Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 14:52
Static task
static1
Behavioral task
behavioral1
Sample
c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe
Resource
win10v2004-20220414-en
General
-
Target
c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe
-
Size
2.7MB
-
MD5
235c65d98cae9133afd6357bef878061
-
SHA1
cf5c6c1ce68dcd06152b29c763711ebcb25f45b0
-
SHA256
c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae
-
SHA512
e836e2a38ed2e01b4d391be9b5dabcdc52bee2d70dc64c495aaa541a5f53f92f93c125123aa734d56cd141dba71695e256b236659a058d47eb357c586a3ef354
Malware Config
Extracted
C:\Unlock_All_Files.txt
https://drive.google.com/file/d/1L1qeBgY_AfjYVgO8FEZsViJxK4TBWXZI/view
https://t.me/filedecrypt002
https://www.bestbitcoinexchange.io
Extracted
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{e756a66b-cec5-4538-aefe-75811fadc379}\0.0.filtertrie.intermediate.txt
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\PREVIEW.GIF.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolap.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\management.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\updater.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\offfiltx.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ADAL.DLL.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10R.CHM.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\skins\default.vlt.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\PesterThrow.Tests.ps1.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyoptionaltools.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\MAPISHELLR.DLL.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\MSCONV97.DLL.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolap.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-execution.xml.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCL.DLL.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\7-Zip\Lang\co.txt.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\BLUEPRNT.INF.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\Xusage.txt.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinChart.v11.1.dll.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.schema.mfl.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\PackageManagementDscUtilities.strings.psd1.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.Email=[[email protected]]ID=[YQVCFMBSPRPAUHYK].encrypt c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
SearchApp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 1364 taskkill.exe 4024 taskkill.exe 916 taskkill.exe -
Modifies registry class 64 IoCs
Processes:
SearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1614" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\ = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 ^ 0008 1 0009 2 000a ~ 000b : 000c a 000d aw 000e ax 000f ay 0010 b 0011 d 0012 ch 0013 eh 0014 eu 0015 ey 0016 f 0017 g 0018 h 0019 ih 001a iy 001b jh 001c k 001d l 001e m 001f n 0020 ng 0021 oe 0022 oh 0023 ow 0024 oy 0025 p 0026 pf 0027 r 0028 s 0029 sh 002a t 002b ts 002c ue 002d uh 002e uw 002f uy 0030 v 0031 x 0032 y 0033 z 0034 zh 0035" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "16000" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "409;9" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2230" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "804" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HW" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1902" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "162" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\sidubm.table" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = 4f12242f895bd461c879f1e773d97c8ee816e4b5a37737ac6216dd9bb9e3a2bb SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1614" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8048" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "409" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{BAE3E62C-37D4-49AC-A6F1-0E485ECD6757}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Mark" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Zira" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Adult" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Mark - English (United States)" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomains = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{C6FABB24-E332-46FB-BC91-FF331B2D51F0}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "I 0069 Y 0079 IX 0268 YX 0289 UU 026F U 0075 IH 026A YH 028F UH 028A E 0065 EU 00F8 EX 0258 OX 0275 OU 0264 O 006F AX 0259 EH 025B OE 0153 ER 025C UR 025E AH 028C AO 0254 AE 00E6 AEX 0250 A 0061 AOE 0276 AA 0251 Q 0252 EI 006503610069 AU 00610361028A OI 025403610069 AI 006103610069 IYX 006903610259 UYX 007903610259 EHX 025B03610259 UWX 007503610259 OWX 006F03610259 AOX 025403610259 EN 00650303 AN 00610303 ON 006F0303 OEN 01530303 P 0070 B 0062 M 006D BB 0299 PH 0278 BH 03B2 MF 0271 F 0066 V 0076 VA 028B TH 03B8 DH 00F0 T 0074 D 0064 N 006E RR 0072 DX 027E S 0073 Z 007A LSH 026C LH 026E RA 0279 L 006C SH 0283 ZH 0292 TR 0288 DR 0256 NR 0273 DXR 027D SR 0282 ZR 0290 R 027B LR 026D CT 0063 JD 025F NJ 0272 C 00E7 CJ 029D J 006A LJ 028E W 0077 K 006B G 0067 NG 014B X 0078 GH 0263 GA 0270 GL 029F QT 0071 QD 0262 QN 0274 QQ 0280 QH 03C7 RH 0281 HH 0127 HG 0295 GT 0294 H 0068 WJ 0265 PF 007003610066 TS 007403610073 CH 007403610283 JH 006403610292 JJ 006A0361006A DZ 00640361007A CC 007403610255 JC 006403610291 TSR 007403610282 WH 028D ESH 029C EZH 02A2 ET 02A1 SC 0255 ZC 0291 LT 027A SHX 0267 HZ 0266 PCK 0298 TCK 01C0 NCK 0021 CCK 01C2 LCK 01C1 BIM 0253 DIM 0257 QIM 029B GIM 0260 JIM 0284 S1 02C8 S2 02CC . 002E _| 007C _|| 2016 lng 02D0 hlg 02D1 xsh 02D8 _^ 203F _! 0001 _& 0002 _, 0003 _s 0004 _. 2198 _? 2197 T5 030B T4 0301 T3 0304 T2 0300 T1 030F T- 2193 T+ 2191 vls 030A vcd 032C bvd 0324 cvd 0330 asp 02B0 mrd 0339 lrd 031C adv 031F ret 0331 cen 0308 mcn 033D syl 0329 nsy 032F rho 02DE lla 033C lab 02B7 pal 02B2 vel 02E0 phr 02E4 vph 0334 rai 031D low 031E atr 0318 rtr 0319 den 032A api 033A lam 033B nas 0303 nsr 207F lar 02E1 nar 031A ejc 02BC + 0361 bva 02B1 G2 0261 rte 0320 vsl 0325 NCK3 0297 NCK2 01C3 LCK2 0296 TCK2 0287 JC2 02A5 CC2 02A8 LG 026B DZ2 02A3 TS2 02A6 JH2 02A4 CH2 02A7 SHC 0286 rhz 02B4 QOM 02A0 xst 0306 T= 2192 ERR 025D AXR 025A ZHJ 0293" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "DebugPlugin" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8037" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; net=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; Name=NativeSupported; media=NativeSupported; message=NativeSupported; companyName=NativeSupported; computer=NativeSupported; math=NativeSupported; duration=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_HW_en-US.dat" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\Total = "0" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "55" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "CC" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "11.0.2013.1022" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "11.0.2016.0129" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6208" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Japanese Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "411" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SpeechUXPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "129" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\c1033.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Spanish Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1" SearchApp.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exesvchost.exeSearchApp.exedescription pid process Token: SeDebugPrivilege 1364 taskkill.exe Token: SeDebugPrivilege 4024 taskkill.exe Token: SeDebugPrivilege 916 taskkill.exe Token: SeManageVolumePrivilege 4632 svchost.exe Token: SeDebugPrivilege 4400 SearchApp.exe Token: SeDebugPrivilege 4400 SearchApp.exe Token: SeDebugPrivilege 4400 SearchApp.exe Token: SeDebugPrivilege 4400 SearchApp.exe Token: SeDebugPrivilege 4400 SearchApp.exe Token: SeDebugPrivilege 4400 SearchApp.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SearchApp.exepid process 4400 SearchApp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SearchApp.exepid process 4400 SearchApp.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.execmd.execmd.execmd.execmd.execmd.exenet.exedescription pid process target process PID 3316 wrote to memory of 2064 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 2064 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 2064 wrote to memory of 1364 2064 cmd.exe taskkill.exe PID 2064 wrote to memory of 1364 2064 cmd.exe taskkill.exe PID 3316 wrote to memory of 4868 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 4868 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 4868 wrote to memory of 4024 4868 cmd.exe taskkill.exe PID 4868 wrote to memory of 4024 4868 cmd.exe taskkill.exe PID 3316 wrote to memory of 4328 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 4328 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 4328 wrote to memory of 916 4328 cmd.exe taskkill.exe PID 4328 wrote to memory of 916 4328 cmd.exe taskkill.exe PID 3316 wrote to memory of 2904 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 2904 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 760 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 760 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 2404 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 2404 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 3676 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 3676 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3676 wrote to memory of 5008 3676 cmd.exe attrib.exe PID 3676 wrote to memory of 5008 3676 cmd.exe attrib.exe PID 3316 wrote to memory of 3944 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 3944 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3944 wrote to memory of 1340 3944 cmd.exe net.exe PID 3944 wrote to memory of 1340 3944 cmd.exe net.exe PID 1340 wrote to memory of 1636 1340 net.exe net1.exe PID 1340 wrote to memory of 1636 1340 net.exe net1.exe PID 3316 wrote to memory of 1840 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe PID 3316 wrote to memory of 1840 3316 c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe"C:\Users\Admin\AppData\Local\Temp\c053df842991d751eb53b271d7f3b4e8d6362633a1b79a6d8341c058057a90ae.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\system32\cmd.execmd /C "taskkill /F /IM sqlservr.exe /T"2⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlservr.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
-
C:\Windows\system32\cmd.execmd /C "taskkill /F /IM sqlceip.exe /T"2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlceip.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
-
C:\Windows\system32\cmd.execmd /C "taskkill /F /IM sqlwriter.exe /T"2⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlwriter.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\Users\Admin\AppData /s /q"2⤵PID:2904
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\Users\Default\AppData /s /q"2⤵PID:760
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\Users\Public\AppData /s /q"2⤵PID:2404
-
-
C:\Windows\system32\cmd.execmd /C "attrib +h +s Encrypt.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\system32\attrib.exeattrib +h +s Encrypt.exe3⤵
- Views/modifies file attributes
PID:5008
-
-
-
C:\Windows\system32\cmd.execmd /C "net stop MSSQL$SQLEXPRESS"2⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\system32\net.exenet stop MSSQL$SQLEXPRESS3⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS4⤵PID:1636
-
-
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\$Recycle.Bin /s /q"2⤵PID:1840
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:2944
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy1⤵PID:2208
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4400