9563aaa0aa41bb9762c4f84bbc0892831f804b0343fc08b1e4a665230a60331c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plugins/Restore all built-in apps.ps1
Size 1KB
Sample260509-c8y3eahz8v
SHA256 9563aaa0aa41bb9762c4f84bbc0892831f804b0343fc08b1e4a665230a60331c
MD5 c0c8b652c4b5d04a19f5849df8228a48
SHA1 f83b40f96f7d0486946847140525640e5be6d329
SHA512 0b012f528105b309ff000b16d4e0adcb693caa3fb319464b653ed351d83a48149890b0ced3501ffb07381ccc05daa8947eb484aef12a03f3a828c69f67fcb893
TLSH
T14C3121365AC012F6B95BC2CF204A581828B702274A9F0950F6DDC419FFCB52EC6A34B7
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware execution spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1276	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Microsoft.Photos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Microsoft.Photos.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Elsa - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Zira"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Katja - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Elsa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{179F3D56-1B0B-42B2-A962-59B7EF59FE1B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Stefan - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - fr-FR Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{57523D96-B7F6-4D2C-8AFC-BCC5F5392E94}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Paul"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\c1040.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "È stata selezionata la voce predefinita %1."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\tn1031.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5218064"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "既定の音声として%1を選びました"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; net=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; Name=NativeSupported; media=NativeSupported; message=NativeSupported; companyName=NativeSupported; computer=NativeSupported; math=NativeSupported; duration=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Paul"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Traditional Chinese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR en-US Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Vous avez sélectionné %1 comme voix par défaut."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; message=NativeSupported; address=NativeSupported; media=NativeSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0CFAE939-931E-4305-8D05-8C76C254EB34}"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\lsr1036.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; media=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1041-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "en-US"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\r1036sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hortense - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\L1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\MSTTSLocdeDE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Helena - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1276	powershell.exe
1276	powershell.exe
4968	LocalBridge.exe
4968	LocalBridge.exe
4968	LocalBridge.exe
4968	LocalBridge.exe
4968	LocalBridge.exe
4968	LocalBridge.exe
5976	SkypeApp.exe
5976	SkypeApp.exe
3476	LocalBridge.exe
3476	LocalBridge.exe
3476	LocalBridge.exe
3476	LocalBridge.exe
3476	LocalBridge.exe
3476	LocalBridge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	5976	SkypeApp.exe
Token: SeDebugPrivilege	5976	SkypeApp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3108	SearchApp.exe
4104	wwahost.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\plugins\Restore all built-in apps.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
"C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
1⤵
- Checks processor information in registry
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
Size 2KB
SHA256 e58a78251798dacb463ad7c56e5e8d385ef3a5965ab08e546402afd44aa20d8f
MD5 208820b192bc3bffe66d45a7862880a9
SHA1 0284e21297ad032ea042dfa5254618105276eb0f
SHA512 6fb20f90621cd87d4f0008eb0c35d14c6ef9ffc2ef5be8600c5f7fc98580c068cc5dadcb0325c1382c6cd4d9febe8f66f0ea7dbbe11f9aa133429d7041104314
TLSH
T14D412C176764DAD1FD785C808A95BBB52CFCFB138C54009A341A6116587DFE4FB010AD
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 0a70c15464c4553a6369001e63e6946c0ce35cbbe1fede420f4c36855171271b
MD5 96592b148dc7e854984b8f08633283cf
SHA1 cc132d1890e22f1cfbabb9329327f24623ccef57
SHA512 85aebf869dbb330176dd5c85fc21378761684f0d9afba2837fa7463275626e97a0bcd7f23a3efc6ed5168da621eef8455dc43a9523b98f5dfc65a9c738b59ed7
TLSH
T19EF00E53409CE804AEA36CDC10B0DAF33425A46400D16089709DA9E10C6BDA6B63F039
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
Size 556B
SHA256 8af075720bbe1422cad8b3d35017ead26eb159dddace42a7408d96d6afe96cbd
MD5 9d68aa7583867408783da8f37a42b6bc
SHA1 7cec8c8f619bfe87834a1b7e54678963c11b2356
SHA512 a4e2e61d0524a5146e11c956937d628df1ad3aed346969c30b5c283c39c5afc95d1f0eecd796faf41e2217de3465e562a5f659364599d1c40b3b690d435a8f1d
TLSH
T1F8F097A474F88127D2739B3CABE46EAEE926F22324022A3D019242081903F431C6372F
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 3e55291f4474f7354ef5df756e3d574f0388d33022f4eff26e709c4b366a72d0
MD5 bab2d68573190d87e3a27e82c300ac46
SHA1 caf31459679e8826d09cc352d82e490932d2a5cd
SHA512 4b57a2bbf4a14e5c3d4ed57ec83a7b71f157fab6053c5cbe137415e80ac8825f4f425baef528b7b33fa54c6c468b09c294f925a04e888d3f0b16222d7968262c
TLSH
T1C0E0C02025FB012EF1F6E17447D8BCB0C15AF0111460A2B315D87B066202A00ED11D35
MD5 SHA1 SHA512 TLSH

Submit Download

LocalBridge.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log
Size 1KB
SHA256 9be9391f014c9d2823d8f04f26e5d706dea11aeb6473ab3b63a94027b99a6840
MD5 f933dcb7c3e56e44762b4431ba59f4cc
SHA1 62fd879e612296ab29136c4e17193a11d4fdaf11
SHA512 86d8690381b12dcade62ede921f3b8760fb275670d7efc6d05b99b359c76ac68cc5a472600da5426efc2c317747aff8526a42946b490bf079b3d6ddee6fdbe66
TLSH
T1FE219E7032B6A0D98D111E591C1E6BC403FF932A7A909F1C7994725EED36447AF322F6
MD5 SHA1 SHA512 TLSH

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5261c8a1-f13a-42a5-bceb-5a36d4da7dde}\0.0.filtertrie.intermediate.txt
Size 29KB
SHA256 b0aa0fa250b06eccd920a303c494bcdd5e93db70ce8e76e5115d2ee52b615944
MD5 d340e87253ca2e82fcc88c51c10a4f57
SHA1 6e2b53a6cccbc17055f0cd86f9895762095ea7b6
SHA512 583ceb6b7547065c2f14fd0cde52f1d8b2c663461092b30fa2ef6f330ae44c0a022d0a343f0b548bb69a901550e12617e132269771e079cb57f494c78a068a72
SSDEEP 768:+/FC9wchIEZDqUpdNGiRy0oyX7aFHNDikd9HajS:6a9Dtdz1oyX7+pndQjS
TLSH
T1A5D2FC35C772A16B70B15AE46F478352BC01C44697C7AA621BADBCF4E1C90B18FA727C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5261c8a1-f13a-42a5-bceb-5a36d4da7dde}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5261c8a1-f13a-42a5-bceb-5a36d4da7dde}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5261c8a1-f13a-42a5-bceb-5a36d4da7dde}\Apps.ft
Size 40KB
SHA256 518434cb3b590c194f62656bbdc683c7eb4525e1c6334d4ce17f2f6467285b5c
MD5 7805351db0d73efadb4d83f92e5e2df4
SHA1 dcd0e5bee12d45248d6480485d42b7b2b2bb4051
SHA512 3c3c356667c112c564c28dbadfee50e5fadad54369c47a884462704e7718f475d2e7722ffedf35a1a0df1b173fc4bf2ecdc864a7f3ae184170de1a3fbcedddf7
SSDEEP 768:EtBYEobNf12OO2qd23ht6ZVoVPPP8sXAG1IdFE:EtBYEobNf15O2qE3hteVoVPPP8sXAGSk
TLSH
T157031BD94B29962FF30A1F3A4682A435DAE427B0A1D9F7C3DCD434A81DCD5621F3C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apps.index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5261c8a1-f13a-42a5-bceb-5a36d4da7dde}\Apps.index
Size 1.0MB
SHA256 9dfe87527da29e5de6e78e627a4fa4ce0394b3fdd009810d28ca6ebae57e005c
MD5 c1c585f998a50d75fe899566744891ef
SHA1 9224ac98afdfd7eaccff2356496f9c00f2d2e6ca
SHA512 504e97c0ec3b29bf06507df731bb5ffd8b855449ee6c7a3bf4ce76fe43b00abf1ede40613f0098047e80a2735e097d45209f498e8fd52e9f10cdc6f094264cc5
SSDEEP 12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSFR:AoLr7YfoyFxz8GfoLr7YfoyFxz8GZdL
TLSH
T1E235E0096F60626BE8255BB42FC32F513FBBC62A53EB13AB8B35413C1CB43457D5942A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134227684159612744.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134227684159612744.txt
Size 88KB
SHA256 40bc90b6d19f509a259e9627bc63b08a566934d1637b8332517bd2d424763bea
MD5 43b1a3b1fb7a8b0baa024b93f429814c
SHA1 38bdba6166074ebcbb65b7b034fbcc223b7bdf59
SHA512 cdb21d1fd64b9918dba40a3e0b9355860e7215ef3d2f786c318675bf0a9b2e28ee558b895147c0f43b70cb4fbf3fff38d9ddbe4d439d8656173cdf4733dbf6a7
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/ib:vYGzozuyK2RzV1D
TLSH
T12F93A2A53281CBF3317966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 24KB
SHA256 f79cb7f74637aa8d8cc2fb0b1ea202c6bb7e4aea2bf950ec63343ff979c5f428
MD5 70d03b4a55ae106e249d774312e157df
SHA1 de19f95b82c7afa56ae0c4dfcba75a024f78c2d9
SHA512 021d78b3583dee960d7e4b0bc023b0f37277467d5996e7c3f0695d77260a8f292f852fd0ebbc463a95ec106b5e86dfc256cd0c29633f3eb72c8e9630395e9b80
SSDEEP 768:mYVuyRV7xXcT68O/ffa49h+i3+4fLchl8RJs:mYVuuFxXceRffa49h+i3+P
TLSH
T128B21E743AF51725F3B29F718AF5A99A683AB862AD00DB8D416203490537D53CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18e190413af045db88dfbd29609eb877.db-wal

Path C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-wal
Size 12KB
SHA256 b9cb94299beec8a2f3407f1af1070c36e4d8bd4a41cc62b690ddcdf3530fd558
MD5 ef9e9a3a672e943417f7de11049b74c6
SHA1 2400e1c1aa48b329547c50290a2387936e446d89
SHA512 9c8491f77900aafa9ce6d02b1a29db825b5023a0eb384905c9a3abca686ccc2fe142ff583362c23cd13bfa07a70e4d06da596996cb3f5800d1cf2027e4ccc17e
SSDEEP 96:1MjVGJQ2VgMfn3N5Lj2VgMfheRXLS2VgMfheRiNB6lNljVGC:1M4JQ+3jLj+wRXLS+wRWyl4C
TLSH
T1C742B88137704601E8E95DB2C1EB1B377279D549A27340DDDAF24541ACD2186EC2E9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o1gxnijs.4sw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1gxnijs.4sw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

offline-wal

Path C:\Users\Admin\AppData\Local\Temp\offline-wal
Size 8KB
SHA256 3cf5a208a5617c4027dc85ba31b741713e53724d6a571d12fa9603418f358dc5
MD5 6f6c5d95a5a16910ca555daeb5720ada
SHA1 105e82dff78dc734132fd4b2531970a9aed35d86
SHA512 43280433c88ce6f0873d53bbed8341dd605cf6675f3b2b863c6004840187644696a14e81b9685d89c5d812bd707551fff4b96d5d35e35186d7f39933662771e6
SSDEEP 24:KQWcn4qt8VtbDBtDi4kZERDBgw8oqt8VtbDBtDi4kZERDf:j1n4O8VFDYMdgw8oO8VFDYML
TLSH
T10E0291C1B6787161E09651B7CDB313AB177DD269043392A32DB25892DCC18CAD4355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-16-0x000002C108030000-0x000002C10803C000-memory.dmp

Download

memory/1276-13-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/1276-315-0x000002C108030000-0x000002C10803C000-memory.dmp

Download

memory/1276-0-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/1276-18-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/1276-17-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/1276-1-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/1276-15-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/1276-2-0x000002C121ED0000-0x000002C121EF2000-memory.dmp

Download

memory/1276-10-0x000002C1223E0000-0x000002C1223F6000-memory.dmp

Download

memory/1276-11-0x000002C1223D0000-0x000002C1223DA000-memory.dmp

Download

memory/1276-12-0x000002C122480000-0x000002C1224A6000-memory.dmp

Download

memory/1276-14-0x000002C121F00000-0x000002C121F10000-memory.dmp

Download

memory/3108-56-0x000001D27AE80000-0x000001D27AEA0000-memory.dmp

Download

memory/3108-225-0x000001CA78180000-0x000001CA7818C000-memory.dmp

Download

memory/3108-25-0x000001D27A8B0000-0x000001D27A8D0000-memory.dmp

Download

memory/3108-35-0x000001D27A870000-0x000001D27A890000-memory.dmp

Download

memory/3476-288-0x00000252D4CF0000-0x00000252D4D98000-memory.dmp

Download

memory/3476-305-0x00000252B8F50000-0x00000252B8F5C000-memory.dmp

Download

memory/3476-312-0x00000252B8F50000-0x00000252B8F5C000-memory.dmp

Download

memory/4104-303-0x000002A042400000-0x000002A04240C000-memory.dmp

Download

memory/4968-292-0x00000201BCD30000-0x00000201BCD3C000-memory.dmp

Download

memory/4968-258-0x00000201BE340000-0x00000201BE589000-memory.dmp

Download

memory/4968-257-0x00000201BCD70000-0x00000201BCD78000-memory.dmp

Download

memory/4968-256-0x00000201A2B70000-0x00000201A2B7E000-memory.dmp

Download