.exe SearchApp.exe PID 1388 wrote to memory of 4348 1388 WerFault.exe SearchApp.exe PID 3740 wrote to memory of 1536 3740 WerFault.exe SearchApp.exe PID 3740 wrote to memory of 1536 3740 WerFault.exe SearchApp.exe PID 4864 wrote to memory of 4424 4864 WerFault.exe SearchApp.exe PID 4864 wrote to memory of 4424 4864 WerFault.exe SearchApp.exe PID 3988 wrote to memory of 4880 3988 WerFault.exe SearchApp.exe PID 3988 wrote to memory of 4880 3988 WerFault.exe SearchApp.exe PID 4280 wrote to memory of 3276 4280 WerFault.exe SearchApp.exe PID 4280 wrote to memory of 3276 4280 WerFault.exe SearchApp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe"C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:4536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4348 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4348 -s 45322⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:1312
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 4348 -ip 43481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1388
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1536 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1536 -s 42442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3676
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 1536 -ip 15361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4424 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4424 -s 38842⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 504 -p 4424 -ip 44241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4880 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4880 -s 39602⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:396
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 4880 -ip 48801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3988
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3276 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3276 -s 38842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 540 -p 3276 -ip 32761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ad264abb-df4c-4877-9012-f500265c5c51}\Apps.ft
MD55dc7c685f78dcf159dcf969090688b5e
SHA136154b5ada14d2331ef0e369ef688edcc455e2dd
SHA25650caf3a9f4a9337de01b82a2c2de6732a19c6d6c5c69e77c181bbf07a7c50254
SHA512cb25ea7882770502e2625c14d9621c5f0bac99f2bad59cd325aded4c910aba1c112ec173e03123ebfd60dbe5558d73d1616b2d342620f874a7f97aa09cddc94b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ad264abb-df4c-4877-9012-f500265c5c51}\Apps.index
MD5df753fba91757c2bcfd17ff736b51770
SHA1af24ed3aa4187b045a39586601bcd9b041060249
SHA256997f1a4992609df8fc4fd9e3f9bb315f0ff8339fa7b27813d39977ddb84ce307
SHA512fcb54c348ccb3cb2f941663cd4294f4bf0630cebb85a09efc6202f21201e7beebd4583f2d1ce5838a0fee5bcf1e4773952d9e8f3ab722c18189dda93b0c5e176
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache132890382830401256.txt
MD5284047b820bb63374114d72707839d53
SHA19469b4b936fca0df40b805b2f4712c1f6af73aef
SHA25621252f386747af89a5e7593dca48eccc66908b9cd95796ef641f79640a2d4771
SHA5127cadcea59b2d374d06ff259001a43cd1d60cc9b1bae9fd7e5d64759942fa0934cd11303dbf0cfc6712cc79fa68199a3da3cf0febae16823b136b5d00708120de
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F
MD59c6832d00a42c7b402ffe4e80eb7ba70
SHA16fe7005327d1454bddc1b07dcc0e764d8b672da5
SHA25627df51409220ffadc995c144c7cfddd0305bc7f8fbde95c22a7cb86868bba1b7
SHA51267c67f9c84878bd451ce48ea6cae93d4d3c812dfe0d440e5baaab4449f0bbbc91037024be00d009098166cae76f1f1880c232378e86eb1b3cf4b54365a6e80a4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
MD57e553c78190eeb77ee936acd7c762bc2
SHA1d4c07aa2d9a525310c46ec852e1787b2c72db54a
SHA25610da1ff5fe39f7f6ab32d50660a4271a3d2c515d48fb2b84c8851af688376daa
SHA51280c0a29ede8a1586902baa9fe74308088f1eef318914936319f9fdee6e96013dae9477805bf85d01f46a3163360c226351084e3f4e112980d3989dcc078dd8a7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml
MD501c099bc767fefd0f92ef60db3e4c074
SHA1d6930ffeda6f0f268b11ecfccd3d086a76171732
SHA25664e2d3998d69a8869ae1622f95f51d21e70625c71ec0eddb39402fbac34b221d
SHA512f0b1f728e5980d757534662c002eea6f2fc9c14e7a6b667fcf39376b52f1bec52f36823dd3c6fbfea62cedb18340a7b9f8ae15a7dc6e135b591feea9d66c64d3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml
MD57ca3bf662e8c25e8cdb50453ab30d44b
SHA1175f1de0a865584647d309801c597a1c94ebb5f9
SHA256ed0a49c3174a9db10490aedc6d2aa785da644ce13ff24dfd40fec551c0d9b350
SHA51290e16f3a4a414d276a1233ec25844a2ca8e6b64e54c168c812795dac3c53c75324bcf6bfe59fee7ddb6ffc2eea2ecee9e5db28ebccf774ab6fc7d919fff3a663
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml
MD524a0ec00afb936024834923aa0096aac
SHA1e863d1613664620d05c910d3efe90972e0c04eb5
SHA2568bba3d307e737c9cc4692fdcd9a5df8d362dffbcd18ac94089a3272b78e64e98
SHA5124de523c73b6e863a5cdc44f70346abd27416d303505c839bcf84f2639faf6c04c130430ecb2ce292aca1737a3fbb75a516c3ea7e4a5a9aadae9b4195cc9f17ee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xml
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed