9db78f817a6761bcf5affb7848271e1fad6470e590b2737080ad357a334b1791

Analysis

max time kernel
80s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 162KB
Sample261014-cl4pdaxset
SHA256 9db78f817a6761bcf5affb7848271e1fad6470e590b2737080ad357a334b1791
MD5 ee2d47210c53ecd4a158c57bf2b87cd0
SHA1 5a2f02e739443237e81359b3c333798c906a27c5
SHA512 5335d91d4dd070b2fc672a01256b6be3c5d149a8ac5c98f8697745114ff5e8f07858d86a559f7b74b951551a69696b3a3ae4b1bea01f24ada21a60f5fa6bc661
SSDEEP 3072:9/xuEaNsQTJBrXJut+B6XIFerstLNRO/vbhkALKdKjJhZJxZMA:9kNutB1kA+dwJ
TLSH
T148F35B36F1D2C433D1660ABC8C5ADAE16927FD302C3A611735D93F8D8E3969258A97C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\recycled\\SirC32.exe\" \"%1\" %*"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\Driver32 = "C:\\Windows\\system32\\SCam32.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.19041.1_none_a81a33274fb1b624\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.19041.1_none_d69cbb4282e4fe2c\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.19041.1_none_cbd9ad4986c925d5\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.19041.1_none_36436b821c9e7209\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.19041.1_none_0b090bb5ae01dd1a\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.19041.1_none_905c6a851ca62951\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.19041.1_none_148b41803c849a3c\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.19041.1_none_f6eee8789c1c6fdd\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme1\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.19041.1_none_4b0e6b545bf0f4e7\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.19041.1_none_3870d3554f39ac78\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.19041.1_none_2f07a4cad3dec315\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.19041.1_none_923716ddadd939c8\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme1_31bf3856ad364e35_10.0.19041.1_none_8ccb1090444b78d3\Desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RDC-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.sys	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\DigitalMediaDevice.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\msux64w10.INF_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\iagpio.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\wbem\de-DE\netttcim.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\dimsjob.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\KBDOGHAM.DLL	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Host-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.inf	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\cht4nulx64.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\wlanpref.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\wbem\cli.mof	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\L2SecHC.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\Com\comadmin.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\regedit.exe.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\comctl32.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-HypervisorPlatform-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.867.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-UnifiedWriteFilter-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\MXDWDRV.DLL	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\listsvc.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\wbem\it-IT\mstscax.mfl	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.264.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LanguageFeatures-Handwriting-ja-jp-Package~31bf3856ad364e35~wow64~~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\c_keyboard.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.19041.1288.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0211~31bf3856ad364e35~amd64~~10.0.19041.1288.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\Dism\it-IT\OSProvider.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\hidscanner.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\netl160a.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\vdrvroot.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\TransferCable.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\wlanutil.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~en-US~10.0.19041.117.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\Dsui.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\modemui.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterStatistics.cmdletDefinition.cdxml	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\EditionUpgradeHelper.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\KBDBUG.DLL	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\EAPHost.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\F12\it-IT\IEChooser.exe.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\vfwwdm32.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\icm32.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-FCI-Client-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\Netwfw08.dat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\circlass.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\setup\RasMigPlugin.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\dc21x4vm.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\netelx.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\wbem\PS_MMAgent.mof	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-UnifiedWriteFilter-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\wlgpclnt.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\vhf.sys	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\Kds.psd1	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\Dism\es-ES\WimProvider.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\en-US\wmitomi.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Core-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.153.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\volmgr.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\PhotoScreensaver.scr.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\KBDHELA2.DLL	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogo.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\it_MASCULINE.pak	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\173.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\PaintLargeTile.scale-150.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-white_scale-100.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Social	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-200.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO40UIRES.DLL	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.mail.config	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_fw.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-125_contrast-white.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_altform-lightunplated.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-24_altform-unplated.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-white.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\az.pak	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\t2k.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_qtr.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-400.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-black.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-100_contrast-white.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_altform-unplated_contrast-black.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationUI.resources.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\SWBELL.NET.XML	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-100.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-150.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-150_contrast-white.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-unplated_contrast-black.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\ui-strings.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\fi.pak	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Controls.Ribbon.resources.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Confirmation.m4a	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-white.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-black.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected.svg	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-64_altform-unplated_contrast-white.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.19041.1_it-it_a404249a5c38819f.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_installutil.resources_b03f5f7f11d50a3a_4.0.15805.0_en-us_d084c90a2ef86965.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..sprovider.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_936b5cca5e65577d.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\diagnostics\system\PCW\fr-FR\CL_LocalizationData.psd1	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Virtualization-RemoteFX-User-Mode-Transport-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Exchange.Theme-Light_Scale-400.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.SettingsHandlers-nt\pris\Windows.UI.SettingsHandlers-nt.de-DE.pri	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..reservice.resources_31bf3856ad364e35_10.0.19041.1_es-es_35a0f1d5a19e3cae\CaptureService.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-g..linetools.resources_31bf3856ad364e35_10.0.19041.906_en-us_723764f005113fa1\gpresult.exe.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.19041.1_none_6da8f779b049952c\5 - Task Manager.lnk	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m...appxmain.resources_31bf3856ad364e35_10.0.19041.1_pt-br_028a3ad42e2450e5\resources.pt-BR.pri	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-rasdlg.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9acf87d8a4a65399\rasdlg.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-cursors_31bf3856ad364e35_10.0.19041.1_none_01289c50fa22c737\aero_unavail_xl.cur	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_windows-staterepository_31bf3856ad364e35_10.0.19041.844_none_daa7a21027e8dc48\r\Windows.StateRepositoryUpgrade.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_systemresource-wind..-ui-accountscontrol_31bf3856ad364e35_10.0.19041.1_none_8805ef3af31f4b8c\Advanced.Theme-Light_Scale-300.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..iextensionsbinaries_31bf3856ad364e35_10.0.19041.1_none_1cdb4b178ac2f836.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-msmq-powershell-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1237.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.19041.789_none_372ecccdb2c89109\f\accessibilitycpl.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_de-de_181aed41f51697e5\TrustedSignalCredProv.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5af0d35f5d5822e9.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_et-ee_2e542ad48c77431e_bootmgfw.efi.mui_a6e78cfa	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..randsleep.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_97df00ae041f3417.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..ctivities.resources_31bf3856ad364e35_10.0.19041.1_de-de_87546ce25029bc0f\Windows.Data.Activities.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..redential.resources_31bf3856ad364e35_10.0.19041.1_de-de_5a4d1da4e6b631da.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_wvmbusr.inf-languagepack_31bf3856ad364e35_10.0.19041.1_it-it_cdbea04613351484.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-l..overy-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_c639d3e99c6f593f.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Activities.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\GazeInputInternal.winmd	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-composerframework_31bf3856ad364e35_10.0.19041.84_none_04cc8ea92b09a58a\f\WindowsInternal.ComposableShell.ComposerFramework.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.19041.546_none_cefcfcd89d8d8a93\f\wuceffects.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..edirector.resources_31bf3856ad364e35_10.0.19041.488_en-us_abf37dde47a14058\f\umrdp.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_10.0.19041.1151_en-us_ef30ed021326193e\f\wpd_ci.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..dminflows.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5a7ba8144123e555.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_10.0.19041.1023_en-us_e7d5a7ef6b22aa09.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.Resources.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-acpiex_31bf3856ad364e35_10.0.19041.1_none_eabbb32778568ee1\acpiex.sys	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\f59cdad9de4487c8f883fc44056198199816a11b3e439b1564971db3354ff957.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\msil_policy.1.0.microsof..ll.commands.utility_31bf3856ad364e35_10.0.19041.1_none_d30fcd398945ca99.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\System.Runtime.Caching.resources.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-r..izard-mui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7336f569fdc72dd0.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-waasmedic.resources_31bf3856ad364e35_10.0.19041.1_en-us_91b8aab78c172da0.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SplashScreen.scale-100.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\program_files_windowspowershell_modules_microsoft.powershell.operation.validation_1.0.1_8dc23381b6cca003.cdf-ms	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..s-sessionenvservice_31bf3856ad364e35_10.0.19041.1_none_94cf631187048f38.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\NearShare.scale-125.png	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\r\cleanmgr.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.csharp_b03f5f7f11d50a3a_4.0.15805.0_none_9a8ac6d5a05b610c\Microsoft.CSharp.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-transactionmanagerapi_31bf3856ad364e35_10.0.19041.546_none_3f25415e6728280f_ktmw32.dll_835a43ee	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-devices-wifi_31bf3856ad364e35_10.0.19041.264_none_c9a8d584f9ed6e6b.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\lottie.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..-wmpshell.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b8e8bea0dbd0dc52\wmpshell.dll.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_10.0.19041.1_es-es_07cae14c20d47379\xwizard.exe.mui	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_product-onecore__mi..p_src.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_029fa2714cb9da9c\microsoft_bluetooth_a2dp_src.inf_loc	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_system.diagnostics.tracesource_b03f5f7f11d50a3a_4.0.15805.0_none_7fe888873c946868\System.Diagnostics.TraceSource.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-AppServerClient-OptGroup-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.mum	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\servicing\Packages\Package_7_for_KB4552925~31bf3856ad364e35~amd64~~10.0.1.3176.mum	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\r\navigator.js	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\WpcBlockFrame.htm	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.964_none_21209b01f08afd33\r\SystemResetSSO.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_netmyk64.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_47249b20a108b349.manifest	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Ichiro - Japanese (Japan)"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = 4ceb4de51753375e6967fd144fced62b87697270a205fca4961d9e7157eeb830	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "804"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\MSTTSLocesES.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech SW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Ichiro"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR en-US Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L3082"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Helena - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 aa 000a ae 000b ah 000c ao 000d aw 000e ax 000f ay 0010 b 0011 ch 0012 d 0013 dh 0014 eh 0015 er 0016 ey 0017 f 0018 g 0019 h 001a ih 001b iy 001c jh 001d k 001e l 001f m 0020 n 0021 ng 0022 ow 0023 oy 0024 p 0025 r 0026 s 0027 sh 0028 t 0029 th 002a uh 002b uw 002c v 002d w 002e y 002f z 0030 zh 0031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 ^ 0008 1 0009 2 000a ~ 000b : 000c a 000d aw 000e ax 000f ay 0010 b 0011 d 0012 ch 0013 eh 0014 eu 0015 ey 0016 f 0017 g 0018 h 0019 ih 001a iy 001b jh 001c k 001d l 001e m 001f n 0020 ng 0021 oe 0022 oh 0023 ow 0024 oy 0025 p 0026 pf 0027 r 0028 s 0029 sh 002a t 002b ts 002c ue 002d uh 002e uw 002f uy 0030 v 0031 x 0032 y 0033 z 0034 zh 0035"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\c3082.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\lsr3082.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - es-ES Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Julie"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{BAE3E62C-37D4-49AC-A6F1-0E485ECD6757}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "5233694"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Adult"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-3082-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\lsr1036.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - ja-JP Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Ayumi"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "en-US"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\MSTTSLocdeDE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\tn1036.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR de-DE Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR es-ES Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - it-IT Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Japanese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "409;9"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "407"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Discrete;Continuous"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\AI041036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1040"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Haruka"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1033-110-WINMO-DNN"	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2652	svchost.exe
Token: SeDebugPrivilege	6016	SearchApp.exe
Token: SeDebugPrivilege	6016	SearchApp.exe
Token: SeDebugPrivilege	6016	SearchApp.exe
Token: SeDebugPrivilege	6016	SearchApp.exe
Token: SeDebugPrivilege	6016	SearchApp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6016	SearchApp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6016	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Creates a file in the Startup directory
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2560

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:6108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:4040

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6016

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:1820

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:692

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USS.jtx

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jtx
Size 3.0MB
SHA256 d5698de690d3017782640c35587afa6bbd8fd782d015447ab5041dcfe466f358
MD5 2f044318ebb5e01153cc6df3e9310975
SHA1 b58e8b2b73503bff0b3b6a862ea70d16404cfe95
SHA512 9a4b3dbc6927aeb9839242873de737520cde85d4cec3137a6ceec365131003862c6ac304f7687bfcd8322da95b4f194616cc2c0943ebb3e5b1173214870728ab
SSDEEP 12:zWJaH2N1PqH2N1P2+W4X12N1PqH2N1P2Cs8YQ1kkd4DKob:zWJaH2DSH2D+pu12DSH2D+C7CkeDfb
TLSH
T180E53082B2FDDD2AD965447A5EA732D996F0E6142F85E30A5305D58C75B2808EEA1303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QG6YCIPX\microsoft.windows[1].xml
Size 97B
SHA256 5970e52fdc0423ad0ddc3ebf74c1f13361c67931888c3c64a477fe92ce12d9d9
MD5 b4fd1bd677e81ec2b676652ca0f45a9d
SHA1 ab567eec0138a27048e768b4b9433fe3ea18147b
SHA512 709816051ac0fca1f6e880a82002cb988d8799fe1df9b183396c50e4249671c47f529920c7e1e1202816edc66e70aa4a4de437f6a26d8996519d3d2b6b2da9a4
TLSH
T153B0121279849C59069565F62F0AE0F072EE008253457A7838F8FC0675C5D46E037CA0
MD5 SHA1 SHA512 TLSH

Submit Download

95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
Size 2KB
SHA256 43f031617df4c74466274815ada75537a5579982e5ec85482615a7861d609063
MD5 99158a2ac810ea01bab19483303756f1
SHA1 a8d6c62409b570b2e1a22d09e33d537f95b391f2
SHA512 b45025587c7bf37361d2c8b9e4c2f0b31587def63a5ee654200648ce6d6971ad8a659e30855bb6f2fa4d9bf9a34a0a9b302600cc8f002d5245fa90510d0b8033
TLSH
T15A512858BAF91048B3B7AF5A9FF7A86E487F79272F07D45D10110D4E0B22A41C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1c4d4a-60a2-461a-8551-e9728dd693fa}\0.0.filtertrie.intermediate.txt
Size 2KB
SHA256 c664536a666f514186a2aafb529effb6ef6fd2e8ed46acbba6c2f7568ce8997f
MD5 1f04954b0d40df9d3068bcdd4c30050d
SHA1 672e868d295a3713a3a27c5d750f28fee74dabb4
SHA512 2f753ac069f9b6fe2a91e2dcdde5d2356752e52a0f62bc166888c520a8ec54e9b673bc83c893fc2a756173107a3bf4ab29f778ed30ad9108e8ae80836b0f939b
TLSH
T1A05114A10B20505E58359AB48787B381BC6DC14297ABCEB105FCB3B4A4C29F49F961FE
MD5 SHA1 SHA512 TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1c4d4a-60a2-461a-8551-e9728dd693fa}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1c4d4a-60a2-461a-8551-e9728dd693fa}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1c4d4a-60a2-461a-8551-e9728dd693fa}\Apps.ft
Size 3KB
SHA256 32a0917af0e7a80dc038db5e60c0d29dc252d965eea12bcb38cb2e394f983b49
MD5 d18030246767d3bb47b5d9f1fcc8bc91
SHA1 db0d86b2b7ba0993d968e6ff63eb4e828003ad49
SHA512 20a8ccb348516f69a2c5d942a7595da1f2187467d534bf8b893f930e076ab5031381635de3c8d850d89a83632d79087ed3c420bf1ef3851321ea512e39eac07b
TLSH
T13C71EFD60620733EF3451E3A46C9A031EFF2A77490ACB6EED8CA74655CE55615F2C183
MD5 SHA1 SHA512 TLSH

Submit Download

Apps.index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1c4d4a-60a2-461a-8551-e9728dd693fa}\Apps.index
Size 888KB
SHA256 a975b50a860c06322d5faf8187f589dfeb870c5a6c048e2fff5e99c7211e1a18
MD5 cccca06ee528b091bab6cadaf5620d96
SHA1 ddc04227dfc2e4fe32b67588f05560eed82496c1
SHA512 f93d07201e1ed3f19373ab6647a01d0d59034fe5f454769506ec15e4ad8dc1de9cc92b3224616f9a40553b93ab1a9eb451d0507455e589ea328192ae20a5f56d
SSDEEP 12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSY:AoLr7YfoyFxz8GfoLr7YfoyFxz8GY
TLSH
T1171502097C90637AF9359BB03F426F526FBFC61D92EE10BF983542101DA42499E9D83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apps.csg

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8d5131fe-9935-41f1-914d-c50faa92fe78}\apps.csg
Size 444B
SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
MD5 5475132f1c603298967f332dc9ffb864
SHA1 4749174f29f34c7d75979c25f31d79774a49ea46
SHA512 54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff
TLSH
T193F01757FF51C800C8800E7C0E6BCFCDAB10E8848E226307B2B9678E2D7355E5811A25
MD5 SHA1 SHA512 TLSH

Submit Download

apps.schema

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8d5131fe-9935-41f1-914d-c50faa92fe78}\apps.schema
Size 150B
SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
MD5 1659677c45c49a78f33551da43494005
SHA1 ae588ef3c9ea7839be032ab4323e04bc260d9387
SHA512 740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030
TLSH
T1C0C04C109C23D21BE56213E4BB7D4BD0C338515953B324A7B822B095574145D52A52C5
MD5 SHA1 SHA512 TLSH

Submit Download

appsconversions.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8d5131fe-9935-41f1-914d-c50faa92fe78}\appsconversions.txt
Size 1.4MB
SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
MD5 2bef0e21ceb249ffb5f123c1e5bd0292
SHA1 86877a464a0739114e45242b9d427e368ebcc02c
SHA512 f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b
SSDEEP 24576:A5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMo:AMVD4g
TLSH
T137650F08AFF56A1FCA6C77B6DEF94B8623B707800433F415CA6CEB252E4641B5E6406D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsglobals.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8d5131fe-9935-41f1-914d-c50faa92fe78}\appsglobals.txt
Size 343KB
SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
MD5 931b27b3ec2c5e9f29439fba87ec0dc9
SHA1 dd5e78f004c55bbebcd1d66786efc5ca4575c9b4
SHA512 4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd
SSDEEP 3072:+rNHn+auvNDrohmXLI7E8FAtXQkun1907JL6hq65sRQsqbmfEV+1+b:qNH+auvJohmXLIQfhI1YL6hB5PsqCfU
TLSH
T15E74447D064E0AF83160D7EA0CE969DFE39BEF239006A702DBD4D78C4E07D59291AD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appssynonyms.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{8d5131fe-9935-41f1-914d-c50faa92fe78}\appssynonyms.txt
Size 237KB
SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
MD5 06a69ad411292eca66697dc17898e653
SHA1 fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d
SHA512 ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693
SSDEEP 1536:ek7gHR0SV2zp+MK2MHYAb8hqahIBAgoEA6YoGCmrzzB9C1D48fYMLZB1QMX+Z6pL:RUx2kBFeDb9YiAlP+zCmTXFePKG
TLSH
T11934B70E967739262E5BDBC40C5392E3FF1F0592A48270F578683E09898157FB1DBAB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134364174807402527.txt.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134364174807402527.txt.~tmp
Size 9KB
SHA256 0fd7f1691d348b6a114fa05e468c9fbdc4d7e542246535724aa2abf60bb7a56a
MD5 1ef5f13877fa44ecbe33fabad4124473
SHA1 2c033d610d178a535483dcfc83262f6238fc3d24
SHA512 335e34b4fdfaf066a9217fadb99b2d2c28d2aa481407725a065dd6cb68a86bf24dafdaf715cb89fd5eda9ba335912dbc9c64a46e96348a52d4d1b37c760dc44d
SSDEEP 192:Os/iYF/LOa/LSN/x3E/nCzhGzR/MxPJ/+MV/xt/MUh/Fc:R/ik/LJ/La/xU/nCzozR/Yh/+2/x3/Fc
TLSH
T1A812B4617290CBF7657976A07CDAE470E46D27A2D0A88F4421FA9217EC5BADC63313C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDX_CONTENT_TASKBARHEADLINES.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
Size 326KB
SHA256 5f147a4f239cfb4d9d479ee1cfb63b8662b1ac254406bf4e60090f3266c10322
MD5 4b83032b4b06572240cca6b8f4b82c81
SHA1 d62516a42cdfb5155d812b40a5d679d0a6256278
SHA512 0e98f3a5a6a42c5fc16c723c1548e3afb3db66a9d8dd08316f6aaccb13e88fd18885b4f0331c2e54114a89484f59bbcb473c3e87b13185a0b7dbcf05a9ab908b
SSDEEP 6144:ajWajXDnnXhIOgglJJh+qe31Pddz10/IQ:WWqDnnXhIOllJJh+qelPddz10/IQ
TLSH
T126641B276118E4B3CB856ECECC3F6F376196611E49D69C9CE79CCE088DA80BC27562C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~ortanaUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\~ortanaUnifiedTileModelCache.tmp
Size 8KB
SHA256 fed47b5b55361ee2cab9916b256758d57513a431990e3e6ac77081b91e43644e
MD5 7db4f485b2f0a2952f9df46ad0b26678
SHA1 7ae24be269b7acf053faa7f6ccde321b254e11f4
SHA512 28c3c827f67bdcf374224addb00f8fb3ff5a718b7a3fd2a712813a91a9ffba032a794b617d7e337201d53c1c50b227e5b236149009632c75a8bafca65dcdb549
SSDEEP 192:4eKWoLyhn1MGcDuJN4Wn8PQkZPWQLvzf+yc+OQTShI:41WuyRfcp1PWQLLf+i3+e
TLSH
T15902E3243BF41719F2F64F35D5B52D9AA93B78669C01D38D1526128D083BE92CE70F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~ortanaUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\~ortanaUnifiedTileModelCache.tmp
Size 7KB
SHA256 a455addded690fa4d061653249c1f29ca3f61be50c6d20f49d104d916bcfe02b
MD5 ba94bb668701060cdf6d38c5f2088845
SHA1 1f8463ab5ebd6e72971036eb5510bb59ab816f18
SHA512 ff69937be076937f1dbeadef20858d83754d6a2244e0c34a9261653cb2a0576736e9fc08d40c6a93c3ea64049a0473028f620ba7e89469e029442858e41b6a51
SSDEEP 192:bGmWoLyhnAMGcDuJN7Wn8PQkZPWQyvzf+yc+OQTShI:bxWuyRYcc1PWQyLf+i3+e
TLSH
T188E1E36437F41B18F3F61F3599B52D9AA93FB8269C04D38D1526129D083BE92CE70B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2560-55-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-385-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-362-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-380-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-383-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-389-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-387-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2560-0-0x000000000041F000-0x0000000000420000-memory.dmp

Download

memory/2652-48-0x00000222DA270000-0x00000222DA271000-memory.dmp

Download

memory/2652-50-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-66-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-67-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-68-0x00000222DA2A0000-0x00000222DA2A1000-memory.dmp

Download

memory/2652-69-0x00000222DA2A0000-0x00000222DA2A1000-memory.dmp

Download

memory/2652-70-0x00000222DA3B0000-0x00000222DA3B1000-memory.dmp

Download

memory/2652-71-0x00000222DA300000-0x00000222DA301000-memory.dmp

Download

memory/2652-72-0x00000222DA300000-0x00000222DA301000-memory.dmp

Download

memory/2652-21-0x00000222C9F40000-0x00000222C9F50000-memory.dmp

Download

memory/2652-6-0x00000222C9E50000-0x00000222C9E60000-memory.dmp

Download

memory/2652-41-0x00000222DA120000-0x00000222DA121000-memory.dmp

Download

memory/2652-43-0x00000222DA260000-0x00000222DA261000-memory.dmp

Download

memory/2652-65-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-59-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-62-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-63-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-60-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-61-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-53-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-54-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-56-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-57-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-58-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-52-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-64-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-51-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-49-0x00000222DA290000-0x00000222DA291000-memory.dmp

Download

memory/2652-46-0x00000222DA270000-0x00000222DA271000-memory.dmp

Download

memory/2652-47-0x00000222DA270000-0x00000222DA271000-memory.dmp

Download

memory/2652-45-0x00000222DA260000-0x00000222DA261000-memory.dmp

Download

memory/6016-366-0x000001C27A030000-0x000001C27A0C9000-memory.dmp

Download

memory/6016-113-0x000001C267930000-0x000001C267950000-memory.dmp

Download

memory/6016-93-0x000001C267590000-0x000001C2675B0000-memory.dmp

Download

memory/6016-79-0x000001C2675D0000-0x000001C2675F0000-memory.dmp

Download

memory/6016-74-0x000001C266570000-0x000001C266670000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads