fc69e505cbef1f07d3ca493276e3da72c65fd521540d4b06584810a2f0ff61d1

Analysis

user interaction
yes
max time kernel
139s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Free_minecoins.bat
Size 219B
Sample260522-3jce8aay4z
SHA256 fc69e505cbef1f07d3ca493276e3da72c65fd521540d4b06584810a2f0ff61d1
MD5 375930500ff2701566958d62f58bde09
SHA1 6886fa64eb2117ef93c00c0bf429edad64f40191
SHA512 7764f4977665ec6479b8bd041a06a3409180ade4bbb2515cf32c82c8a997556850312c68a6f5c639f9fac53753b8208282722771bca1731291dbe7e55006f711
TLSH
T189D0A78BAC6884E624376905657A46D97152D14A1108FB65E447042A30FB1C17909806
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "You have selected %1 as the default voice."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Cosimo"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat.prev"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\MSTTSLocesES.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1036-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\r1041sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Haruka"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{179F3D56-1B0B-42B2-A962-59B7EF59FE1B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{6BFCACDC-A6A6-4343-9CF6-83A83727367B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Zira - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Paul"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - it-IT Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "40C"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{81218F10-A8AA-44C4-9436-33A42C3852E9}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\c1040.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Ichiro"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "409"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Ichiro - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Near"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "DebugPlugin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR en-US Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR en-US Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR es-ES Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = 4ceb4de51753375e6967fd144fced62b87697270a205fca4961d9e7157eeb830	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "16687"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\r3082sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\MSTTSLocitIT.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\VoiceActivation_es-ES.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1041-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Anywhere;Trailing"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR en-US Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Laura - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Paul - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\lsr1041.lxa"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{31350404-77AC-4471-B33A-9020A2EDA1D1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
12644	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2816	4636	cmd.exe	88
PID 4636 wrote to memory of 1192	4636	cmd.exe	90
PID 4636 wrote to memory of 4020	4636	cmd.exe	92
PID 4636 wrote to memory of 4500	4636	cmd.exe	93
PID 4636 wrote to memory of 1600	4636	cmd.exe	94
PID 4636 wrote to memory of 3000	4636	cmd.exe	95
PID 4636 wrote to memory of 2532	4636	cmd.exe	96
PID 4636 wrote to memory of 4304	4636	cmd.exe	97
PID 4636 wrote to memory of 4320	4636	cmd.exe	99
PID 4636 wrote to memory of 2744	4636	cmd.exe	101
PID 4636 wrote to memory of 2096	4636	cmd.exe	102
PID 4636 wrote to memory of 4696	4636	cmd.exe	103
PID 4636 wrote to memory of 3428	4636	cmd.exe	104
PID 4636 wrote to memory of 5072	4636	cmd.exe	105
PID 4636 wrote to memory of 2804	4636	cmd.exe	106
PID 4636 wrote to memory of 3740	4636	cmd.exe	107
PID 4636 wrote to memory of 1860	4636	cmd.exe	108
PID 4636 wrote to memory of 1096	4636	cmd.exe	109
PID 4636 wrote to memory of 4288	4636	cmd.exe	110
PID 4636 wrote to memory of 4248	4636	cmd.exe	111
PID 4636 wrote to memory of 952	4636	cmd.exe	112
PID 4636 wrote to memory of 4300	4636	cmd.exe	114
PID 4636 wrote to memory of 1504	4636	cmd.exe	115
PID 4636 wrote to memory of 4544	4636	cmd.exe	116
PID 4636 wrote to memory of 4992	4636	cmd.exe	117
PID 4636 wrote to memory of 4192	4636	cmd.exe	118
PID 4636 wrote to memory of 1360	4636	cmd.exe	120
PID 4636 wrote to memory of 700	4636	cmd.exe	121
PID 4636 wrote to memory of 728	4636	cmd.exe	123
PID 4636 wrote to memory of 1068	4636	cmd.exe	124
PID 4636 wrote to memory of 3492	4636	cmd.exe	125
PID 4636 wrote to memory of 3868	4636	cmd.exe	126
PID 4636 wrote to memory of 836	4636	cmd.exe	127
PID 4636 wrote to memory of 4816	4636	cmd.exe	128
PID 4636 wrote to memory of 3948	4636	cmd.exe	129
PID 4636 wrote to memory of 3684	4636	cmd.exe	130
PID 4636 wrote to memory of 4268	4636	cmd.exe	131
PID 4636 wrote to memory of 2056	4636	cmd.exe	132
PID 4636 wrote to memory of 768	4636	cmd.exe	133
PID 4636 wrote to memory of 2656	4636	cmd.exe	134
PID 4636 wrote to memory of 5040	4636	cmd.exe	136
PID 4636 wrote to memory of 4908	4636	cmd.exe	137
PID 4636 wrote to memory of 4804	4636	cmd.exe	138
PID 4636 wrote to memory of 3756	4636	cmd.exe	139
PID 4636 wrote to memory of 3564	4636	cmd.exe	141
PID 4636 wrote to memory of 3792	4636	cmd.exe	142
PID 4636 wrote to memory of 2244	4636	cmd.exe	143
PID 4636 wrote to memory of 2284	4636	cmd.exe	144
PID 4636 wrote to memory of 3860	4636	cmd.exe	145
PID 4636 wrote to memory of 4144	4636	cmd.exe	146
PID 4636 wrote to memory of 3944	4636	cmd.exe	148
PID 4636 wrote to memory of 1064	4636	cmd.exe	150
PID 4636 wrote to memory of 4068	4636	cmd.exe	152
PID 4636 wrote to memory of 4608	4636	cmd.exe	154
PID 4636 wrote to memory of 5012	4636	cmd.exe	156
PID 4636 wrote to memory of 3204	4636	cmd.exe	157
PID 4636 wrote to memory of 5156	4636	cmd.exe	200
PID 4636 wrote to memory of 5228	4636	cmd.exe	202
PID 4636 wrote to memory of 5244	4636	cmd.exe	204
PID 4636 wrote to memory of 5252	4636	cmd.exe	205
PID 4636 wrote to memory of 5260	4636	cmd.exe	206
PID 4636 wrote to memory of 5268	4636	cmd.exe	207
PID 4636 wrote to memory of 5276	4636	cmd.exe	208
PID 4636 wrote to memory of 5284	4636	cmd.exe	209

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Free_minecoins.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1192
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4020
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1600
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4320
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3740
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1860
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4248
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:952
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4300
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4544
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4992
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4192
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:700
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:728
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3868
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:836
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3684
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5040
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3756
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3564
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2284
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3860
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1064
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4608
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5276
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5284
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5292
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5300
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5308
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5316
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5332
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5372
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5388
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5404
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5452
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5484
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5508
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6384
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6392
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6660
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6668
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6956
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7060
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7516
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7556
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7564
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7572
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8520
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8724
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8740
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8752
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8988
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9004
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9196
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9224
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9240
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9484
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9528
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9744
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9932
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9972
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9996
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10036
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9300
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10284
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10344
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10424
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10464
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10584
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10600
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10680
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10924
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11048
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11164
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11188
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11216
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10692
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11272
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11508
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11556
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11580
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11772
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11964
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12016
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12180
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4708
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4120
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12332
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12528
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12616
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12636
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12720
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12744
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12900
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12916

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:12744

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 8a7c3a21ab6bc6c03ba91149d9778a7c dKG2lMXo0kGKB39OAQYXUw.0.1.0.0.0
1⤵
PID:12780
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:12676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:12644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AppCache134239664033905945.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134239664033905945.txt
Size 85KB
SHA256 c3d452cd97caa623b0889591772b4c0af8b72a83ec4d9b43d1fdeb4a508fe187
MD5 6e2fffa16656980fa6282585f1414c42
SHA1 59ab8dbc4f67966ed579d31c64e24ac4f4c79787
SHA512 d90b2a3661753bb1c7d4e160421ecaf262081dcdaf8b287a556b0ebbed72e9779829ae70278d514f594e98a80aefa9056942e3771936115ac8879065c4d7709a
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/i7:vYGzozuy1qRy1D
TLSH
T1C383B3A53281CBF3317966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/12644-7-0x000002151EF80000-0x000002151EFA0000-memory.dmp

Download

memory/12644-19-0x000002151EF40000-0x000002151EF60000-memory.dmp

Download

memory/12644-38-0x000002151F350000-0x000002151F370000-memory.dmp

Download

memory/12676-0-0x00007FF6D7E40000-0x00007FF6D7EA7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads