6c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1

Analysis

max time kernel
172s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
12-02-2022 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80805036184d9ff94a32bad39ba0a553.exe
Size

3.4MB
MD5

80805036184d9ff94a32bad39ba0a553
SHA1

4dfa5e8254755da7c2c589efb7467bd0b67aaa98
SHA256

6c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1
SHA512

b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b

Score

10^/10

evasion themida trojan

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 920 created 3480 920 WerFault.exe SearchApp.exe
PID 2724 created 520 2724 WerFault.exe SearchApp.exe
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

IntelRapid.exe

pid process

2316 IntelRapid.exe

description	pid	process	target process
PID 920 created 3480	920	WerFault.exe	SearchApp.exe
PID 2724 created 520	2724	WerFault.exe	SearchApp.exe

pid	process
2316	IntelRapid.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

80805036184d9ff94a32bad39ba0a553.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	80805036184d9ff94a32bad39ba0a553.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	80805036184d9ff94a32bad39ba0a553.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe

Drops startup file 1 IoCs

Processes:

80805036184d9ff94a32bad39ba0a553.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	80805036184d9ff94a32bad39ba0a553.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/412-130-0x00007FF712990000-0x00007FF7132B3000-memory.dmp	themida
behavioral2/memory/412-131-0x00007FF712990000-0x00007FF7132B3000-memory.dmp	themida
behavioral2/memory/412-132-0x00007FF712990000-0x00007FF7132B3000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
behavioral2/memory/2316-136-0x00007FF738040000-0x00007FF738963000-memory.dmp	themida
behavioral2/memory/2316-137-0x00007FF738040000-0x00007FF738963000-memory.dmp	themida
behavioral2/memory/2316-138-0x00007FF738040000-0x00007FF738963000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

IntelRapid.exe80805036184d9ff94a32bad39ba0a553.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	80805036184d9ff94a32bad39ba0a553.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

80805036184d9ff94a32bad39ba0a553.exeIntelRapid.exe

pid process

412 80805036184d9ff94a32bad39ba0a553.exe
2316 IntelRapid.exe

pid	process
412	80805036184d9ff94a32bad39ba0a553.exe
2316	IntelRapid.exe

Drops file in Windows directory 3 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2692 3480 WerFault.exe SearchApp.exe
2904 3480 WerFault.exe SearchApp.exe
3676 520 WerFault.exe SearchApp.exe

pid	pid_target	process	target process
2692	3480	WerFault.exe	SearchApp.exe
2904	3480	WerFault.exe	SearchApp.exe
3676	520	WerFault.exe	SearchApp.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exeSearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies data under HKEY_USERS 48 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4312"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4104"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893011602329096"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.160531"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe

Modifies registry class 49 IoCs

Processes:

SearchApp.exeSearchApp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1980"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7820"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7820"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7132"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1980"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7132"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2290"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7132"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2290"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7820"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1980"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2290"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

IntelRapid.exe

pid process

2316 IntelRapid.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid process

2692 WerFault.exe
2904 WerFault.exe
2904 WerFault.exe
3676 WerFault.exe
3676 WerFault.exe

pid	process
2316	IntelRapid.exe

pid	process
2692	WerFault.exe
2904	WerFault.exe
2904	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe
Token: SeRestorePrivilege	3556	TiWorker.exe
Token: SeSecurityPrivilege	3556	TiWorker.exe
Token: SeBackupPrivilege	3556	TiWorker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SearchApp.exeSearchApp.exe

pid process

3480 SearchApp.exe
520 SearchApp.exe

pid	process
3480	SearchApp.exe
520	SearchApp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

80805036184d9ff94a32bad39ba0a553.exeSearchApp.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 412 wrote to memory of 2316	412	80805036184d9ff94a32bad39ba0a553.exe	IntelRapid.exe
PID 412 wrote to memory of 2316	412	80805036184d9ff94a32bad39ba0a553.exe	IntelRapid.exe
PID 3480 wrote to memory of 2692	3480	SearchApp.exe	WerFault.exe
PID 3480 wrote to memory of 2692	3480	SearchApp.exe	WerFault.exe
PID 3480 wrote to memory of 2692	3480	SearchApp.exe	WerFault.exe
PID 920 wrote to memory of 3480	920	WerFault.exe	SearchApp.exe
PID 920 wrote to memory of 3480	920	WerFault.exe	SearchApp.exe
PID 2724 wrote to memory of 520	2724	WerFault.exe	SearchApp.exe
PID 2724 wrote to memory of 520	2724	WerFault.exe	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\80805036184d9ff94a32bad39ba0a553.exe
"C:\Users\Admin\AppData\Local\Temp\80805036184d9ff94a32bad39ba0a553.exe"
1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:412

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:2316

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2696

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3480 -s 4676
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3480 -s 4676
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3480 -ip 3480
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 520 -s 3852
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 504 -p 520 -ip 520
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\1UewCJeQh7H4TkEu4viPy9Nx7dE.br[1].js
MD5
f4413271ac0ca45888e312c3c47c90b8

SHA1
15e388f42d8e01294e2c86d437ffa19e4db5d9c5

SHA256
f31e966580294a5c9962fb4574bfe4dd586f43c41aabce56334df4ff37a08001

SHA512
1406a3db4afba4741143825256c26a0c0b867d0ab19f4df04093da3d7b5da33259a26cfd19f4b54d996a2bbbff2705e3feb0567895180d77dacc5503ea4ef03f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\98-tFzBbrLP3oaKdmZtyZ4BBBI4.br[1].js
MD5
129776db6ba6bea4af70cdb1ea56942a

SHA1
12bfe666c0b57b134e7b8b88bcf1a0c3b5dcf3cd

SHA256
2d55886903198e35295b8e90738da47859837baba26d47e15bac87f90ee608d3

SHA512
aedf99a152b97be6a57f0d1fb1dd43b0bb69508eae65b3a054024cd9e5dd59670ebeaff6ce7525e2b7263bbd7c963c30659628f9a2df16410674871538def94b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\BQR--Mi6Hdug9aUgfjMzORag63E.br[1].js
MD5
e515e69b21c49a355d5d4b91764abe00

SHA1
7571f85095e21ba061631d8a38d18623bcabf301

SHA256
365f8b7a23865ca36d1c1f7a25553afddb6223ff524b56d4beb80fdd98c8e057

SHA512
aa38791ce4ed4039a6d63cf6273be8ca0dde2436b8c6e0451937a85652d1c6ea22f38da9fd81ba9a4e877861b507603c88cacbbffe4e6b30ec602396f2b87a81

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\EFZQVfd-aT3vKh3O-kC_qyc_0q8.br[1].js
MD5
054ef7cd29256c88fd72b10c674eb111

SHA1
4a142e6fb51ab8475e54d159e12d065dea435aab

SHA256
e0368e053c9fb781eb26b3771883a41dd48da7da6a53b538e1b45dca1ae01f98

SHA512
9aff5e72da38891816024e0322c5488ea9a3c03a173da4dd9d55d22cd945f92376137ac70999e295605a4efe42a81a5fb858f3a08e6b27952364b0f22061f0f7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\HXQOmZnHKkJYgneadHww_IjOlxQ.br[1].js
MD5
8cd6f73e00f396b041f5a788f07d0f7e

SHA1
c2bbd29a876f140bdb76caea42e38cdc8ab98cef

SHA256
f6ee1bf110376f94b564e95a516562d214c1ff7bddf1b6080848cd855549d955

SHA512
a6b910f4a010ddb4fe7b3387fd58c3fe41b3cfd8afdc535293363c3775fa7cdd7c35613d0e5a40411cc76492eb069744655eb66049464163b6fc1468ec9822b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\Init[1].htm
MD5
5307c421e7742012c2e6e50b55c6a692

SHA1
39627e71729e4239cfe3ed4753f1c03e5913685d

SHA256
f3d48dd9e4f96749c12e8de0bb0da3a71fbb01e561caae9eebc903278744438e

SHA512
09531fa9423b41956ab34174d182b30ded11fafec219ad53db9be077a9ed6da25c2fd96972466e9fcd79cb0d6964a35ac95ee3563c092c63e571bb7bf9ffbc78

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\MDqPc1m5c6NCOcjcf9QO_UfJAUI.br[1].js
MD5
ad2956117b3bb3b8ded1d5a8945728bd

SHA1
ce98bf78b2076eeb264366999e5d390ab506b8ad

SHA256
f056e55c0288ea309b2a0df00efc4da32f79f4abc9ec851e20fae2831dc5f3bc

SHA512
8c991c7db99ffd12e607dc6a05a2da7369b8d2a6a6760682d670e2cde30d92cef511f522f1cfedd8e20a6cc91b1d766832fa89830c495cac992316049d8a2c02

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\MOF_GzvGOii0VGtOHdGSeaiR5wU.br[1].js
MD5
0f840e90799c8d250ea8ea2234595c48

SHA1
eb98e01f0d08cc8bd1db90c4fa0cf44a5f0f8d18

SHA256
60a08c1085b345c14ba09682600a94167ba4e17774ceabff3f9e605c962c3dd8

SHA512
8acaac7d5b3bd37014c70c442b40f50315a237b4decf75242da52b66a471f497bb02ecb7d13365e398a208280ff0a2c36f017b72a02d671767942ebe6c293bfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
MD5
77373397a17bd1987dfca2e68d022ecf

SHA1
1294758879506eff3a54aac8d2b59df17b831978

SHA256
a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13

SHA512
a177f5c25182c62211891786a8f78b2a1caec078c512fc39600809c22b41477c1e8b7a3cf90c88bbbe6869ea5411dd1343cad9a23c6ce1502c439a6d1779ea1b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\U006EeMfq1iK7IAAM8DJcfY519o[1].css
MD5
17d579f86147ac3b11056da41a9d5e89

SHA1
a2b67ea1edfaa6591541d9169bdd0b91efa1efbb

SHA256
b0595825dff390fcf05e06dd2d9e52a8fd1f0fba04c53a56fd38b0faedaf1fdb

SHA512
f54c5ec8ee0d5544589880bdce0a7ac3858bab338c75231d39a13c6df1ddfbfa8868645822380fceb65c265ab85415786c9fd6a16710c2580a627f14220d702e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\VzcZsC_3g7JMdxylSPgw0bVs1HU.br[1].js
MD5
49a075063ef221262f95146467d3eb14

SHA1
f8fe5f85247a6fa11be9a3c42767dea61305e56b

SHA256
79da5675057a9b5ed8791701104d4c90d75dda1c9f30ee04040046e2edf09862

SHA512
954bc47e819234685a53a66d81f5fd98cd5f0ece4530d8311ca1aeb8d5f2a661b520cb9fa2a3ec6a882e39672842cf868a8590434ff13dea435e18bb86c151ec

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\WHnOpzzEZzQlWY6EuSOq71UjlFQ.br[1].js
MD5
a8b8e973c9c03929909468b4f8948fd1

SHA1
a74e8b038275662b495b3675f5d16951ac6bc36f

SHA256
cff0579a26d744de2486d7699d0b05df1de4e51ffd2e58c8aa21d3c5eb62e74d

SHA512
ee27cfbfc501a74668bb2a720d81569956a31897d5877afd30c238a772c7cf525a9fa4deade5a01413701cac9656576ffc2aae5b04c25a567fa4f0b7c1f795ad

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\Yi3Flkft8YS8nbd9qCHjIlXAHPg.br[1].js
MD5
6859b06c69a93bd325d6cdb2a5cecbd4

SHA1
5f1b96c6e59054c14d1ee9a3f3a2cbbc70e03b87

SHA256
6a232348034a0564b74d8a293ac8dc15664e26664cd4e071e1d2e740b76d9ec6

SHA512
9166d92cbf6945282259a2ca8d53f6d5986ff81de3d61c191d44a745b093936e21e71132833cb885a829c9bf9e4ce42618bd5e995b7a24929436615df35e91ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\_6kcejpIrJTtxudclBiss_A-0_g[1].css
MD5
5fa42803ad27f35eef70ccfb471435d5

SHA1
fe74ed39acfc0e18885dbf1c61b04d87e44bdeb6

SHA256
f611daf8888d818ab050660b581cf108816c7141f2f8d3fbff3deb7b3448c1b4

SHA512
6ad4793ae7834d9fc019f2df535a58e34fd8da2cf9d280770003690777d13ade78a3065af4a7f8fcdf8e80b880c0f9f39ea42a65a8924e2a64fed102116a13d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\_F0M0yoTmc2b-_eS3W0Eu-fGENs.br[1].js
MD5
e86abefe45e62f7e2f865d8a344d0b6f

SHA1
5d4a0a597759412da2b8e9efd1affe8305e7d116

SHA256
5d54790c856ce13811590e18ac3b0aceefefb61258852490f4c5c60748365e89

SHA512
7903c3046865e3d1db040d66b2c052e3e56f791bc035c56d5fc76b28166dc88fdf6212699f98ee598fa6ba76222dd2da9e428f6662430776edbb4982a232c595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\d2T4nDEu_NCR0uTkcxXxtTyQgzk.br[1].js
MD5
a93ba0ef88e6459f610a704d4fb63949

SHA1
5e3d0005113b8302ee6f055eecb1e4a6ed7317ff

SHA256
2e89ba4799bb426bc4109677a4104c55aa6e8abc5d4fe3b06c53cc00952ec2cb

SHA512
22b753a2a9e5e35cb061bba431dd1ccc774182edcb5f11f7435134f3b9b06cd0095bd505fb0af60ddb753f6556411f2804e8aa4a3f68fec112676284d60138a9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\jz5JHWe_2WCod7u1RNWmByRezL4.br[1].js
MD5
e9e0f2c7d9ff4e7ba872a004593454b5

SHA1
2db69a5f85d5afd2c523f8f6b8867eaa4e1125f9

SHA256
24d847fbf4fd59be3529fdfa7542fd3fe9512662927dd482e60d11344175e778

SHA512
f01ac1fed499aab6465f3f1fea96b5036043c260dd8a9029046895768794503264a98e41cc306f54557eac74c228af9a65a1e6cbdcfe6b4e0e8bbbd730f6a6a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\n0tAjrh0OUxqjqlSPvO1hybRfiY.br[1].js
MD5
7eb9fffdd41917ea831cadcb06973122

SHA1
1602980da42cfb114acb040f5b065b309f4825b8

SHA256
f36fc58ba6d065464053feed391c1a5d6771af7ffaa4a141ac313a1e08b8e527

SHA512
5880db8d3296978bb6a684ac1465ff55c9a0e7e0fe4dc61c48ad6b22f0a59e4bd88d37fc45a71a3de505da25352ee26d014f91de5b82df66e89d1a2f24507493

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\obTY3qKq0d8OC7nv1dy1IdMW4CA.br[1].js
MD5
a1ef6743d774fc65c9d28fbfa6445c61

SHA1
5ecec227bc3fa6e4c6f8e20bef490855a76976fe

SHA256
3283bbec60497f7fb896e1b4af3f65423b860992c72d3fbce565ee02f22dcb4f

SHA512
ead9d5995938903a5a9c7af87e481b191ffcd9e3bf810900aca11b40e5557f26da23faf0629892ae58e11b1a94231a0ee73062f4a92e35bd1dda071a2736c154

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\onra7PQl9o5bYT2lASI1BE4DDEs[1].css
MD5
d167f317b3da20c8cb7f24e078e0358a

SHA1
d44ed3ec2cde263c53a1ba3c94b402410a636c5f

SHA256
be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad

SHA512
afc65b0fa648d49a5eb896be60331aa222301894e228fe5684399e9276342f6510773dffa3e7e75b8d6197bc51c732bc7fd7518e593ecd20c4884c47058d46d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\s1QRPzn0kGP9oIe5MgvHjNWUeTg[1].css
MD5
d586d74b25707cc825084d7cf28b7d4c

SHA1
282d0ab4dd664394ec2e27cd397aa5a4b300a2df

SHA256
17b4fe5c808876dd59a4850611abacfce27db632fd2ad6319c3edca091908b3d

SHA512
4c460f9a1d7a07b848e3cf9b5bc850055f7831ec56d37c41ada05765f81142e55322a53b88c587a53618a9b9426740dd11595eaeddf0f38b8a81a0a459bc0805

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\sXBfecFatLi3whWPUBtJfpuWh1c.br[1].js
MD5
5ded92d7f1ee49b84790bbe102ec589a

SHA1
6b7ed89c1227d34d203d8c19e4f2d4e513283203

SHA256
31227d0dcf2dd1a62d23fd3216430658fc55d4fc190e156a3fd8e9f45cbc9919

SHA512
9deb62d1dfe98e49f57294e71eee7dab0e34d1efb62153f0e870ef694111691347ccbe80ba3633f5bc2bc2680fa003e808fe0b88fb74bd18ae21c9c243cc4ac2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\tUWuyrvoBg6nl4pYbN1MpS_9cCI.br[1].js
MD5
49e407560d19719fa0e87ecb0a20abb9

SHA1
bd4c25762056256da805893c7409cb423ec20b95

SHA256
b400da645d6ab5fcf581538501e97278f255dc975454c84e07875a2320571045

SHA512
ae402a1805e828ead281b96304019aaf6980cffb8e39e40413b9d5c89a2078c73423f0cdfcf2e4a25518fae9e42f660c81955288fa28d1bb62e7f6dd2cfa3595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\weVEqwvEjQTO1AQLhywy4-gNLgw.br[1].js
MD5
ffdab333e6bdfc440d52fd0981b242b8

SHA1
70fbea15c005216ae985f4c3ef83ac2e7c50711c

SHA256
a1706ffd6a8f21a07879826d0a5aa653483a2767b806de53ee208e5e0b4483a7

SHA512
c8affed8c9bb548dfcbcedaad4a1f05b0de62889a11353b78ae986fbb161202324766baf9d1125e72a4451771e28828cc980d9348769f321c24f4e203ad5c8fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\x0Cvpg0MmmBx9EUGxLDfa2xcV-E.br[1].js
MD5
23c987e711c002d4ca3cd02deedc9bbf

SHA1
c0c26b66ea6793fa884f143e76cb9ad2e0109c7c

SHA256
a1c2f4c8ca6113ebdac36f2c33d6ce19bcf2f4bd99ec06e8ba845e2b25b03322

SHA512
969bc04d69f629f08585c7c2ee23e998d8c91146b912370cf9886a7f0b067e68654a9581c0203da522d30533871e41c1b96bf60f18091b6c7eb86d1a863b5d06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\zEQqhwKoETyGdQapOnP2uL1FFF0.br[1].js
MD5
30f68a3ea9f8fe63101e59ced32fa3e7

SHA1
0450964533a5363f20fd7a7ae16821cdfc1fcc1d

SHA256
90fccf6342d5bcfde3f69f88b80253ec694b9b901cc55fd84a2e0c6e0ff05caf

SHA512
f994377757539611fe2781b6aeedcfe2b2c7073516c0f3887c0fd836e1ed69066daabe7065dae1fc4aa071f8f5080939591b3ebd4642b1eaa42c7b25c2003349

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\INetCache\CU387W9N\fFSXkj1t_zfXRNULqSUNux82Lcw[1].js
MD5
4f97cdbdb0fa8bf1cb77389c60e17c55

SHA1
6ff3550b0125ced54e298ea5524177e0340ee7d9

SHA256
612cf023657f77a9562eb932196bc955ee924ba71e7f45e71d64a14c60130822

SHA512
71ff47996aadd361eedfe96da581243e8561bf1582ab71edbce604714e17b1c5a9249004f6447e486082f6984a3342a80bbc14709c670d886722fb031c92875e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
643eb7f6fc11cf8822926dacfaaffaed

SHA1
0dcceca65977f4829c8a82745ca5fec96331cdb4

SHA256
d9b11ae7fe98c0472ab7300739009293021a2f5f9974147fa17880ac5177b5bf

SHA512
bafce51b7cf82cf546c5ebfb3b4aa23fc851a07f7d7986d6518f8cc8ac00abf0137af4177d215220ae2283b96afe0d6c2268515141e3b9504cce9c4c2654179d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
a53e3e8d1216017eb3de5f7423000e51

SHA1
06d6df5cae86655b28090569edaa255ca88f6d1d

SHA256
f8807f703a0bfdc1cdf0089f96152fb05a9da0b1320ecf7f9d0f721a2139e38e

SHA512
cf9deeee77be5eb753da2a4030eeb26bc17cc9b4658fbeac42d13539a5d9a232a25c8b896b68e94c5277afb280c6fd91cf133b3c29007a4b031019695014363d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RU1N0LOI\www.bing[1].xml
MD5
3be32fa2a5e952ab0b196321cfe30873

SHA1
171780c7d2672837ddc64030cd3f3f1b676d55af

SHA256
16128edc0d94b06e674d9cad192be6faa81e57ba6811a1279e6b2fed002bae8d

SHA512
a42c9e8ae7f8fdb8e3eb14832065da0f9d6c84b585799c4ef8530c7ca0b6c018804cc972b786864d35ea8e536a390408f75108c42a2f330a9fe13b92e9fd0e20

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
80805036184d9ff94a32bad39ba0a553

SHA1
4dfa5e8254755da7c2c589efb7467bd0b67aaa98

SHA256
6c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1

SHA512
b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
80805036184d9ff94a32bad39ba0a553

SHA1
4dfa5e8254755da7c2c589efb7467bd0b67aaa98

SHA256
6c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1

SHA512
b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b

Download Submit
memory/412-132-0x00007FF712990000-0x00007FF7132B3000-memory.dmp

Filesize
9.1MB

Download
memory/412-130-0x00007FF712990000-0x00007FF7132B3000-memory.dmp

Filesize
9.1MB

Download
memory/412-131-0x00007FF712990000-0x00007FF7132B3000-memory.dmp

Filesize
9.1MB

Download
memory/412-133-0x00007FFE874F0000-0x00007FFE874F2000-memory.dmp

Filesize
8KB

Download
memory/2316-138-0x00007FF738040000-0x00007FF738963000-memory.dmp

Filesize
9.1MB

Download
memory/2316-136-0x00007FF738040000-0x00007FF738963000-memory.dmp

Filesize
9.1MB

Download
memory/2316-137-0x00007FF738040000-0x00007FF738963000-memory.dmp

Filesize
9.1MB

Download