Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/02/2024, 07:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
General
- Target SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe
- Size 23KB
- Sample240227-h55zfabb77
- SHA256 2ede5b3ee36af240b64f1258b8a3ebd1398becac1a122ccb641394cfe28ad17a
- MD5 e8911f3944a0f583a035404ac651dbf6
- SHA1 1d1ac6951d858b46c6534f0ac2e766d486410a44
- SHA512 0c5525078307807786cd5bcde16d390d2e8b8e0fe4800d6cdeaddcf8bfc71df8c299c7b4fabe787f64afee5544da746b1e35929477670a21e09f47b4bd5dbf18
- SSDEEP 384:m80GEIW1ulecvrYc2GrFtnvrYc2GrFteIjrYc2GrFt:mUlbDYc2UPnDYc2UPeIPYc2UP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gm.dls cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\afunix.sys cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui cmd.exe - Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll cmd.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe - Possible privilege escalation attempt 2 IoCs
pid Process 4640 takeown.exe 680 icacls.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 4640 takeown.exe 680 icacls.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\AM91A0~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM031C~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMBE63~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM82AF~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM60C1~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM33F5~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMF414~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA417~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMC81E~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM5D45~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3CA2~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM0A9A~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2651~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM6E1C~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMBA5B~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM1A03~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7F8B~2.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM73FD~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME3F0~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD8B8~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM10F5~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3600~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME369~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA114~1.423\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB420~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM52EB~2.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM26C1~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD8BC~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM066F~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7F64~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB161~1.1_N\Desktop.ini cmd.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ja-JP\p2p.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\kbdnko.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\netl1c63x64.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\xusb22.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\gpprefcl.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\KBDGEO.DLL cmd.exe File opened for modification C:\Windows\SysWOW64\whoami.exe cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\PresentationHost.exe.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\display.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\iyuv_32.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\it-IT\MSFT_ServiceResource.schema.mfl cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\wvmic_guestinterface.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\shutdownext.dll cmd.exe File opened for modification C:\Windows\SysWOW64\uk-UA\sndvol.exe.mui cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\wsp_fs_uninstall.mof cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterQos.cdxml cmd.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-privateprofile-l1-1-0.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rawsilo.inf_amd64_1cbfddc97a663ba6\rawsilo.inf cmd.exe File opened for modification C:\Windows\SysWOW64\KBDSORS1.DLL cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\uk-UA\MSFT_WindowsOptionalFeature.schema.mfl cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\connect.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_3bb2e5702f25a518\mdmaiwat.inf cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\rpcnsh.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\fastprox.dll cmd.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_7b6fc0e15997ce81\mdmadc.inf cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_1daeee8f3aa30fcb\Amd64\TTY.INI cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\nvdimm.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\ykinx64.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\apphelp.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\MSFT_WaitForSome.schema.mof cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\lsi_sas.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\logoncli.dll cmd.exe File opened for modification C:\Windows\SysWOW64\msacm32.drv cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterSriovVf.Format.ps1xml cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\wGenCounter.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\iscsidsc.dll cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\gpedit.msc cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\WF.msc cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netrast.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\megasas35i.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\CPU~1.INF\intelppm.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\hidirkbd.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\RunAsHelper.strings.psd1 cmd.exe File opened for modification C:\Windows\SysWOW64\colbact.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\hiddigi.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\acpi.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\rhproxy.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\SCRAWPDO.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\twinui.appcore.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\msvcp140_clr0400.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\PS_VpnConnection_v1.0.0.cdxml cmd.exe File opened for modification C:\Windows\SysWOW64\BluetoothApis.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\blockSoftware.xsd cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\iaLPSS2i_GPIO2_GLK.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\ja-JP\iologmsg.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\net7400-x64-n650.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\Dism\de-DE\FfuProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_5dbe5e81fafe4636\vdrvroot.inf cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\neth.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\scrptadm.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-libraryloader-l1-1-0.dll cmd.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe cmd.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~1\WINDOW~1\ja-JP\OfflineScannerShell.exe.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MICROS~4.SCA\Assets\WINDOW~1\WindowsCameraMedTile.contrast-black_scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNotePageMedTile.scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\BG2_TH~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\offsym.ttf cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\UIAutomationClient.dll cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\oskmenu.xml cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIB28C~1.0_X\Assets\CONTRA~1\AppList.targetsize-30_altform-unplated_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID54F~1.0_X\SLOWMO~1\USERCO~1\SUPERS~1.XBF cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HX3F35~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\SECOND~1\DIRECT~1\Work\RTL\CONTRA~2\LARGET~1.PNG cmd.exe File opened for modification C:\PROGRA~2\WI8A19~1\it-IT\PhotoAcq.dll.mui cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\fr\System.Speech.resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\SmallTile.scale-100_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI9577~1.SCA\APPXBL~1.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI10D6~1.0_X\Assets\CONTRA~2\AppList.targetsize-64_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIB28C~1.0_X\Assets\CONTRA~1\AppList.targetsize-40_altform-unplated_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\EX2363~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\APPICO~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\SmallTile.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\images\FILESW~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SY48E3~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\SmallTile.scale-125.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HxA-Yahoo-Dark.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\OU456C~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\LiveTile\W3.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\SECOND~1\DIRECT~1\Work\RTL\CONTRA~1\MEDTIL~1.PNG cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI8CE7~1.102\ACTIVA~1.LOG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\ON87EE~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~1\30x30\178.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID2A4~1.0_N\APPXME~1\APPXBU~1.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ON3FBA~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\ONBOAR~1\CONTAC~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HX9795~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.Tests.ps1 cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~1\30x30\202.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\stickers\word_art\STICKE~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PhotosWideTile.contrast-black_scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxMailLargeTile.scale-400.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\Assets\CONTRA~2\MOVIE-~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.ps1 cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI8FA4~1.102\S-1-5-~1.PCK cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\it\System.Xml.Linq.Resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\autstbim.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNotePageWideTile.scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\BLANK_~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI7414~1.SCA\Assets\CA3495~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\LIC495~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\Assets\GAMESX~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\_RESOU~1\1BBC4~1.RSR cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Data.Linq.Resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID540~1.SCA\Assets\CONTRA~1\MIXEDR~4.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\CsiImm.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\EM5D97~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HXMAIL~3.PNG cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\fr\UIAutomationClientsideProviders.resources.dll cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\it\System.Windows.Presentation.resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\APPXME~1\CODEIN~1.CAT cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MI5136~1.SCA\Assets\VODECD~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\Spacer\1px.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~2\210x173\82.jpg cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\SmallTile.scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID54F~1.0_X\FrameExtractorPage.xbf cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\LI36EC~1.PNG cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\Nirmala.ttf cmd.exe File opened for modification C:\Windows\servicing\Packages\MI6FA7~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AM36CE~1.1_N\KBDINBE1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM2D77~1.1_J\LICMGR~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM1288~1.1_E\MSKEYP~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM7AC4~1.1_N\IOBAEB~1.XRM cmd.exe File opened for modification C:\Windows\WinSxS\AMBD0C~1.1_P\WINDOW~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMAC13~1.1_D\RS_RES~3.PSD cmd.exe File opened for modification C:\Windows\WinSxS\AMB577~1.115\Splashscreen.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\AM193B~1.264\f\WINDOW~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$C3E9~1.CDF cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\test.html cmd.exe File opened for modification C:\Windows\WinSxS\AM33FE~1.1_U\http_404.htm cmd.exe File opened for modification C:\Windows\WinSxS\AMAD1C~1.120\mighost.exe cmd.exe File opened for modification C:\Windows\WinSxS\AME9D1~1.1_E\VMWPEX~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMCF3D~1.264\TRANSP~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM11AE~1.746\Square44x44Logo.targetsize-32_altform-unplated.png cmd.exe File opened for modification C:\Windows\WinSxS\AM8A49~1.1_N\app936.fon cmd.exe File opened for modification C:\Windows\WinSxS\AM2ABE~1.906\r\NETPRO~1.DLL cmd.exe File opened for modification C:\Windows\PrintDialog cmd.exe File opened for modification C:\Windows\WinSxS\AM3309~1.1_F\BATMET~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM702E~1.1_F\LANGUA~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM91B7~1.746\WSECED~1.MUN cmd.exe File opened for modification C:\Windows\WinSxS\AM7DAE~2.1_N\smss.exe cmd.exe File opened for modification C:\Windows\WinSxS\AMA1C2~1.1_E\TRACER~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM365C~1.1_U\vss.mfl cmd.exe File opened for modification C:\Windows\WinSxS\AM1BF7~1.126\f\EDB8E8~1.XRM cmd.exe File opened for modification C:\Windows\WinSxS\AM32A2~1.115\r\mssvp.dll cmd.exe File opened for modification C:\Windows\diagnostics\system\IEBrowseWeb\de-DE\RS_DisableAddon.psd1 cmd.exe File opened for modification C:\Windows\WinSxS\AM8C9D~1.108\wosc.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMEE07~1.126\f\DEFAUL~1.XRM cmd.exe File opened for modification C:\Windows\WinSxS\AM867F~1.264\f\WINDOW~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM0FD5~1.1_I\SERVIC~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$EC19~1.CDF cmd.exe File opened for modification C:\Windows\servicing\Packages\MI4F51~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AMFCC9~1.128\f\VMCOMP~1.EXE cmd.exe File opened for modification C:\Windows\WinSxS\AMC79D~1.1_N\SmallLogo.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\AM9988~1.1_J\F12SCR~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM4B6B~1.1_D\WINDOW~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM6AC7~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\AM02CC~1.1_E\MTSTOC~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM826E~1.1_N\vgafix.fon cmd.exe File opened for modification C:\Windows\WinSxS\AM0B6D~1.1_D\RADAR~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\AMFFEE~1.123\f\wshom.ocx cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$D52B~1.CDF cmd.exe File opened for modification C:\Windows\WinSxS\AM51E0~1.1_D\BCMWDI~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AM4962~1.1_N\hwvid-migration-replacement-2.man cmd.exe File opened for modification C:\Windows\WinSxS\AMABC4~1.1_N\Square71x71Logo.scale-400.png cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$1FC6~1.CDF cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Professional-License-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat cmd.exe File opened for modification C:\Windows\WinSxS\AMD659~1.746\f\WINDOW~1.PRI cmd.exe File opened for modification C:\Windows\WinSxS\AM1D92~1.546\DMISO8~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMA81E~1.746\f\wmidx.dll cmd.exe File opened for modification C:\Windows\WinSxS\AM211E~1.1_I\VSMRAI~1.INF cmd.exe File opened for modification C:\Windows\INF\mdmusrsp.inf cmd.exe File opened for modification C:\Windows\servicing\Packages\MI4CAC~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AM30FF~1.1_U\BTH~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AMAF19~1.1_F\HIDBAT~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM4BED~1.1_N\tcpmon.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMAC5B~1.1_F\WAVEMS~1.MUI cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Runtime.WindowsRuntime.UI.Xaml.resources.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMF014~1.1_D\EXPLOR~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM3C78~1.1_E\SCHEDP~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AME34C~1.1_F\SERWVD~1.MUI cmd.exe - Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\Total = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\NumberOfSubdomains = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeManageVolumePrivilege 2544 svchost.exe Token: SeDebugPrivilege 4948 SearchApp.exe Token: SeDebugPrivilege 4948 SearchApp.exe Token: SeDebugPrivilege 4948 SearchApp.exe Token: SeDebugPrivilege 1168 SearchApp.exe Token: SeDebugPrivilege 1168 SearchApp.exe Token: SeDebugPrivilege 4368 SearchApp.exe Token: SeDebugPrivilege 4368 SearchApp.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4368 SearchApp.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4948 SearchApp.exe 1168 SearchApp.exe 4424 SearchApp.exe 540 SearchApp.exe 4368 SearchApp.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1924 wrote to memory of 4640 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 91 PID 1924 wrote to memory of 4640 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 91 PID 1924 wrote to memory of 4640 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 91 PID 1924 wrote to memory of 680 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 93 PID 1924 wrote to memory of 680 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 93 PID 1924 wrote to memory of 680 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 93 PID 1924 wrote to memory of 4728 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 95 PID 1924 wrote to memory of 4728 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 95 PID 1924 wrote to memory of 4728 1924 SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillFiles2.2675.31217.14697.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\takeown.exe"takeown" /F "C:\" /R /A /D Y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4640
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\" /grant %username%:(F)2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:680
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C rd /s /q "C:\"2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4728
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy1⤵PID:692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4948
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy1⤵PID:4224
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy1⤵PID:1512
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1168
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4424
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:540
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4368
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4656
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2876
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:1004
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4024
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:816
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4564
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4976
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2660
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4268
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2104
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:1188
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2432
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:3164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
- Size 2KB
- SHA256 c095582cf75f9a46b0f3d0be50b3621d0a03c67685e52713d8fb1e7f79a83020
- MD5 c4f05622ab536201a51ba7ad48a34f4e
- SHA1 19984054e1812db0cabf8bbbc9b5ec5a141808b2
- SHA512 8a6f68900002b4a76b0552d2db9895e5ebcc2167148cf9fc0c65c21107b73ea2c95ba0f2ee1095376df47a257998cfe07a3c3cc5cf49f0b6f90c10142c517119
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}
- Size 36KB
- SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
- MD5 bad093419be1135cfe9694ea77088c78
- SHA1 76204c7ca72cf666add9c9931389d635c82e8af0
- SHA512 3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
- SSDEEP 48:jDlmj1hraax2DvfG+ohTrNAg4eBDAudJ4hKO2I7dQOggBYiiqD1yB72G6nBRz9iz:jDlU1hUol9onbdaa/aarIkb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27519f24-1686-49f6-b577-455fe4bc58d2}\0.0.filtertrie.intermediate.txt
- Size 28KB
- SHA256 80b1c12d18e49cf0ebfa4b380028b6f9e1791f4800a6bfb657e140714c3e8f3d
- MD5 bb7640183196f554caf076ff2ca0e12c
- SHA1 ccc92a16fda19e15631083fd81b02f0ea6e732ed
- SHA512 1e2ab4baac6458e7149f6bc8a1a649a1e8d7edf41309e0b1a8cbc8f2b392cc8e3ab8dc77de98763ab3879c86dbe6a6207dabf3284c1b7799428a10d2fae612a1
- SSDEEP 768:+/ECewchqEZDgApz9dGByMVyNAaFH5Dikj91JjI:tv9R1zS/VyNA+dnjhjI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27519f24-1686-49f6-b577-455fe4bc58d2}\0.1.filtertrie.intermediate.txt
- Size 5B
- SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
- MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
- SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
- SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27519f24-1686-49f6-b577-455fe4bc58d2}\0.2.filtertrie.intermediate.txt
- Size 5B
- SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
- MD5 c204e9faaf8565ad333828beff2d786e
- SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
- SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27519f24-1686-49f6-b577-455fe4bc58d2}\Apps.ft
- Size 38KB
- SHA256 59d9a0ad8f3a55b1f83aea35ee590e2ef70f06939eb7beb8f77af9c40ce2ca84
- MD5 a2bdb51b1b1ea8360bc64530ab16d7cc
- SHA1 95b7724c7506e17a6cfb38a29d5cac95f0ae14e6
- SHA512 dee7aacd0e11d2595d7bc32dcb21fe78afd8f2f3f88f6a5142f14e22de60c1117906b72d6ace9bad8ccb035575b9ff3136a5a8729919a8cee13142c40559e5ba
- SSDEEP 768:UXNYPohNf1F/Om8Vz9JWxXVoVPPPw4XcWocHE:UXNYPohNf11Om8B9JWNVoVPPPw4XcjgE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27519f24-1686-49f6-b577-455fe4bc58d2}\Apps.index
- Size 1.0MB
- SHA256 d9325550e42b994a9eafa97df42e55a6dde97e393ba1d7734d02e42d7b4aeb08
- MD5 bfcaa14dffd4f012957064bc236f3164
- SHA1 569e9c9102f03ca1ea83f7f4ae479f8e3a116ec8
- SHA512 d0dc537859cef13e9ed1932403fa98973cd81345be999cb7fb006e7a1c39aa31edd98b3069813cedea541a554c9f127192aef152563b8f3548f32bd967d50ec2
- SSDEEP 12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSJT:AoLr7YfoyFxz8GfoLr7YfoyFxz8GJnT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\apps.csg
- Size 444B
- SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
- MD5 5475132f1c603298967f332dc9ffb864
- SHA1 4749174f29f34c7d75979c25f31d79774a49ea46
- SHA512 54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\apps.schema
- Size 150B
- SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
- MD5 1659677c45c49a78f33551da43494005
- SHA1 ae588ef3c9ea7839be032ab4323e04bc260d9387
- SHA512 740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\appsconversions.txt
- Size 1.4MB
- SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
- MD5 2bef0e21ceb249ffb5f123c1e5bd0292
- SHA1 86877a464a0739114e45242b9d427e368ebcc02c
- SHA512 f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b
- SSDEEP 24576:A5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMo:AMVD4g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\settings.csg
- Size 454B
- SHA256 1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48
- MD5 411d53fc8e09fb59163f038ee9257141
- SHA1 cb67574c7872f684e586b438d55cab7144b5303d
- SHA512 67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\settings.schema
- Size 162B
- SHA256 d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031
- MD5 ac68ac6bffd26dbea6b7dbd00a19a3dd
- SHA1 a3d70e56249db0b4cc92ba0d1fc46feb540bc83f
- SHA512 6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\settingsconversions.txt
- Size 520KB
- SHA256 2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13
- MD5 721134982ff8900b0e68a9c5f6f71668
- SHA1 fca3e3eb8f49dd8376954b499c20a7b7cad6b0f1
- SHA512 5d1c305b938e52a82216b3d0cee0eead2dc793fac35da288061942b2bd281fb48c7bd18f5fdaa93a88aa42c88b2a0cce1f0513effb193782670d46164d277a59
- SSDEEP 6144:CJ/o/Xp9DRgb06sVxj8dAB4u2OsfnEa83LGWCAFdkwQknzBc8A:CgRbxjiuTsP583eAMwQknzBcT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\settingsglobals.txt
- Size 43KB
- SHA256 218042bc243a1426dd018d484f9122662dba2c44a0594c37ffb3b3d1d0fb454a
- MD5 bbeadc734ad391f67be0c31d5b9cbf7b
- SHA1 8fd5391c482bfbca429aec17da69b2ca00ed81ae
- SHA512 a046600c7ad6c30b003a1ac33841913d7d316606f636c747a0989425697457b4bc78da6607edd4b8510bd4e9b86011b5bd108a5590a2ba722d44e51633ed784f
- SSDEEP 768:NhLlwUkdu97GqHJh+Ivl+2rn29oyWSlfM4NN30c/f3hQI+7A:NhaUd9iEXnrnOTr2q3GU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0c4a138d-2221-4511-b7a5-4a371e20ab39}\settingssynonyms.txt
- Size 101KB
- SHA256 12d00eee26e5f261931e51cfa56e04c54405eb32d1c4b440e35bd2b48d5fcf07
- MD5 003ece80b3820c43eb83878928b8469d
- SHA1 790af92ff0eb53a926412e16113c5d35421c0f42
- SHA512 b2d6d9b843124f5e8e06a35a89e34228af9e05cbfa2ae1fe3d9bc4ddbebda4d279ce52a99066f2148817a498950e37a7f0b73fe477c0c6c39c7016aa647079a5
- SSDEEP 1536:Vk0avCce1rfaFdi8MGBtf9if6pW3O2cI40d7uwLLy8K:u0csLaFEX8G6pW3G98K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8c239cab-0ea1-4e5a-9b0e-e7842e56a126}\appsglobals.txt
- Size 343KB
- SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
- MD5 931b27b3ec2c5e9f29439fba87ec0dc9
- SHA1 dd5e78f004c55bbebcd1d66786efc5ca4575c9b4
- SHA512 4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd
- SSDEEP 3072:+rNHn+auvNDrohmXLI7E8FAtXQkun1907JL6hq65sRQsqbmfEV+1+b:qNH+auvJohmXLIQfhI1YL6hB5PsqCfU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8c239cab-0ea1-4e5a-9b0e-e7842e56a126}\appssynonyms.txt
- Size 237KB
- SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
- MD5 06a69ad411292eca66697dc17898e653
- SHA1 fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d
- SHA512 ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693
- SSDEEP 1536:ek7gHR0SV2zp+MK2MHYAb8hqahIBAgoEA6YoGCmrzzB9C1D48fYMLZB1QMX+Z6pL:RUx2kBFeDb9YiAlP+zCmTXFePKG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534920322122947.txt
- Size 72KB
- SHA256 c8fe9454e3257e33e2aa62872f4e7686f19e5ef84f161fdafb59e364e764e069
- MD5 5b4b9d0df8b6dfd821c5d714018057d2
- SHA1 737572ed9a2e31b9c70be6b89a69c1cef3b9fa5a
- SHA512 dc55427a58a5a84f3daed54eec79f47ad6278ca640ddb39d1c346006b2455347a94d41b7184afda1e9f34c9d848f478a1b55a70594afb5f500458bac4ed1ec29
- SSDEEP 384:i/vg/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/eAe//r/td:der1D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
- Size 190KB
- SHA256 d3171fd7108d92671be33906a568a713b258a5e8ffa4336f4da42228adfd6dd0
- MD5 7791859ad3723805e89d8562fbd88faf
- SHA1 8536379206a2f9c8e4ca581de359d57f11f692c3
- SHA512 99199f408db62908aab3e668ef808add693c6b609135499f46150655bc678ca28d18ec3bca6f3e9a8b6af4ee571cdfde266321ec9abd88930c6ab7f60212f640
- SSDEEP 1536:PgFkqkncOSNZPFBgTu5pm5TM7p0Nm5+u5eAxldBM7p0CEn5b1mzHgc65d0h+H3sl:PgFkqkcO6FBghqd0hQ3sDh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
- Size 9KB
- SHA256 f63bc44728316b890870dd6b2e94bc9dc588b29ae105adbf8748b0a2ba8d783b
- MD5 3ada0f86714734f86b0017e9d10803d8
- SHA1 27a614ec12fed63874205582fccb0660b82ed8dd
- SHA512 2fc2b5fbd5a645600fac06d87d2e5bdf82b47349f126a66d594ee5d40148c312ddabc71e25b456f4b48205897220d914cd511a757cf871f24070b547850b2143
- SSDEEP 192:DfJPy49I7Qiy3zkYJeko/tkpCk5NDuZAksz2ZUhmkDSRRPQReqjfQOVjeQ8RJo1l:bJQ8zkkeZ/tBAJtpmcfQOVjeQ8RJo7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\42CFW8O1\microsoft.windows[1].xml
- Size 97B
- SHA256 90b097879d7332c8d759e457382c41d94548c39867985a55b1093ec1af7ec776
- MD5 6475ec397ab64a09537ff6897d16f135
- SHA1 76f6e07197f4676c68bac02b92888160deeff214
- SHA512 fcad77da85bc5cf400a0948edc29e23592776bac0f4eaa613cbe9bddc68c079410ce936d5d1e58e233d92ad062ca8acdc0c50016519111bbc99030893eab0bf1
- MD5 SHA1 SHA512