Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
91s - max time network
111s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/10/2026, 05:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://teamsmeeting.site/
Resource
win11-20260911-en
windows11-21h2-x64
25 signatures
150 seconds
General
- Target https://teamsmeeting.site/
- Sample261024-fwckesec77
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://update.microsoft.com
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://us-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
-
exe.dropper
https://eu-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
-
exe.dropper
https://au-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
-
exe.dropper
https://ifconfig.me/ip
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3436 action1_agent.exe 788 action1_agent.exe 2832 action1_agent.exe - Loads dropped DLL 4 IoCs
pid Process 6132 MsiExec.exe 6132 MsiExec.exe 6132 MsiExec.exe 3000 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ifconfig.me 32 ifconfig.me - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe - Drops file in Windows directory 42 IoCs
description ioc Process File created C:\Windows\Action1\action1_agent.exe.connection action1_agent.exe File created C:\Windows\Action1\previousUser.txt powershell.exe File created C:\Windows\Installer\e59f311.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF4A8.tmp msiexec.exe File opened for modification C:\Windows\Action1\logs\action1_log_2026-10-24_01-14-03~3436.log action1_agent.exe File created C:\Windows\Action1\action1_agent.exe.instance_lock action1_agent.exe File created C:\Windows\Action1\rules.json action1_agent.exe File created C:\Windows\SystemTemp\~DF4DD5D25732FFD4AA.TMP msiexec.exe File created C:\Windows\Installer\e59f314.msi msiexec.exe File created C:\Windows\Action1\datasource_data\1008.poll.tmp action1_agent.exe File created C:\Windows\Action1\action1_agent.exe msiexec.exe File created C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF5765C8F8140239A3.TMP msiexec.exe File created C:\Windows\Action1\scripts\DataSource_1004.ps1 action1_agent.exe File opened for modification C:\Windows\Installer\e59f311.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A} msiexec.exe File opened for modification C:\Windows\Installer\MSIF4B9.tmp msiexec.exe File created C:\Windows\Action1\action1_agent.exe.update_state action1_agent.exe File created C:\Windows\Action1\advanced_settings.json.tmp action1_agent.exe File created C:\Windows\Action1\schedule.json action1_agent.exe File created C:\Windows\Action1\scripts\DataSource_1008.ps1 action1_agent.exe File opened for modification C:\Windows\Installer\MSIF3EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF5B5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF5D5.tmp msiexec.exe File created C:\Windows\Action1\what_is_this.txt action1_agent.exe File created C:\Windows\SystemTemp\~DF5A77CC5441D0F633.TMP msiexec.exe File created C:\Windows\Action1\rule_data\1008.suppress action1_agent.exe File created C:\Windows\Action1\rule_data\1000.suppress action1_agent.exe File created C:\Windows\Action1\scripts\Windows Update History_2044-1792508628.ps1 action1_agent.exe File opened for modification C:\Windows\Installer\MSIF4E8.tmp msiexec.exe File created C:\Windows\Action1\datasource_data\1000.poll.tmp action1_agent.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Action1\action1_remote.exe msiexec.exe File created C:\Windows\Action1\first_install.tmp action1_agent.exe File created C:\Windows\Action1\agent_downgrade.version_pair.tmp action1_agent.exe File opened for modification C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon msiexec.exe File created C:\Windows\Action1\sas.dll msiexec.exe File created C:\Windows\SystemTemp\~DF3856929AC1B18AA9.TMP msiexec.exe File created C:\Windows\Action1\7z.dll msiexec.exe File created C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi MsiExec.exe -
pid Process 2400 powershell.exe 3176 powershell.exe 2176 powershell.exe 5560 powershell.exe 5636 powershell.exe 5504 powershell.exe 3800 powershell.exe 5904 powershell.exe 1724 powershell.exe 3412 powershell.exe 5932 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname action1_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain action1_agent.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2680 chrome.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000040fd3fc73d5da4b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000040fd3fc70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090040fd3fc7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a40fd3fc7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d40fd3fc7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17ca0f450e action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a1780aa40e9\fae8ab0e action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17dbf974bf action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dd421c47d095b8 action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a179a506762\a37dfe62 action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17ca0f450e\fae8ab0e\@{Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8 = "Windows Voice Recorder" action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17e7c668e6\fae8ab0e action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a182d03da30\a37dfe62 action1_agent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17963e73b8\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb = "Microsoft News" action1_agent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a1777d67c13\fae8ab0e\@{Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe?ms-resource = "Your Phone" action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a18225d032\fae8ab0e action1_agent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17848c79fa\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.StorePurchase = "Store Experience Host" action1_agent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5Cmicrosoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a178cedf009\fae8ab0e\@{microsoft.windowscommunicationsapps_16 = "Mail and Calendar" action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17bffb668e action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe%5Cresources.pri action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17c4c03149\a37dfe62 action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe%5Cresources.pri action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17848c79fa action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1_agent(teamsupdate).msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net msiexec.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\action1_agent(teamsupdate).msi:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 5708 msiexec.exe 5708 msiexec.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 5904 powershell.exe 5904 powershell.exe 5904 powershell.exe 1724 powershell.exe 1724 powershell.exe 1724 powershell.exe 2176 powershell.exe 2176 powershell.exe 2176 powershell.exe 3412 powershell.exe 3412 powershell.exe 3412 powershell.exe 3412 powershell.exe 3412 powershell.exe 3412 powershell.exe 5560 powershell.exe 5560 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 5208 msiexec.exe 5208 msiexec.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3316 wrote to memory of 4128 3316 chrome.exe 82 PID 3316 wrote to memory of 2680 3316 chrome.exe 83 PID 3316 wrote to memory of 3584 3316 chrome.exe 84 PID 3316 wrote to memory of 3584 3316 chrome.exe 84 PID 3316 wrote to memory of 700 3316 chrome.exe 85 PID 3316 wrote to memory of 700 3316 chrome.exe 85 PID 3316 wrote to memory of 4080 3316 chrome.exe 87 PID 3316 wrote to memory of 4080 3316 chrome.exe 87 PID 3316 wrote to memory of 964 3316 chrome.exe 86 PID 3316 wrote to memory of 964 3316 chrome.exe 86 PID 3316 wrote to memory of 1120 3316 chrome.exe 91 PID 3316 wrote to memory of 5560 3316 chrome.exe 93 PID 3316 wrote to memory of 4304 3316 chrome.exe 94 PID 3316 wrote to memory of 332 3316 chrome.exe 95 PID 3316 wrote to memory of 228 3316 chrome.exe 96 PID 3316 wrote to memory of 5208 3316 chrome.exe 97 PID 5708 wrote to memory of 2700 5708 msiexec.exe 102 PID 5708 wrote to memory of 6132 5708 msiexec.exe 104 PID 5708 wrote to memory of 3000 5708 msiexec.exe 105 PID 3436 wrote to memory of 3800 3436 action1_agent.exe 108 PID 3436 wrote to memory of 5904 3436 action1_agent.exe 110 PID 5904 wrote to memory of 788 5904 powershell.exe 114 PID 3436 wrote to memory of 1724 3436 action1_agent.exe 115 PID 3436 wrote to memory of 2176 3436 action1_agent.exe 118 PID 2176 wrote to memory of 2832 2176 powershell.exe 120 PID 3436 wrote to memory of 3412 3436 action1_agent.exe 121 PID 3436 wrote to memory of 5560 3436 action1_agent.exe 123 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teamsmeeting.site/1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0148c728,0x7ffa0148c734,0x7ffa0148c7402⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,1465061367773436761,9998905690572160772,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2084 /prefetch:112⤵
- System Time Discovery
PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,8667422365310247947,1576007161432276092,262144 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,6621513035882077933,7107642093030639585,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2524 /prefetch:132⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,1467405142769575737,6615558960605117650,2097152 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,5900182636193051829,11822355717655574383,2097152 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,15299534301009499890,10737429189812983733,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5164 /prefetch:142⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,16452916694824105400,10910849426309304924,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5628 /prefetch:142⤵
- NTFS ADS
PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,14483589054699436855,11075888799961084801,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5624 /prefetch:142⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,9602285330522249869,13795668102854240121,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:142⤵PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,11799663734217516709,9796438276478101060,524288 --field-trial-handle=2044,i,15665881532643966296,2646012066293852949,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5680 /prefetch:142⤵PID:228
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\action1_agent(teamsupdate).msi"2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:5208
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4292
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2700
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6BAFF37E8CC43317FBEA3BD60C3A11CD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6132
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CE8B65594546D36604CD3B1CD50AF9A5 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3000
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5924
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3800
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:788
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3412
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1792508628.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5560
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1792508628.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
PID:5932
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1792508628.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
PID:5636
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1792508628.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
PID:5504
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1792508628.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
PID:2400
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1792508628.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
PID:3176
-
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f312.rbs
- Size 240KB
- SHA256 0dd4bbf14bf977b81f9516bb4196b26773c5da1ea70f4f22619ac00a180dc215
- MD5 d8e37bda9b67e2430a0a08ce24c75ed5
- SHA1 e08ffab2a3b8e48f3d8fc424ee4e09965ae770cd
- SHA512 b0e16c8dee5832d38f0c311290dc7b01f93f98642fc42f1e4ea60cf39c6e194dad17a67775e0218031e68fe9f6aafb241ca656d8023b988e16b722ded3f1b520
- SSDEEP 3072:CXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Cqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T1BD348E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59f313.rbs
- Size 7KB
- SHA256 5a53ee156bf7b03dd19f04d1d86f2fbec8939b78b4cc9a0a11e3c5dfabebda74
- MD5 3ab466a3c40dc0001b552c67ec492aba
- SHA1 fe528d09d919f42c937a8915033549068b5f5078
- SHA512 ed0467cd6266ae9be6d6f90eb28e371dd2b2ba165fd004400e1ae4f43984b4c38cec90cf2ffcbf3b958a4e397fc91592d3f3ea40b97b497da3f58d8f7efc93df
- SSDEEP 96:8y99tPeeDIv7XkUMAiOliCsThqxBXkUMAiOliC6jZS2dThqxaH+35fyG9tbktqZr:8KezfXhI2XhM+YS0/pW
- TLSH T19CE130017A1042F3FAAA0735D3471F9437B2D2DA43102B1B8DCDA670AF5BB8D2E951CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 765B
- SHA256 c14f070f8c4cbded2f0770128e341e5e90f6cc09fd5f3f37706a92dd577a69c0
- MD5 52f4c37a00b976533c1ca4aa865bd418
- SHA1 9e362bda865da66ec78987ab029e5567d462e5fd
- SHA512 5417df44d8fd2fcc5ca2ff76848793f93d07c88bde57aa139f6b04e696a3db8443a1fdd900fd23a2acfec35689f057ef4a10f74c3a6f415a548ddf93ac1daf6a
- TLSH T1D401B5170E771A82BF388E7204D9C22BB5003036B0D3017778E835410EDAB1F2B288E8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
- Size 637B
- SHA256 78bfc4e53ce9c00579f417c8a44cd272c2e86bd7c3a6c430e4c22359e370648c
- MD5 81e3212bdde3ea19d26a989dc7b64000
- SHA1 921ece73fa92b12e2617824fe8c90f4ecd510e78
- SHA512 c10ce296c6fa5090ac9e6919d6e9f446cf3f6d1f62675ac167a390e05fd9052fbb4b443c8a2263ad8178dde12d8776fe42db2deef3852118043e72a2d29fb24f
- TLSH T1F2F023939F28E8227C1C99B00488C9443574B6A73DD3D047119D1525D84F7334822021
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 1KB
- SHA256 e47bc4dc4e841694a92080d712e615b18b7da34ae698c575f7bbc5f4c9c8d556
- MD5 ea290ddadac29c118750128911621b11
- SHA1 26794cd32d628dc2b7accbd49cdd1874814d37e2
- SHA512 9b3d97cc8463078a5ef21f5a67c56653dabcd438880522ebe0545fd1b4d4e1fd1a908d8de0832aa48a7ec50ab98281a1b57a7e0b610751644f90d28f2737aed5
- TLSH T1D931E6D77FB8B810AE0A4DD59C5E8BA2BCB0356A7A640C7930E5405AD4B2F902C0981D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 484B
- SHA256 c0a39b244f736d9a62231dfd0262e4d06ec4f56abf66cef28f6119cb39082eb1
- MD5 24c23f511048d1977c6bf71fb37e5615
- SHA1 39eb2bcd2d7ae01c057a4893ab77683f9cd36942
- SHA512 bcf9cafdf5c4360cc9cef5b5b3a62d95b316dd7182f4c7cb0c1945036aae706be54fc259fb875c9654097a9494f1081b0f9b9250ea312f7cf34de77d2ceda5d8
- TLSH T1A0F05C2815E9403FF0658D7586F06032FD06F1223005617D06F2031A4B97E05989165E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
- Size 488B
- SHA256 f1414cbd3463bbcc77b3ec2f64bb222fbbafc2acbd316614da0b9001294b06f1
- MD5 53917fb6681faa8ac7458852b8f0513d
- SHA1 1fb607269dd08f54fb0ec86e9c678e895e51581e
- SHA512 68966983c098c5140616876756ec1e29852e2418ccac83df16ef0d83b3e96c57a86b29052785f8d267bd0bf1a3360da23be005d700374196dfb6474fe7d49869
- TLSH T1B6F0A32CADF7007FE074C57A87E5C1578D15F219180545AD22E00709E647F809C53D77
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 482B
- SHA256 34224f0aadfa10870be117cd2319a6b2e4216009874ddb7b7a88660050f6fdd7
- MD5 0c31b31aadda16ba21d22b2f4db10af9
- SHA1 9cf9a3079caf8510c88027edb4251158453ddb28
- SHA512 58ef653ee7f42dc88bbd1705e6e8da1dead706d92f8633acfb25cf9391c8f4cbd274921c5402d0cb4a060356e444700fc3453316e293120e71f306599b447010
- TLSH T14FF0AB28357585AFF072FFB6C6CAA6A95CBDF310240452A306904E062E0EF829FA1123
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7ee96d68-e004-470d-8f90-1a0d2ed11141.tmp
- Size 177KB
- SHA256 198d0b5a76f894fa88961a36e820fe7d2a6e83af810ae711fd909270b303a617
- MD5 ed605f392c4e824b62bbec2d8736f6c2
- SHA1 a4b69c4840f3754795a466e7de470cd3a1be58e9
- SHA512 0d297ad6f18cf8b79b2dcf136556ed27fd77c8ac447b8fbdff5a259c9411fd38fe6ff4ec5b88173e25fed086dc2da7fc17e347e4d630628ec3c5e8e5565ba198
- SSDEEP 3072:SpPV2heVFoefSKzhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:w4eVF13zxmX/B5UgKf2ne1utL1
- TLSH T1DC04127ACDEDEFA365A1B031759A0E5F89FB7BC87061EE9090B41085104F1FD8296A63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8333511c-8d4f-421f-88ba-da8e68739d81.tmp
- Size 131KB
- SHA256 7249e1d18b3503a6dc8986f44502d8737245a4c5ed44d8afdc6383bc468b2294
- MD5 1baac44df5b34fc9ac13576bcb4e1b9a
- SHA1 ba184b7428b3ebe47bb969095861cb8f666d4823
- SHA512 1ef9ce1f623303fb231808d25c9053381c4086ab78a9f322f56bb30fcb8f42d5bcde96bbc3ba16ebdabf32190aed40815d229fc28b3ab7346c46f0a055fd0b83
- SSDEEP 3072:chgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:cxmX/B5UgKf2ne1utL1
- TLSH T195D302BE9CDDEFA36392F026A9A91B5BC9F67BC85160DE4081F41185009F1FD83D9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\16e47611-0322-4b21-99d2-62bf4fa2be00.tmp
- Size 414B
- SHA256 03d38e5bacee14c1e00d13b0868bc79458135efcb324a44288416648a98f4eb9
- MD5 5c0d9305aa823daa902604e038d18ef6
- SHA1 f304c9f3692439451756efd3e18bc17f8e1bc25a
- SHA512 3636fb89f3eed3b01a61f4ed3c7dbbbde7f495f91a706e9b3f93e7bc9c85c8ab0ece3d0c3b2cec8c5e1b7f1b9471a9f053d2788b5f871b8fc4f5e5b9bb6c5566
- TLSH T149E02BADCC21AC271DFC4F6866154746E740176A2A51898F3B3DD1094F7172A8585C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\40343bb3-32f4-497a-9ff4-b38c03689a50.tmp
- Size 13KB
- SHA256 cbcfbe27999bbf1c38c32cf734dbc58c0c74e8fb94cebfe52fc4ac99ec4b2c4e
- MD5 2687abbcac7af17c0b616b501e486b1d
- SHA1 baf57c5410325446dd74e61be138853be50fcccc
- SHA512 d6063c76c0f9513dcd556327052394a8fbae929daff68178795f4017c88a3a038bc8b09526fadfd4132488a9d51a09e3cd9ab6243430667f2c455f48c796d43f
- SSDEEP 384:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwXODb++ErU3l6HGjOoAWI8n:3hb67KxkXqKf/pUZNCgVLH2HfgsP6OPJ
- TLSH T19152F867A84D9A7F0FD8C94DD8266F4FACB5015766680C6893FB5C0803E5BCB114A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4f882bae-b841-4bae-a1bd-6b01da7b3937.tmp
- Size 12KB
- SHA256 3c2d0e1b58567e199007b9cbb0849a00fc82e1fa3261c086f0a6d835e97fe40d
- MD5 d52dfbf36772a93fd2f79a29b01df01b
- SHA1 0473a4a9969b0110e7be13dd446c74d46cda68a7
- SHA512 69462e1431a4b4ee0748f977f8dc6190015257517520c9599ad41a550bd538d9573c3fa75d861bcda006e1c6ee4c9afe5a6d3be5e79b1c9cba38823f7b480a3f
- SSDEEP 192:WRZ0psD4Rv7+7pYPRp+vT9ZHsb+WNnrO+W+elnwoe0LaUVyIsnAUgE:WRZW+4BS7wXUbwCueVweaQE
- TLSH T19142C82DED50793B5DDBD21AFA627B57E6F5103225A02E44EBFC892C11E7ACC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f404dcd-8b8e-4dfc-a0c6-6d9270fa8d41.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 96B
- SHA256 3e65f971164bc46419994d63d6080e92eec41d4e97b1b3354a87e5c52a783f8d
- MD5 672e004cb1871e0027ad5d17963a1110
- SHA1 0436cc0a23ff384d2263d9ae2076772bbf7a77ed
- SHA512 220c032b8f766207d871a17c5787d76d5b630d01b6a6e9d70e0b240c4bb4c3c4f48b5b02c6cac7e52a0916ec6fc5fd4f5a8abdf749d14ab46b3809952990b77d
- TLSH T192B0120804D0C166EE04577410822F40222508284311031355D04C70C8022D10116110
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3ec66b55-cdd1-47fe-82e5-fc3ddb0498b2.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\538a8884-a4b7-412b-a1e1-97e8c2b0e818.tmp
- Size 3KB
- SHA256 b67116f73bcdc146a72720d62c879fcf871c4e76b0e75c1fc83a078c0a4d6160
- MD5 d269bf2290e52857a6c9ebd1e94c2f01
- SHA1 39e107603840a23ea9789e174eb45c8c54035ee5
- SHA512 68296165c0696d53eba26427f10e003fb69b749c6e5c4b14df1a1a634fa4ba7a45b7bcb4e10f0c1c37f23eef4a1c8169a5ba26197cf38a8ca3f1d7f37fea89e5
- TLSH T19251CEFBC3F4863DC911A2F0A605AE1BCE2D0519535C38A6C5D8AE1BA7F3971E24124E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd9e0c20-77d1-4e18-b8f7-82ffb443bd57.tmp
- Size 12KB
- SHA256 a189e92f21f5c18b84cf119bb9c777ff933c57ef799243f349ed19e10ef1020c
- MD5 29fc002be328ef8d9f7a9be8de1577d2
- SHA1 2941a770a58addf7b44f36725be93fb677222b9a
- SHA512 b20a2ff0d3336b5eaadbd0651e32b5408fe9c0178e54f18a7dd6266ab3b1aaeded934427f32a459bad20f666c1c81f0f48b82b36cb720c2b0781bd9761d0f646
- SSDEEP 192:WRZ0psD4Rv7+7pAPRp2vT9ZHsb+WNnrO+W+eKnwoe0LaqVyIsnAUgE:WRZW+4BS7UXMbwCuegweaqE
- TLSH T1DE42D82DED50793B5DDBC21AFA727757E6F5102225A02E44EBFC892C21D7ACC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc44a79e-8208-4dca-809f-e36c88cdf35e.tmp
- Size 11KB
- SHA256 0213ea330233e4884010b5722c2156f3f4110ead77d30271a5e89c1dbe0be4b8
- MD5 4913bccd09c7d3933c308907194005cf
- SHA1 6bddb0024ebe923bfff0dd9650b48a732e43aa73
- SHA512 640402759880159b152b6f7eb6b77a3c458f2bfdc24d2ded448664f85fd779ba3889df72bc83b17baedefb76cf220e9823ac95d4851ad7fdad334e81376fa56b
- SSDEEP 192:WRZ0XsD4Nv7+7pAPRp2vT9ZHsb+WNnrO+A82snwoe0LamVyIsnAUge:WRZy+4tS7UXMbwC+26wea+e
- TLSH T18742B62DEE50793B5DEBC21AFA727757D6F5102225A12E44EBFC882C21D7ACC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2dcc202-2e6c-419c-835a-fec7a04c798c.tmp
- Size 130KB
- SHA256 7379b8c2d5d1c0a2aa07768cc0dbba9dcaf3faa147eee8d50372304f485b9c1f
- MD5 ab2d3d4183504dcb17696243d6fd706d
- SHA1 034369a719bbc09789af6d43a7542fab477694a5
- SHA512 e65335fdb51c55f72524fb69d41e94b46d963091eea1b46441d785b776e8fdfb61f68724466da38cf259be9f6da2f752995827f0a8cebe6fba5f074220dd6ed0
- SSDEEP 3072:ThgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:TxmX/B5UgKf2ne1utL1
- TLSH T162D302BF9DD9DFE36391B026B9A95B6EC9F67FC8A160DA4080F41085009F1FD4399A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ff16864a-0363-4e37-b23b-fc05f9b5722a.tmp
- Size 131KB
- SHA256 c498e1714f625b3e3b17c5e0d3cb28c7c78c5f633a85144252a7cb45f4785ad5
- MD5 051422e47d0e0c87ceb1a20df8f74cd7
- SHA1 41e250f387d173a463c1977981eccd076c528a32
- SHA512 fed2551be5931e0936e10bf7ef2109e247ec28a03f7ef1d74e792de8f1a0734fc580ecf503d51920a23d9f0ca1f73d5e7ce6830421f35f88b2697cbe0dee7d85
- SSDEEP 3072:9hgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:9xmX/B5UgKf2ne1utL1
- TLSH T1D9D302BE9CDCEFA36392B026A9A91B5BC9F67BC85160DE4081F41085009F1FD4399A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\9d17f9d0-f0af-454a-a552-e31f7b2c2b9f.tmp
- Size 13KB
- SHA256 f28c70fddfe4239e9030aa40aa1013303999c91301a68239506cf50004cc3b28
- MD5 8233aadfa74082c84506c056a2b47dd2
- SHA1 1b358027ec2b04b02defba97ff766d490b52e3c7
- SHA512 bff9cc50a6c05923bb4337860291e876841d7cd2cebaf9095674349b3708fe5ca8176b0ba1e23ddcbade53aedae4b1cd56e2eb3b70b77cbbb105ea56c5de440f
- SSDEEP 96:k8yU88y08cy4Gcm8GIRgehGORBQUBRhxlYkzddMGXdXIxXBiE4zUxW:kn8y08Tcm2RGOdBRzzddMGtXIxRiEbW
- TLSH T18352B6167DC9DF2BC683AF394C9AC99D02A2FC41EF16E1033995B72F903ABC0455075A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 518976.crdownload
- Size 6.8MB
- SHA256 9c5ec25d6c564d4041a051787d3e4050d9a8ae4ab3caaa3493aaacdb516ec548
- MD5 0f788b80b17e72bb6fb4456c29fe8979
- SHA1 d5e9dcfaf50586b89d59ca589a26141a2f961c9e
- SHA512 687e11dc6345b9ca5ae9cd1238182a9bafadcb456d857c72079ab60244e3a13e3050d31be8fda6f5c1af66c4ba85febad398764cf7c7c61f64e499e7fe931657
- SSDEEP 98304:LkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Alc4pkbLHLhObmXe/kdkmPDTs
- TLSH T112761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\action1_agent(teamsupdate).msi:Zone.Identifier
- Size 140B
- SHA256 14208dec5ad980bf405e59d7b8765e1ebdd36cfe7bda24aa7507231b4964796c
- MD5 e3164b7073509c987a0d684afec7398b
- SHA1 d26ec0b02ad2bcac9037196d18e40b303c22638e
- SHA512 f12b12701d0bf198d07cd1df1747f59ef0801dd28cc0c5d0a7093a33599da40b009df5f3257db251e975a94eab7a807b619ab7ed5591381687d79bf392b2ba1f
- TLSH T103C02B4F48018019155421C00ECF430F700FD259CC033044CE80C343FD0409C645E0CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
- MD5 e4f1f52a78f22dd2be17449ca6f8f0af
- SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
- SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
- SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
- TLSH T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\advanced_settings.json
- Size 54KB
- SHA256 26c1e4456dcf6c8f3c84711d6df470737dee2895ba4fc2a946736aaece4c7e86
- MD5 33b2d88182101c2d09bbcc8cd361612d
- SHA1 d63f6e80d0b863d6f8c576917e67acab68e7d183
- SHA512 2425f89ac99c05a03d7c4c456da0365153c461f3ce96bf8ae1d1038bed1eb238e81dd3c4a2c8cd6641faeef9f818b3efd285e8df859d29dbb395622839d3af9d
- SSDEEP 768:5XKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQz+:0RoLEBxY+wkMdAe0HcLW
- TLSH T167439E16E4757DB204C2588C5FCB1AF7DA4E019612D906DE871CEEBF89AF52C8102E9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\agent_downgrade.version_pair
- Size 81B
- SHA256 a774be1a62477c3870d534c5d416874d3bc358102073ee5b1a283571c698aff7
- MD5 1eaf2e8890d180a14fb88ade5c00fb9d
- SHA1 8e5f9f5473c240864b97c07174983008259d28b7
- SHA512 1c1a108c210761bf3636927540151a0a3073a9b46a93118c49b139e926aae3490846b8267e9f999c3270dfc351038556d28ff46d23195c15b09afbf408109651
- TLSH T169A0110220000AA308E28A82283A222ACF0A00ABCF328C0C208C88808A8C2820A8CA00
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\previousUser.txt
- Size 14B
- SHA256 0d7d45562d827f09b7fd449a98dec902d8d293b05a3c7d9058afd6085bb82b2a
- MD5 8766182a98cfa1930dc1fc9e5a6aabd2
- SHA1 b31653960bbc286b7f474db39b0adc650bd76435
- SHA512 68902588c421eb344c637324bca4b343a0975ec5f0be23cdf87c6c40165ca561d36dab6cb232bf8c4c45809638701a60b5b7d779b49d938b822bbb0c3a15350b
- MD5 SHA1 SHA512
- Path C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1792508628.ps1
- Size 15KB
- SHA256 311faba15883013b7a9aa031dc5118da630a35c2337c5f1c0ab6802228505cfb
- MD5 90d346b440bab02108d540391fb251ab
- SHA1 31e32ea2acd320eafbaf92f7c604888aed82b6d2
- SHA512 db027687f1601f7e65e66990fb14c98e8a19c85f61a7007adbfa8dc2fb2e7cb5648928b739abacdb24c7ef2f810d1161963ddde987f61f02223e1164e6f14c00
- SSDEEP 192:/5bdxGiVPHMM7tJ7beqEqL7loLLvx91UI9mOCJO5V51DT:/571Hz1L7loLV91UjOJP
- TLSH T1CA620F28FD68A062C2F35B2EDEA37990EE3571AB54A10414B19CD6C41FB0E50D31BF7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1792508628.ps1
- Size 1KB
- SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
- MD5 c48b3a721c277b1b83910fcd259a178f
- SHA1 ff21b517474db3e80884a1243c9a3d922ad3b685
- SHA512 4d18307e373b07e7f3dfd90db2b6843312a9d0e517d76ebb97d237b84e7e296e4b8c20b7f44fb68d5a3f79f6e6b46881f690f2924a850f98f45fea863a0d7845
- TLSH T1C43141126B34A4BB93837550F8C3C1AE52350DEE20667CC2A0FDCE8D908F6C06A6A577
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\scripts\DataSource_1004.ps1
- Size 54KB
- SHA256 8bb1a1a832384f954454f47f294401c11c6b425d904495d5367120b6aa19b07c
- MD5 6fc8969b7a94e78f4dfb85df9ddcaf05
- SHA1 69516854be0504c11e03d89ffec2fe6f05ee56cf
- SHA512 afbf13750b12e7bc7ad5cad1c9fea03561669547a23a5e06d6c9210078a2c1a888c24d88e101f8c3bd27dbddc560c796b3a77949750f417e967817ab7ce95360
- SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1Y:Q/41KUT+UKFf
- TLSH T1CC43814CA9DAE13651A3713C5ECF60083A35801F014D9A14BA8D81C5FFA2579DBBE7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\scripts\DataSource_1008.ps1
- Size 20KB
- SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
- MD5 745c2c539a54b590bf44ea13064ca55e
- SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
- SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
- SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
- TLSH T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1792508628.ps1
- Size 2KB
- SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
- MD5 178c7995314b2a74eb29b269a396393e
- SHA1 0b9b97db4a5a331d405606a77c22007805191922
- SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
- TLSH T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1792508628.ps1
- Size 2KB
- SHA256 42666e20b7306295eb6a89cede8ab05b56aabe7dc781f5737e4af42169ee1a16
- MD5 a9d17bd611d15a1568b413e47d3dfa1b
- SHA1 b94f74eb3af7260bb7fde4f5ac879466d224589c
- SHA512 5bb41659fe28b1ef14d35942444abbbbbc5b1826f872782f3f9440528323c03be9ba01d24ba103e4a656c2468a62448097ce164f68c87560022db5d05429fb58
- TLSH T1BC4164402F98D4E2C2826546FAE2743E5C270E4E111E7D8C38EDCCCEEA83699D66143B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\scripts\Windows Update History_2044-1792508628.ps1
- Size 6KB
- SHA256 20cb9a46d7a8ab6496604ba0916c2d14576a4d41475f507a6696813ef248d95a
- MD5 21c0e37290521f5623ad9a79e3ae1b09
- SHA1 4bf4a4a9fdcd6c67d35212153adfc22c5acbaeb1
- SHA512 148b20a031202bb2cc61e44c83048550c63f191f0614d58719b5fc831f42e0b5363ad3e726fa0395b8534a00632efe627a6e9ec90d50b35296c9c182ff81d5fa
- SSDEEP 192:sM948rFljvSk8yeCyfQiVLFw8NSgMaVsei1DaF3T:sM9HZsQiVLFw8NuAsX1Dw
- TLSH T127E1524926A6E13115C3715AEFD3940BE974804B40AEBD00BFDCC1C4DFA1818F6EAA37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\scripts\Windows Update Status_2064-1792508628.ps1
- Size 16KB
- SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
- MD5 e33245b05a35394e95870140a6a0ffa4
- SHA1 9aa03d9f967b8021934e559787f90297e392a35e
- SHA512 3f5c2c9c7e0621d238b66abaa9a9b8029a39ed67451ecc54e71c882589b6b8b46b4733a3283a72d267cb0a0a53280ad37267f14c348a7950546ab93117f6a990
- SSDEEP 192:bNJPHMM7c5bdxep3qf/onAh5eVuOB6GCjtauiA+XPJLb6TptSZO7BApjNDVCYVCs:PHY5K+2875lYQS0PeZFUW
- TLSH T1FB72863CFD13E0225AF3172E9A4A5654EF3A113B21911940B1FD87C0BFB1A60C72AA77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF3EB.tmp
- Size 387KB
- SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
- MD5 4112820180a36753089ee5c0fdba1538
- SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
- SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
- SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
- TLSH T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF4B9.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\Tmp8BF5.tmp
- Size 1KB
- SHA256 bb55117ca0011c68d390f08a4257117807a0443ef8a90960a1dbbcdc350b0409
- MD5 0ea4dd53bce21b16dd91dda748d1e183
- SHA1 e8877ba89e433effc757893a80dee3edb24d5ffd
- SHA512 2f0e3e256d89b24eadcf9b945799efb30b88ccc4687e53ffab4446a5ed660d9734dc7e6fe752542607b00f2add2e5fa9e96167c8646bd8a6ed5b99b811ef6b2b
- TLSH T14511B6A55FA4FC842C5AF24E8948832FD1D3D07B4D9FE6445D6224429524A4697FF80E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_03vfvehj.vae.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
- MD5 627073ee3ca9676911bee35548eff2b8
- SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
- SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
- TLSH T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 d7b8539a9e53e622590c4851e99f881b09d73d5e255d622610d2615dd74e4910
- MD5 dc007a1bdba7b7abc907ba9851cb8816
- SHA1 1296de74753b0d552cd3de8481cba84a938b2d67
- SHA512 ad5dbb435c1663584900533a4fd55b45be03d8400674346f1e9e706ec68c7613ff53b5bf4ad69657e34d4be95be4d587f4154704b63e076fee9fa6bf1b5c224a
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 498ed72ca69ff988c096485f22609d6edd0969e05b7f29be088c40c7c9c91c36
- MD5 20c68333119190d6a2e4fa6e52577f30
- SHA1 2cc794aec29215b732ed8a5d59a18edbe8dc3c7d
- SHA512 9efd79f23b87a5fdfaa0779b7bd0ba7d0665065996ea7e979cdde39644ccdc0be23583f0aa6b4bd97eeea8e128209f3fe9131c3da572e7353acc82808a49cc5c
- TLSH T104218933B7ACC1B5C8C9117A1089AD01B2B2C3C7449ECECB7B84C508E57F999DF642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 438a509a97c0d67ed922e7a5a457b19940cc61f48454789b22c68cc0998b78a0
- MD5 606df7bf69c76a084d9372d6baa785ec
- SHA1 a0a7e289cc4b304531374e3d6780e464b5fc3f75
- SHA512 9a79f425a3d51a9360d1892ebfe1156aadb6d1ba6d946cd57453a19002fe296b2341b8f15da63de123afb6dc69139c31a6944ec6766fcf9c826fdef445d5af26
- TLSH T1B0217633B3ECC135C8C915BA108CAD01B2B5C3D744AE9F9B7B84D508A57F999EA642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 921f76ba0536ca931b83334cd351fca8310869ed6cfc219e3cccd5702a98d4e0
- MD5 ea4430ad00d1bfce156c4f6ec369530e
- SHA1 637d7953c739fb55be286209eeb8f1b21014951e
- SHA512 91ce20f17c474eeb101fda13d69df65054b42508061cb06d734a804220cae22850f2a44f771ed8934060ea9a3e942dbeb9bb77b6382d45a94df998aa3a3dd50e
- TLSH T173218933B3ACC134C8C9157A108DAD01B2B1C3C7449ECF9B7B84C508A57F89AEF642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c345721a74451d4a49bad977d3d91d7905cc68cc60aa43c832d4c51ee322e5ab
- MD5 0c4961b617a82f1d0c751202c501991a
- SHA1 45cf9acf6a0a072ffca6b64c7cee3aee924f7737
- SHA512 cee86b0915e4e35bc7a5fca109d7ced1a6bedb99887100b1c3fe80e274b98a9064140771e2dd6329a98b8b1f92c3c75cf4f0303b27544023e275839e94dc99d1
- TLSH T1C3216537B3ACC179C88915BA1088AD01B2B2C7C7449E9FCB7A84C508D17F999DA641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7ce2d52505c6c55ebe23a55226984df33198f706100cfdd9215d90d2d477be31
- MD5 a367c2c3e538b6af377925e19011d4df
- SHA1 4c82576d826c50bd3a3625eabac0502ba75932fd
- SHA512 6ae49382dac95a1aee8c1411f1e08610abed909651637f52db8918929df741b676fda91b9512749abf65b9a901cf3d07bcef2f32162dbfca77518a3e88e58c21
- TLSH T11A117D33B79CC175C8D5157A1089AD01B2B6C3CB049EDECB7A84C508D57F589DF641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 35c01fbbe6381bb7a2e4cb7045b40aded20ae99df6022205ec5e972399cc5db4
- MD5 60e7cd795aff12805e5841a3751bf12f
- SHA1 3f65ec950635bf4297c374544c2e62597e12124b
- SHA512 317c11a18446b7314c8313e1932253b4225ff290302449828cb4832957640089b0f276947fd6196d4bf6b063d94393bc00b9d3dee377c94136e06de0c660932c
- TLSH T1A0218633B3ACC134C8D9117A208CAD01B2B1C3C7449ECE8B7B84C508A57F98ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f1b501c0ae1df2c7ebebd69ce2922e6f580b05087992e8e9ce1e1ffff22fb086
- MD5 048142e21bd8b1db53226d9ab1c744d2
- SHA1 667881584d22e7c329d49ef220b05102ee00e5c4
- SHA512 3c547cacc0d141b1cb2b7e3fa9a3e45f15b6311296f654b6df3e799890229709dff8de8f853181406addda02e25e2d1db9a56bdcedf14ef951747c75fa629fc4
- TLSH T13A219D27B39CC0A5C8D9217A108D5D007275C3CB409ECFCB6684C228D97F6D9DF941A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9bc3d7291d9518a122d499f6c4ae9efefd7cdd52f46bed3480b72e1da6c820ff
- MD5 1450d55cf0eaf2d18bea7bb8d6a78716
- SHA1 6f255de41459915cd195c8507f81897fa137bd58
- SHA512 13e4fcdadff045c8ecb7a3779295ed1f9c34de7118c2aacb55f530a9f47dce946ed92cc40b7465b829de031402a59a3a95ba09a1480c248152d11a2e6cf0e1e2
- TLSH T122319963B3ACC165C8D91276209C5D0172B6C3C7408E8FCB6B84D128E67F6E9CB54064
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 2KB
- SHA256 d8f785267009302e394d8516426a1104b3a2c590aa7c30af217c5dea40658703
- MD5 b02125ddf7b004400a369b8ee194da43
- SHA1 22644e992bf33125e6efc81b444a78df3c303c56
- SHA512 8a894608718d6fa8871e60694c728b2c0a1ef3ca27ca5ced311da3881040f95d73403b030071a01ced701c9cccc79643854de728f499619436c3ca3ff22cca25
- TLSH T15C51B832F39CD1E7C5890DBE1088F81270A58AC34CF9DDC6A78C952DE17E9859A14C7E
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 ce2f4c6aacdfd47b9d8fb33af43db4c9682cddd51ec2b73f85cf5a70c1509c02
- MD5 d322910c39a842d5210cfd735bc6a443
- SHA1 7c10b4edbf6bf774220b47a3d84e73d4720faa73
- SHA512 7bd0289042e0ea5e090b66a776756895a564b60414c68ae15d2e17bedc827c9b6c1715b3bf654c12cb2e9b8c956f0854e30d61654d3d2cf2a242c34b35875b4d
- SSDEEP 24576:G2gmSp1tdoO/vvTLqWh+B0X6fa56QYlLWGyNHZURYaq4E9Fk4KAWbcL2R:6
- TLSH T1F847A22436F92200E7F79E3D68F06A234D3A7D5B9C199E8D45411F4E0A21FB0E972F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c73ffd40-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0cd92fd2-5e57-4c2b-8e0d-7f44b9c75899}_OnDiskSnapshotProp
- Size 6KB
- SHA256 63f5f44a58195d8e38aeaf4e0fe494d0ff2aa565df00fc3442bfb7e7bf8d5252
- MD5 9916264799175440021e1b7529ddecc0
- SHA1 66efd9e2fe90d1a626f18c125a28c38f83ee8478
- SHA512 555f1587bb96df744050ae00b86b606b4fb9ef840b634cc76863c2401fb189861bc868ece18cb148390efe9d368a7692933b04d4c18b4702a70c06e8ec343548
- SSDEEP 96:FX+nsmuvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:RJDb++ZVmN
- TLSH T130D199085AF54711E2B3AB3229F54557A877B811EF33CB8E0298238E6670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH