595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532

Analysis

max time kernel
176s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
15-02-2022 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
Size

3.2MB
MD5

b3a3605b1768e34126afb8cb065a1ef9
SHA1

1aa6029292bf5c72b03e62ec8708ba992da0ec9b
SHA256

595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532
SHA512

f8c5cc965ea6c4fd660934d5c074849c6d20ec5e5bea2d0b8dae609bc88147f11d91cc2b994f8e60ff08eaed28cd57a5cbf272ea5a6b7522ed2c2e9adf22d8bd

Score

10^/10

evasion themida trojan

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 624 created 1576 624 WerFault.exe SearchApp.exe
PID 3028 created 3260 3028 WerFault.exe SearchApp.exe
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

IntelRapid.exe

pid process

3992 IntelRapid.exe

description	pid	process	target process
PID 624 created 1576	624	WerFault.exe	SearchApp.exe
PID 3028 created 3260	3028	WerFault.exe	SearchApp.exe

pid	process
3992	IntelRapid.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IntelRapid.exe595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe

Drops startup file 1 IoCs

Processes:

595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/464-130-0x00007FF70B8A0000-0x00007FF70C1A6000-memory.dmp	themida
behavioral2/memory/464-131-0x00007FF70B8A0000-0x00007FF70C1A6000-memory.dmp	themida
behavioral2/memory/464-132-0x00007FF70B8A0000-0x00007FF70C1A6000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
behavioral2/memory/3992-136-0x00007FF6D8480000-0x00007FF6D8D86000-memory.dmp	themida
behavioral2/memory/3992-137-0x00007FF6D8480000-0x00007FF6D8D86000-memory.dmp	themida
behavioral2/memory/3992-138-0x00007FF6D8480000-0x00007FF6D8D86000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exeIntelRapid.exe

pid process

464 595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
3992 IntelRapid.exe

pid	process
464	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
3992	IntelRapid.exe

Drops file in Windows directory 2 IoCs

Processes:

TiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2320 1576 WerFault.exe SearchApp.exe
3740 3260 WerFault.exe SearchApp.exe

pid	pid_target	process	target process
2320	1576	WerFault.exe	SearchApp.exe
3740	3260	WerFault.exe	SearchApp.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exeSearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3580"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.086655"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3572"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.666605"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe

Modifies registry class 55 IoCs

Processes:

SearchApp.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7429"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7429"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6741"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9254"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2294"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2294"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1982"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2294"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7429"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "9254"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1982"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1982"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6741"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6741"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "9254"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

IntelRapid.exe

pid process

3992 IntelRapid.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exeWerFault.exe

pid process

2320 WerFault.exe
2320 WerFault.exe
3740 WerFault.exe
3740 WerFault.exe

pid	process
3992	IntelRapid.exe

pid	process
2320	WerFault.exe
2320	WerFault.exe
3740	WerFault.exe
3740	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe
Token: SeRestorePrivilege	2840	TiWorker.exe
Token: SeSecurityPrivilege	2840	TiWorker.exe
Token: SeBackupPrivilege	2840	TiWorker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SearchApp.exeSearchApp.exe

pid process

1576 SearchApp.exe
3260 SearchApp.exe

pid	process
1576	SearchApp.exe
3260	SearchApp.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 464 wrote to memory of 3992	464	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe	IntelRapid.exe
PID 464 wrote to memory of 3992	464	595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe	IntelRapid.exe
PID 624 wrote to memory of 1576	624	WerFault.exe	SearchApp.exe
PID 624 wrote to memory of 1576	624	WerFault.exe	SearchApp.exe
PID 3028 wrote to memory of 3260	3028	WerFault.exe	SearchApp.exe
PID 3028 wrote to memory of 3260	3028	WerFault.exe	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
"C:\Users\Admin\AppData\Local\Temp\595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe"
1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:3992

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Modifies data under HKEY_USERS
PID:2528

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1576 -s 4592
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1576 -ip 1576
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3260 -s 2528
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3260 -ip 3260
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\98-tFzBbrLP3oaKdmZtyZ4BBBI4.br[1].js
MD5
129776db6ba6bea4af70cdb1ea56942a

SHA1
12bfe666c0b57b134e7b8b88bcf1a0c3b5dcf3cd

SHA256
2d55886903198e35295b8e90738da47859837baba26d47e15bac87f90ee608d3

SHA512
aedf99a152b97be6a57f0d1fb1dd43b0bb69508eae65b3a054024cd9e5dd59670ebeaff6ce7525e2b7263bbd7c963c30659628f9a2df16410674871538def94b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\BQR--Mi6Hdug9aUgfjMzORag63E.br[1].js
MD5
e515e69b21c49a355d5d4b91764abe00

SHA1
7571f85095e21ba061631d8a38d18623bcabf301

SHA256
365f8b7a23865ca36d1c1f7a25553afddb6223ff524b56d4beb80fdd98c8e057

SHA512
aa38791ce4ed4039a6d63cf6273be8ca0dde2436b8c6e0451937a85652d1c6ea22f38da9fd81ba9a4e877861b507603c88cacbbffe4e6b30ec602396f2b87a81

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\HOhdXCKkBPR8PmokqHlb8CDEo80.br[1].js
MD5
84a0c76f3f238f7042f2b66d630e2394

SHA1
8e01fa294bde8506779debbec69a8be6a96229be

SHA256
b6054f01a5caec71547c334bc317df0c327be6a65d9dd4dd99b0ae169e0845bb

SHA512
7bc240122219f4badd8b30f9e10be854975ebd0fc8b7ebf4e0d944645d52a5619087628476770b29b1ada6ce7145773d27ce1525c6ce0cdc75f725b5b5846368

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\HXQOmZnHKkJYgneadHww_IjOlxQ.br[1].js
MD5
8cd6f73e00f396b041f5a788f07d0f7e

SHA1
c2bbd29a876f140bdb76caea42e38cdc8ab98cef

SHA256
f6ee1bf110376f94b564e95a516562d214c1ff7bddf1b6080848cd855549d955

SHA512
a6b910f4a010ddb4fe7b3387fd58c3fe41b3cfd8afdc535293363c3775fa7cdd7c35613d0e5a40411cc76492eb069744655eb66049464163b6fc1468ec9822b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\HspBKvp4yTgrXo_p0J4XbIuuGuw.br[1].js
MD5
f64820ea8406646c68547983002f25fe

SHA1
204a38feb58c082f6361a3c1072c10575b02fff7

SHA256
0a63f13c0c05b9027bd896780b1ee99c30db9bf5b377a318d5b3211ffb9a3ee3

SHA512
ece265cae6978a1b88a5821e6d2a90adc6607131b8e2165adf15025c723fbf864f2ff1695a83a124110d7321ef7c0834f3160d44ab28cae1902f6bd9700999c6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\Init[1].htm
MD5
5329bdfe51e9d201dbaabff9ce07a9e8

SHA1
7f9eaafd0a640d34270531134520c84ce79f4714

SHA256
e0bf2258e906f294a912d4fd8fffa86acc05219b9f7bb59f8681bf456c03a3cc

SHA512
139024547fda0ddb36912fe47405ef032a275603700bb48b5ae5786cfff3de8c587321a41b4d950d43eb9487b7338826cdebedae873913d095cacb14b1d4ef20

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\MDqPc1m5c6NCOcjcf9QO_UfJAUI.br[1].js
MD5
ad2956117b3bb3b8ded1d5a8945728bd

SHA1
ce98bf78b2076eeb264366999e5d390ab506b8ad

SHA256
f056e55c0288ea309b2a0df00efc4da32f79f4abc9ec851e20fae2831dc5f3bc

SHA512
8c991c7db99ffd12e607dc6a05a2da7369b8d2a6a6760682d670e2cde30d92cef511f522f1cfedd8e20a6cc91b1d766832fa89830c495cac992316049d8a2c02

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\MOF_GzvGOii0VGtOHdGSeaiR5wU.br[1].js
MD5
0f840e90799c8d250ea8ea2234595c48

SHA1
eb98e01f0d08cc8bd1db90c4fa0cf44a5f0f8d18

SHA256
60a08c1085b345c14ba09682600a94167ba4e17774ceabff3f9e605c962c3dd8

SHA512
8acaac7d5b3bd37014c70c442b40f50315a237b4decf75242da52b66a471f497bb02ecb7d13365e398a208280ff0a2c36f017b72a02d671767942ebe6c293bfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
MD5
77373397a17bd1987dfca2e68d022ecf

SHA1
1294758879506eff3a54aac8d2b59df17b831978

SHA256
a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13

SHA512
a177f5c25182c62211891786a8f78b2a1caec078c512fc39600809c22b41477c1e8b7a3cf90c88bbbe6869ea5411dd1343cad9a23c6ce1502c439a6d1779ea1b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\U006EeMfq1iK7IAAM8DJcfY519o[1].css
MD5
17d579f86147ac3b11056da41a9d5e89

SHA1
a2b67ea1edfaa6591541d9169bdd0b91efa1efbb

SHA256
b0595825dff390fcf05e06dd2d9e52a8fd1f0fba04c53a56fd38b0faedaf1fdb

SHA512
f54c5ec8ee0d5544589880bdce0a7ac3858bab338c75231d39a13c6df1ddfbfa8868645822380fceb65c265ab85415786c9fd6a16710c2580a627f14220d702e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\WHnOpzzEZzQlWY6EuSOq71UjlFQ.br[1].js
MD5
a8b8e973c9c03929909468b4f8948fd1

SHA1
a74e8b038275662b495b3675f5d16951ac6bc36f

SHA256
cff0579a26d744de2486d7699d0b05df1de4e51ffd2e58c8aa21d3c5eb62e74d

SHA512
ee27cfbfc501a74668bb2a720d81569956a31897d5877afd30c238a772c7cf525a9fa4deade5a01413701cac9656576ffc2aae5b04c25a567fa4f0b7c1f795ad

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\Yi3Flkft8YS8nbd9qCHjIlXAHPg.br[1].js
MD5
6859b06c69a93bd325d6cdb2a5cecbd4

SHA1
5f1b96c6e59054c14d1ee9a3f3a2cbbc70e03b87

SHA256
6a232348034a0564b74d8a293ac8dc15664e26664cd4e071e1d2e740b76d9ec6

SHA512
9166d92cbf6945282259a2ca8d53f6d5986ff81de3d61c191d44a745b093936e21e71132833cb885a829c9bf9e4ce42618bd5e995b7a24929436615df35e91ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\_6kcejpIrJTtxudclBiss_A-0_g[1].css
MD5
5fa42803ad27f35eef70ccfb471435d5

SHA1
fe74ed39acfc0e18885dbf1c61b04d87e44bdeb6

SHA256
f611daf8888d818ab050660b581cf108816c7141f2f8d3fbff3deb7b3448c1b4

SHA512
6ad4793ae7834d9fc019f2df535a58e34fd8da2cf9d280770003690777d13ade78a3065af4a7f8fcdf8e80b880c0f9f39ea42a65a8924e2a64fed102116a13d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\_F0M0yoTmc2b-_eS3W0Eu-fGENs.br[1].js
MD5
e86abefe45e62f7e2f865d8a344d0b6f

SHA1
5d4a0a597759412da2b8e9efd1affe8305e7d116

SHA256
5d54790c856ce13811590e18ac3b0aceefefb61258852490f4c5c60748365e89

SHA512
7903c3046865e3d1db040d66b2c052e3e56f791bc035c56d5fc76b28166dc88fdf6212699f98ee598fa6ba76222dd2da9e428f6662430776edbb4982a232c595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\h6VZ4iIbyChYfadWUA6ReyL9idw.br[1].js
MD5
2c75b361270ca14823bc117ba8e3a16e

SHA1
d3369bffe1e8c3aa1b658fe883cc22d5c73b5c1b

SHA256
c52a925ef0b8d1aaea86529c6c8968e2b86ce46be890dfac0a4a4cc9e29ef0e3

SHA512
ed09c8dfdfc7c86f00d368850f0f3e7bace196de82e5bfddfde4a3d4ff4f54c40e0b7bc613a385b03eb6a39d44d2643f9e456b9593836cfd8df8ca8950c597bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\jz5JHWe_2WCod7u1RNWmByRezL4.br[1].js
MD5
e9e0f2c7d9ff4e7ba872a004593454b5

SHA1
2db69a5f85d5afd2c523f8f6b8867eaa4e1125f9

SHA256
24d847fbf4fd59be3529fdfa7542fd3fe9512662927dd482e60d11344175e778

SHA512
f01ac1fed499aab6465f3f1fea96b5036043c260dd8a9029046895768794503264a98e41cc306f54557eac74c228af9a65a1e6cbdcfe6b4e0e8bbbd730f6a6a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\jzH1hobOIMdex5kjKGOrhxXGVbk.br[1].js
MD5
fe84c629905f642872f9140a994fd7c2

SHA1
547c535b76b5cdd52328dea285d1e977ab5cb8d0

SHA256
0e97eee2037af3f844f2f52541569d2df8706689e0e0d4b209212adf6d43dcf4

SHA512
cb17019a692396df8cac8601265a3057f7c13975a415a9350b8e9d45e1cf5a8befb6ac85b6d42adacfb492c248665d078cd25b2a661fe70863ef3bb833c4dab5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\n0tAjrh0OUxqjqlSPvO1hybRfiY.br[1].js
MD5
7eb9fffdd41917ea831cadcb06973122

SHA1
1602980da42cfb114acb040f5b065b309f4825b8

SHA256
f36fc58ba6d065464053feed391c1a5d6771af7ffaa4a141ac313a1e08b8e527

SHA512
5880db8d3296978bb6a684ac1465ff55c9a0e7e0fe4dc61c48ad6b22f0a59e4bd88d37fc45a71a3de505da25352ee26d014f91de5b82df66e89d1a2f24507493

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\obTY3qKq0d8OC7nv1dy1IdMW4CA.br[1].js
MD5
a1ef6743d774fc65c9d28fbfa6445c61

SHA1
5ecec227bc3fa6e4c6f8e20bef490855a76976fe

SHA256
3283bbec60497f7fb896e1b4af3f65423b860992c72d3fbce565ee02f22dcb4f

SHA512
ead9d5995938903a5a9c7af87e481b191ffcd9e3bf810900aca11b40e5557f26da23faf0629892ae58e11b1a94231a0ee73062f4a92e35bd1dda071a2736c154

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\onra7PQl9o5bYT2lASI1BE4DDEs[1].css
MD5
d167f317b3da20c8cb7f24e078e0358a

SHA1
d44ed3ec2cde263c53a1ba3c94b402410a636c5f

SHA256
be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad

SHA512
afc65b0fa648d49a5eb896be60331aa222301894e228fe5684399e9276342f6510773dffa3e7e75b8d6197bc51c732bc7fd7518e593ecd20c4884c47058d46d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\s1QRPzn0kGP9oIe5MgvHjNWUeTg[1].css
MD5
d586d74b25707cc825084d7cf28b7d4c

SHA1
282d0ab4dd664394ec2e27cd397aa5a4b300a2df

SHA256
17b4fe5c808876dd59a4850611abacfce27db632fd2ad6319c3edca091908b3d

SHA512
4c460f9a1d7a07b848e3cf9b5bc850055f7831ec56d37c41ada05765f81142e55322a53b88c587a53618a9b9426740dd11595eaeddf0f38b8a81a0a459bc0805

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\tUWuyrvoBg6nl4pYbN1MpS_9cCI.br[1].js
MD5
49e407560d19719fa0e87ecb0a20abb9

SHA1
bd4c25762056256da805893c7409cb423ec20b95

SHA256
b400da645d6ab5fcf581538501e97278f255dc975454c84e07875a2320571045

SHA512
ae402a1805e828ead281b96304019aaf6980cffb8e39e40413b9d5c89a2078c73423f0cdfcf2e4a25518fae9e42f660c81955288fa28d1bb62e7f6dd2cfa3595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\weVEqwvEjQTO1AQLhywy4-gNLgw.br[1].js
MD5
ffdab333e6bdfc440d52fd0981b242b8

SHA1
70fbea15c005216ae985f4c3ef83ac2e7c50711c

SHA256
a1706ffd6a8f21a07879826d0a5aa653483a2767b806de53ee208e5e0b4483a7

SHA512
c8affed8c9bb548dfcbcedaad4a1f05b0de62889a11353b78ae986fbb161202324766baf9d1125e72a4451771e28828cc980d9348769f321c24f4e203ad5c8fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\x0Cvpg0MmmBx9EUGxLDfa2xcV-E.br[1].js
MD5
23c987e711c002d4ca3cd02deedc9bbf

SHA1
c0c26b66ea6793fa884f143e76cb9ad2e0109c7c

SHA256
a1c2f4c8ca6113ebdac36f2c33d6ce19bcf2f4bd99ec06e8ba845e2b25b03322

SHA512
969bc04d69f629f08585c7c2ee23e998d8c91146b912370cf9886a7f0b067e68654a9581c0203da522d30533871e41c1b96bf60f18091b6c7eb86d1a863b5d06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\yLw8UJGayIuyEZYZz_kiIpwFap0.br[1].js
MD5
aec8bffc4876fac398ada7a8c4bbc6b9

SHA1
fd7b7c8bfc3127e7327f0f6888b9251af02b2e33

SHA256
a35fb98b59519adc7c7559c5b5106c9a676650d777f040591c329ef24ffd5b56

SHA512
3ec76009cc69e8598ffdfaf1c0981344798739f09e2c489ae795162d7373d055312ff9220ab5ba4920cf8595b91d195c2373427a2706b859b78ff7373bae6a86

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\9\zEQqhwKoETyGdQapOnP2uL1FFF0.br[1].js
MD5
30f68a3ea9f8fe63101e59ced32fa3e7

SHA1
0450964533a5363f20fd7a7ae16821cdfc1fcc1d

SHA256
90fccf6342d5bcfde3f69f88b80253ec694b9b901cc55fd84a2e0c6e0ff05caf

SHA512
f994377757539611fe2781b6aeedcfe2b2c7073516c0f3887c0fd836e1ed69066daabe7065dae1fc4aa071f8f5080939591b3ebd4642b1eaa42c7b25c2003349

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\INetCache\9YV04B6U\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js
MD5
8c82fd065b817078dd8befefd90db935

SHA1
3e92d13ea6a8f09419f52253a3af06d007620898

SHA256
c5af42879c3d89b2d309c0f30a1bc8231da6fe4377528133f219923654c9b177

SHA512
8837a5f5a661fea36697e8e62347cce6256ab884e5c1ac5ca474a3aba1d9ff8ffeb31da982e3febd54fde37ac206a0a60946c32e0d465c019a08a63eba584829

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\INetCache\CU387W9N\fFSXkj1t_zfXRNULqSUNux82Lcw[1].js
MD5
4f97cdbdb0fa8bf1cb77389c60e17c55

SHA1
6ff3550b0125ced54e298ea5524177e0340ee7d9

SHA256
612cf023657f77a9562eb932196bc955ee924ba71e7f45e71d64a14c60130822

SHA512
71ff47996aadd361eedfe96da581243e8561bf1582ab71edbce604714e17b1c5a9249004f6447e486082f6984a3342a80bbc14709c670d886722fb031c92875e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
6880afdf1e51aacc7ebe5b10377ddd82

SHA1
0cc8f69148e9ef0325e88f0b608ab92eb7c2fdf6

SHA256
65da906e3853c4a20efbf65a4f9963362708e8545b0971ce51bcc29a4f155cf3

SHA512
50df2bd21de95bac4b98529032e7d22d4de8db5b699fd6b32824c28dae8bfe6c35c271dcbeb8a03919307dcb5eabcf9efbde47849361d5ca3c79e11c02bf2e78

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
bbdfe1f65604eb7336caba39efccfa9c

SHA1
27ceae3f56d45cf91ce320273745088049bb911b

SHA256
332835d3fe000b17dc6feb72724072a20013727abc48e1db0a0822cc19d4980c

SHA512
18b8c2c5a62281a0383efe76771f417b47387934fd0429b2f3871ab0606a0e28cf4acc79cd9cd40e522693b23b03669151c2951c3516869a9ab42f5b45e6aa2b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RU1N0LOI\www.bing[1].xml
MD5
eba00c9f59d4da6906c6b08ffc7abab6

SHA1
2e1f9585b0b84e731c386b81562e85e53d9da45b

SHA256
e10ef079937e8e87fa0e5026cb02eccfefd3b57ebbbeb1a948d5f5c63e236f33

SHA512
cc2ef2c921b3dcdddabfd8da8e6407bc5e224605dcefd3e82a2e1a46ac934a091aa827f28a1abef638f05b6d7979c4f06fc1f1faeac7e24792eb98fdc9e2d092

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
b3a3605b1768e34126afb8cb065a1ef9

SHA1
1aa6029292bf5c72b03e62ec8708ba992da0ec9b

SHA256
595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532

SHA512
f8c5cc965ea6c4fd660934d5c074849c6d20ec5e5bea2d0b8dae609bc88147f11d91cc2b994f8e60ff08eaed28cd57a5cbf272ea5a6b7522ed2c2e9adf22d8bd

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
b3a3605b1768e34126afb8cb065a1ef9

SHA1
1aa6029292bf5c72b03e62ec8708ba992da0ec9b

SHA256
595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532

SHA512
f8c5cc965ea6c4fd660934d5c074849c6d20ec5e5bea2d0b8dae609bc88147f11d91cc2b994f8e60ff08eaed28cd57a5cbf272ea5a6b7522ed2c2e9adf22d8bd

Download Submit
memory/464-131-0x00007FF70B8A0000-0x00007FF70C1A6000-memory.dmp

Filesize
9.0MB

Download
memory/464-130-0x00007FF70B8A0000-0x00007FF70C1A6000-memory.dmp

Filesize
9.0MB

Download
memory/464-132-0x00007FF70B8A0000-0x00007FF70C1A6000-memory.dmp

Filesize
9.0MB

Download
memory/464-133-0x00007FFE874F0000-0x00007FFE874F2000-memory.dmp

Filesize
8KB

Download
memory/3992-138-0x00007FF6D8480000-0x00007FF6D8D86000-memory.dmp

Filesize
9.0MB

Download
memory/3992-136-0x00007FF6D8480000-0x00007FF6D8D86000-memory.dmp

Filesize
9.0MB

Download
memory/3992-137-0x00007FF6D8480000-0x00007FF6D8D86000-memory.dmp

Filesize
9.0MB

Download