Analysis
- max time kernel
150s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/02/2024, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
General
- Target d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe
- Size 17KB
- Sample240228-vmka8shd3w
- SHA256 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce
- MD5 12f86d1f2f3d6c0b5cb7440aec26c317
- SHA1 166b6a4f14c5390e26eeae2dc26dec067a1f996a
- SHA512 e0846442de6c22fb586b1b6f02956a453f0b5733dbb999bfc86711acfedd5821b2d8cedcf863ab84a2868abbba54e5008e08d61a70398750ebea84d7d54304ab
- SSDEEP 192:m80GZruIW1ulxIKbv84Yceky/ur0M1Y4nv84Yceky/ur0M1Y4:m80GEIW1ulecvrYc2GrFtnvrYc2GrFt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gm.dls cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\afunix.sys cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui cmd.exe - Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll cmd.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe - Possible privilege escalation attempt 2 IoCs
pid Process 872 takeown.exe 4856 icacls.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 872 takeown.exe 4856 icacls.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\AM3CA2~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM60C1~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7F64~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA417~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM031C~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMBE63~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM52EB~2.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM1A03~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7F8B~2.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMC81E~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM73FD~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME369~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME3F0~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA114~1.423\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMF414~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB420~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD8B8~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2651~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMBA5B~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM82AF~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM33F5~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3600~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD8BC~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM0A9A~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM5D45~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM6E1C~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM26C1~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM066F~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM10F5~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM91A0~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB161~1.1_N\Desktop.ini cmd.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\de-DE\acppage.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\cht4nulx64.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\nete1g3e.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\WVMBUS~1.INF\wvmbus.inf cmd.exe File opened for modification C:\Windows\SysWOW64\oemlicense.dll cmd.exe File opened for modification C:\Windows\SysWOW64\Windows.System.RemoteDesktop.dll cmd.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-threadpool-private-l1-1-0.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\HalExtIntcLpioDma.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\wpdcomp.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\scsidev.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\DevicePairing.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_cnl.inf_amd64_a60833fda31e9831\iaLPSS2i_GPIO2_CNL.inf cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetIPsecMainModeRule.cmdletDefinition.cdxml cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\rtux64w10.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\netxex64.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\PortableDeviceApi.dll cmd.exe File opened for modification C:\Windows\SysWOW64\prvdmofcomp.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_1ea082c6cf8f6982\SDFLauncher.dll cmd.exe File opened for modification C:\Windows\SysWOW64\usbceip.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\fr-FR\ArchiveProvider.psd1 cmd.exe File opened for modification C:\Windows\SysWOW64\it-IT\gpprefcl.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\mfnetsrc.dll cmd.exe File opened for modification C:\Windows\SysWOW64\msxml3.dll cmd.exe File opened for modification C:\Windows\SysWOW64\uk-UA\wiadss.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\themecpl.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\netathr10x.INF_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\bthspp.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_magneticstripereader.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\netvg63a.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\NetworkItemFactory.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\Speech\Common\ja-JP\sapi.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\cipher.exe cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\neth.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\Dism\WimProvider.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\BASICD~1.INF\basicdisplay.inf cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\MIRADI~1.INF\MiraDisp.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\k57nd60a.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\SensorsAlsDriver.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netvg63a.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\netl1c63x64.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_NFA324i_5_SS_T.bin cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\prnms012.PNF cmd.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\en-US\l2gpstore.mfl cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\fr-FR\PSDSCxMachine.strings.psd1 cmd.exe File opened for modification C:\Windows\SysWOW64\downlevel\API-MS-Win-security-provider-L1-1-0.dll cmd.exe File opened for modification C:\Windows\SysWOW64\it-IT\VAN.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\PhotoMetadataHandler.dll cmd.exe File opened for modification C:\Windows\SysWOW64\uk-UA\twinui.appcore.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\OfflineFilesWmiProvider_Uninstall.mof cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\RacWmiProv.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventVmSwitchProvider.cdxml cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_unknown.inf_amd64_9f92c189b415c003\c_unknown.inf cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_bcde2913bb6ccf3d\mdmti.inf cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\WVID~1.INF\wvid.inf cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\PlayToStatusProvider.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\lt-LT\quickassist.exe.mui cmd.exe File opened for modification C:\Windows\SysWOW64\win32u.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_399f04975a0af112\sonymc.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\netnvm64.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\raschap.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\mciwave.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventVFPProvider.cdxml cmd.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\jsaddins\LOCALL~1\LOCALL~1.JS cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HXA-OU~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\EX9412~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\Assets\CONTRA~1\APD9B7~1.PNG cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MIA69F~1.0_N\ACTIVA~1.LOG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\Lighting\Light\SILHOU~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI92C9~1.0_X\Assets\CONTRA~2\MIXEDR~4.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\RUNNIN~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HXCALE~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\Images\PRINTA~1\GL7C76~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\COMMON~1.UWP\Strings\be-BY\View3d\3DVIEW~1.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\en-us\CT_ROOTS.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HxA-Generic-Light.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\EM5D97~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageSplashScreen.scale-400.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HXF2B5~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ONA8D4~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI67C7~1.0_X\Assets\SC1781~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIF104~1.0_X\Assets\ALARMS~4.PNG cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\WINDOW~1.0_N\ACTIVA~2.LOG cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\ipscht.xml cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MI443F~1.SCA\Assets\WINDOW~1\WI2A56~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ONCE1E~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\Assets\Audio\SK2F19~1.M4A cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PH44B2~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxCalendarAppList.targetsize-32.png cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\fr\UIAutomationClient.resources.dll cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.Runtime.Serialization.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\AppList.targetsize-72_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI92C9~1.0_X\Assets\DIRECT~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Videos\Help\UNIPUL~1.MP4 cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\BrowserCore\BrowserCore.exe cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MIBBCB~1.SCA\Assets\AppTiles\CONTRA~2\STOREW~1.PNG cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\MI3AEB~1.XML cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\MIDE17~1.XML cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MIA333~1.0_X\S-1-5-~1.PCK cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\TXP_HO~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\_RESOU~1\81363~1.RSR cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\OutlookMailLargeTile.scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\CONTRA~2\AppIcon.targetsize-30_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WINDOW~1\es-ES\OfflineScannerShell.exe.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Dial\TOLERA~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIF781~1.SCA\APPXSI~1.P7X cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\LI755C~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\CONTRA~1\AppIcon.targetsize-80_altform-unplated_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\ja\System.IdentityModel.Resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI67C7~1.0_X\Assets\SCCC8B~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\GenericMailMediumTile.scale-150.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Assets\IN0CB8~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\Assets\AP853F~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~1\LargeTile.scale-100_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HXD106~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNoteSectionWideTile.scale-125.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\xaml\onenote\SHAREE~1.XAM cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\SplashScreen.scale-150.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HX95D0~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\LinkedInboxWideTile.scale-150.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\Assets\CONTRA~2\AppList.targetsize-32_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Xml.Linq.Resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIEA2E~1.0_X\Assets\NOTETO~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\GE8236~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\DIRECT~1\Home\LTR\CONTRA~2\MEDTIL~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~1\30x30\200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PHB116~1.PNG cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\AMD8F8~1.264\moshost.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\V20~1.507\aspnet_perf2.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM361C~1.264\ERRORD~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM7568~1.1_E\UWFRTL~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM9B0B~1.120\certcli.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMD8F0~1.1_N\dsauth.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMD8F8~1.264\r\MAPROU~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMDE45~1.1_F\RUA25E~1.XML cmd.exe File opened for modification C:\Windows\WinSxS\AMAB3A~1.1_D\WINDOW~2.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMCB7E~1.1_N\SYSTEM~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM0C03~1.126\MPRMSG~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMF824~1.1_D\PSMODU~1.MFL cmd.exe File opened for modification C:\Windows\WinSxS\AM52D4~1.1_I\ESENTD~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM3738~1.1_N\HELPAN~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\AM3089~1.1_F\WIAAUT~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMBB7A~1.128\f\WMADMOD.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM4A53~1.1_E\NETK57~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AM0E23~1.117\f\sppcext.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMAF67~1.1_F\WMSEVE~1.MUI cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\AppxManifest.xml cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-20_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\Windows\WinSxS\AM3862~1.126\SPEECH~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMF2A5~1.1_N\size1_i.cur cmd.exe File opened for modification C:\Windows\WinSxS\AMDDF0~1.84_\rdsdwmdr.dll cmd.exe File opened for modification C:\Windows\WinSxS\AM3F77~1.1_J\VOLSNA~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\Catalogs\E53BFC~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AMB707~1.746\MSMQ-R~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\AMC9EF~1.1_I\SYSTEM~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMCC89~1.1_J\SHLWAP~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM8326~1.0_N\UIAUTO~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$C608~1.CDF cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\pris\resources.ja-JP.pri cmd.exe File opened for modification C:\Windows\WinSxS\AMEB2D~1.1_N\EASEOF~1.PNG cmd.exe File opened for modification C:\Windows\WinSxS\AM176E~1.1_N\tbs.dll cmd.exe File opened for modification C:\Windows\servicing\INBOXF~1\metadata\LA2E6C~1.MUM cmd.exe File opened for modification C:\Windows\WinSxS\AMBAAA~1.1_N\ftp.exe cmd.exe File opened for modification C:\Windows\WinSxS\AMF9E2~1.1_H\MSIMSG~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMEBD2~1.1_N\DIAGPA~1.DIA cmd.exe File opened for modification C:\Windows\WinSxS\AM82A3~1.1_F\STARTU~1.MUI cmd.exe File opened for modification C:\Windows\diagnostics\system\IESecurity\en-US\RS_IESecuritylevels.psd1 cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Numerics.Vectors.resources.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMCAE0~1.1_N\arial.ttf cmd.exe File opened for modification C:\Windows\WinSxS\AM7BD6~1.746\f\trie.dll cmd.exe File opened for modification C:\Windows\WinSxS\AM78B2~1.1_N\f12host.js cmd.exe File opened for modification C:\Windows\WinSxS\AMCC4C~1.1_E\MODEMC~1.INF cmd.exe File opened for modification C:\Windows\INF\mdmgsm.inf cmd.exe File opened for modification C:\Windows\WinSxS\AMEB4C~1.1_F\RESOUR~1.PRI cmd.exe File opened for modification C:\Windows\WinSxS\AM8964~1.844\SQ3EB7~1.PNG cmd.exe File opened for modification C:\Windows\WinSxS\AMEB32~1.1_N\AP0115~1.PNG cmd.exe File opened for modification C:\Windows\WinSxS\AMFDE2~1.746\r\VaultCDS.dll cmd.exe File opened for modification C:\Windows\WinSxS\Backup\AM8B2A~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\Catalogs\e4e22a398a4ca4540695260369b181d2621ac718ab4806475c2ac9cb86e4094b.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-DDA-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat cmd.exe File opened for modification C:\Windows\WinSxS\AMFC3B~1.1_F\B57ND6~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AMD64_~3.173\winload.exe cmd.exe File opened for modification C:\Windows\WinSxS\AM89DD~1.1_N\tsprof.exe cmd.exe File opened for modification C:\Windows\WinSxS\Catalogs\1443DE~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\Catalogs\2d1c9e7ed358d02a52b67d290ca1ee8316071e556566e6a3367e51041bf5330e.cat cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.Client.dll cmd.exe File opened for modification C:\Windows\WinSxS\AM1D86~1.126\r\COMPUT~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM0249~1.264\efswrt.dll cmd.exe File opened for modification C:\Windows\WinSxS\AM5CD8~1.1_F\AFDSYS~1.MUI cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.EnterpriseServices.resources.dll cmd.exe - Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\ = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" Process not Found Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search\ = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage Process not Found Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" Process not Found Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" Process not Found Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search Process not Found Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total Process not Found Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeManageVolumePrivilege 1844 svchost.exe Token: SeDebugPrivilege 3288 SearchApp.exe Token: SeDebugPrivilege 3288 SearchApp.exe Token: SeDebugPrivilege 3288 SearchApp.exe Token: SeDebugPrivilege 3288 SearchApp.exe Token: SeDebugPrivilege 5088 SearchApp.exe Token: SeDebugPrivilege 5088 SearchApp.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5088 SearchApp.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3288 SearchApp.exe 1652 SearchApp.exe 4544 SearchApp.exe 5088 SearchApp.exe 2492 SearchApp.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4056 wrote to memory of 872 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 90 PID 4056 wrote to memory of 872 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 90 PID 4056 wrote to memory of 872 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 90 PID 4056 wrote to memory of 4856 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 92 PID 4056 wrote to memory of 4856 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 92 PID 4056 wrote to memory of 4856 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 92 PID 4056 wrote to memory of 4852 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 94 PID 4056 wrote to memory of 4852 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 94 PID 4056 wrote to memory of 4852 4056 d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe"C:\Users\Admin\AppData\Local\Temp\d17739852c8d3a818026afe64e5fbbc45154c364f9bb4c6cdd33b9f1d767c2ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\takeown.exe"takeown" /F "C:\" /R /A /D Y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:872
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\" /grant %username%:(F)2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4856
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C rd /s /q "C:\"2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4852
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy1⤵PID:4000
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3288
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy1⤵PID:3388
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy1⤵PID:3812
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1652
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4544
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5088
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2492
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2964
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:928
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4696
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:744
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:4632
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:1824
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2532
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:1132
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:3196
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2212
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2040
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:2784
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZY5PAWML\microsoft.windows[1].xml
- Size 97B
- SHA256 7466af2872796572506a70bcef969f28b8bcfe0248daf5bf858b8c291e711cc9
- MD5 806cab0d1c3de7c78d5fef3b59ff4482
- SHA1 37fef63277b9fc8967e3d9ea04af496bf213d7e0
- SHA512 8399264a78a9a50fa1898fe37e5b56faa32a3dce6f702fbfe3ad7edb6a7f91da560650a5282e3207f17d7437c9ccf8bd0d76f001d0eb65a2a08675f927507f71
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
- Size 2KB
- SHA256 c3e966ef8325592ee24e4f718a1832daf61e7b04e211a21aa246aeb3d02dd5eb
- MD5 d1b76ab568c584cb7b93aec9192a3a42
- SHA1 928f3bfc95ba4b1f50aea380f10de898a72de451
- SHA512 f02389981c59f5b64a3bf0a97d7626d279b783f7a78cabec4c65f2284c65b6531b6efe1e39066e03017c7afdcde82097a450fd3a6c66f2a133a8347d3590363f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}
- Size 36KB
- SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
- MD5 bad093419be1135cfe9694ea77088c78
- SHA1 76204c7ca72cf666add9c9931389d635c82e8af0
- SHA512 3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
- SSDEEP 48:jDlmj1hraax2DvfG+ohTrNAg4eBDAudJ4hKO2I7dQOggBYiiqD1yB72G6nBRz9iz:jDlU1hUol9onbdaa/aarIkb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___docs_oracle_com_javase_8_docs
- Size 36KB
- SHA256 a3273cc3378123d6670a231700cb8a1ec161f8c42a49b245c173db31ef1b997e
- MD5 e42ac5c8e552fc39d776eaa7cb7ff168
- SHA1 028f9ed87f403ea61ff56378aabf9ff8b6866cae
- SHA512 5bf4893bd298f55fd459c07cddc21ec124244ea97f351c8a3a3303ac49c5dc30ed335698c7927ee30a183b1bc15e740dd6ea217f2db80a878fe635549d777a90
- SSDEEP 768:Xmmmmmmmmmmmmmmmmmmmmm9KB0OVwGMJdx7b8NEViF1CMui9iJ00BJafYYXenofK:sPH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{23c219e9-4be0-480c-891d-ce6961e631a8}\0.0.filtertrie.intermediate.txt
- Size 28KB
- SHA256 80b1c12d18e49cf0ebfa4b380028b6f9e1791f4800a6bfb657e140714c3e8f3d
- MD5 bb7640183196f554caf076ff2ca0e12c
- SHA1 ccc92a16fda19e15631083fd81b02f0ea6e732ed
- SHA512 1e2ab4baac6458e7149f6bc8a1a649a1e8d7edf41309e0b1a8cbc8f2b392cc8e3ab8dc77de98763ab3879c86dbe6a6207dabf3284c1b7799428a10d2fae612a1
- SSDEEP 768:+/ECewchqEZDgApz9dGByMVyNAaFH5Dikj91JjI:tv9R1zS/VyNA+dnjhjI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{23c219e9-4be0-480c-891d-ce6961e631a8}\0.1.filtertrie.intermediate.txt
- Size 5B
- SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
- MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
- SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
- SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{23c219e9-4be0-480c-891d-ce6961e631a8}\0.2.filtertrie.intermediate.txt
- Size 5B
- SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
- MD5 c204e9faaf8565ad333828beff2d786e
- SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
- SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{23c219e9-4be0-480c-891d-ce6961e631a8}\Apps.ft
- Size 38KB
- SHA256 59d9a0ad8f3a55b1f83aea35ee590e2ef70f06939eb7beb8f77af9c40ce2ca84
- MD5 a2bdb51b1b1ea8360bc64530ab16d7cc
- SHA1 95b7724c7506e17a6cfb38a29d5cac95f0ae14e6
- SHA512 dee7aacd0e11d2595d7bc32dcb21fe78afd8f2f3f88f6a5142f14e22de60c1117906b72d6ace9bad8ccb035575b9ff3136a5a8729919a8cee13142c40559e5ba
- SSDEEP 768:UXNYPohNf1F/Om8Vz9JWxXVoVPPPw4XcWocHE:UXNYPohNf11Om8B9JWNVoVPPPw4XcjgE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{23c219e9-4be0-480c-891d-ce6961e631a8}\Apps.index
- Size 1.0MB
- SHA256 d9325550e42b994a9eafa97df42e55a6dde97e393ba1d7734d02e42d7b4aeb08
- MD5 bfcaa14dffd4f012957064bc236f3164
- SHA1 569e9c9102f03ca1ea83f7f4ae479f8e3a116ec8
- SHA512 d0dc537859cef13e9ed1932403fa98973cd81345be999cb7fb006e7a1c39aa31edd98b3069813cedea541a554c9f127192aef152563b8f3548f32bd967d50ec2
- SSDEEP 12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSJT:AoLr7YfoyFxz8GfoLr7YfoyFxz8GJnT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{6697e4ab-4f89-4f83-a6d3-4f3889edc430}\appsglobals.txt
- Size 343KB
- SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
- MD5 931b27b3ec2c5e9f29439fba87ec0dc9
- SHA1 dd5e78f004c55bbebcd1d66786efc5ca4575c9b4
- SHA512 4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd
- SSDEEP 3072:+rNHn+auvNDrohmXLI7E8FAtXQkun1907JL6hq65sRQsqbmfEV+1+b:qNH+auvJohmXLIQfhI1YL6hB5PsqCfU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{6697e4ab-4f89-4f83-a6d3-4f3889edc430}\appssynonyms.txt
- Size 237KB
- SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
- MD5 06a69ad411292eca66697dc17898e653
- SHA1 fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d
- SHA512 ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693
- SSDEEP 1536:ek7gHR0SV2zp+MK2MHYAb8hqahIBAgoEA6YoGCmrzzB9C1D48fYMLZB1QMX+Z6pL:RUx2kBFeDb9YiAlP+zCmTXFePKG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\apps.csg
- Size 444B
- SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
- MD5 5475132f1c603298967f332dc9ffb864
- SHA1 4749174f29f34c7d75979c25f31d79774a49ea46
- SHA512 54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\apps.schema
- Size 150B
- SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
- MD5 1659677c45c49a78f33551da43494005
- SHA1 ae588ef3c9ea7839be032ab4323e04bc260d9387
- SHA512 740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\appsconversions.txt
- Size 1.4MB
- SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
- MD5 2bef0e21ceb249ffb5f123c1e5bd0292
- SHA1 86877a464a0739114e45242b9d427e368ebcc02c
- SHA512 f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b
- SSDEEP 24576:A5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMo:AMVD4g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\settings.csg
- Size 454B
- SHA256 1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48
- MD5 411d53fc8e09fb59163f038ee9257141
- SHA1 cb67574c7872f684e586b438d55cab7144b5303d
- SHA512 67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\settings.schema
- Size 162B
- SHA256 d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031
- MD5 ac68ac6bffd26dbea6b7dbd00a19a3dd
- SHA1 a3d70e56249db0b4cc92ba0d1fc46feb540bc83f
- SHA512 6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\settingsconversions.txt
- Size 520KB
- SHA256 2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13
- MD5 721134982ff8900b0e68a9c5f6f71668
- SHA1 fca3e3eb8f49dd8376954b499c20a7b7cad6b0f1
- SHA512 5d1c305b938e52a82216b3d0cee0eead2dc793fac35da288061942b2bd281fb48c7bd18f5fdaa93a88aa42c88b2a0cce1f0513effb193782670d46164d277a59
- SSDEEP 6144:CJ/o/Xp9DRgb06sVxj8dAB4u2OsfnEa83LGWCAFdkwQknzBc8A:CgRbxjiuTsP583eAMwQknzBcT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\settingsglobals.txt
- Size 43KB
- SHA256 218042bc243a1426dd018d484f9122662dba2c44a0594c37ffb3b3d1d0fb454a
- MD5 bbeadc734ad391f67be0c31d5b9cbf7b
- SHA1 8fd5391c482bfbca429aec17da69b2ca00ed81ae
- SHA512 a046600c7ad6c30b003a1ac33841913d7d316606f636c747a0989425697457b4bc78da6607edd4b8510bd4e9b86011b5bd108a5590a2ba722d44e51633ed784f
- SSDEEP 768:NhLlwUkdu97GqHJh+Ivl+2rn29oyWSlfM4NN30c/f3hQI+7A:NhaUd9iEXnrnOTr2q3GU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7a759184-b09b-4886-a34b-9db7d9335cc8}\settingssynonyms.txt
- Size 101KB
- SHA256 12d00eee26e5f261931e51cfa56e04c54405eb32d1c4b440e35bd2b48d5fcf07
- MD5 003ece80b3820c43eb83878928b8469d
- SHA1 790af92ff0eb53a926412e16113c5d35421c0f42
- SHA512 b2d6d9b843124f5e8e06a35a89e34228af9e05cbfa2ae1fe3d9bc4ddbebda4d279ce52a99066f2148817a498950e37a7f0b73fe477c0c6c39c7016aa647079a5
- SSDEEP 1536:Vk0avCce1rfaFdi8MGBtf9if6pW3O2cI40d7uwLLy8K:u0csLaFEX8G6pW3G98K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133536136028657564.txt
- Size 72KB
- SHA256 c8fe9454e3257e33e2aa62872f4e7686f19e5ef84f161fdafb59e364e764e069
- MD5 5b4b9d0df8b6dfd821c5d714018057d2
- SHA1 737572ed9a2e31b9c70be6b89a69c1cef3b9fa5a
- SHA512 dc55427a58a5a84f3daed54eec79f47ad6278ca640ddb39d1c346006b2455347a94d41b7184afda1e9f34c9d848f478a1b55a70594afb5f500458bac4ed1ec29
- SSDEEP 384:i/vg/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/eAe//r/td:der1D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
- Size 212KB
- SHA256 a91f31f7d6ebf0a7d773b72b892be02f381881e4600c3c64339b1207db8797a7
- MD5 b6d3a634b46d2d549867e8118f8f5be6
- SHA1 f620d8d40c1b2de0eb77b4a497f6226595062431
- SHA512 8e9cf0875909ff8be62df8b35e6b030fcaf21e3368912c8d79cd9b66f004de011c9523393a76cdbf9493a145d8d36a765b64dbaae7a73df54c35cae92db9f583
- SSDEEP 1536:MOjzL2kqklaaJAKJUYEg4UuH6boOMYdepyasOYHAw7fuiNCpyYsUbkihG9lSBkWv:MOjf2kqklaaJAKiYbkBZW7sSa2PqFFN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
- Size 9KB
- SHA256 3e9a9685d9d36aa479977ba77fe9f8e3fec0a7b4b3a937b40340912897b0106a
- MD5 8b5e98534af1f7a9dc201b1f77c0186b
- SHA1 2e14f0bb9a7fae6531022174ea2427d952345509
- SHA512 bd1b74c8aabb39593c19cc4eaf2bf7aefd30a73dc34d0ec36b0ef75c5c21f6aaa4b369b81244f0102f4e8b2b436d0e604734d7ad145de162f11f16b058d9d093
- SSDEEP 192:rJPy49I7Qiy3zkYJeko/tkpCk5NDuhAksz2ZUhmkDSRRPQReqjfQOVjeQ8RJo17C:rJQ8zkkeZ/tBAJlpmcfQOVjeQ8RJoA
- MD5 SHA1 SHA512 SSDEEP