55d850cefccfa5340b1835c6a3f9ffb48d35c2210be93e3d6d8806feb69a155f

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HaX.exe
Size

4.0MB
MD5

9e8723e4e16c1a654758bb2669f3f99b
SHA1

c56ea25690a9b810e037df0a680f5c2c32d8adc5
SHA256

55d850cefccfa5340b1835c6a3f9ffb48d35c2210be93e3d6d8806feb69a155f
SHA512

76a7bc0ea314fcf653887605972e4f1ba695938410e6efe65ed9f2798b2b448b321a74624ee8ffc01f89494023728649b744d37f07b574e0b6d5db70013e906b
SSDEEP

24576:WVjvlHeY1i15gBUL+JT6p++eciXwvc4lasVAk8oGa1WtDH5Gj1Oes0bWgCjFv6e:UjNHeY1iDHehMa3mYJu

Score

10^/10

spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	1264	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1264	schtasks.exe	89

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	HaX.exe

Executes dropped EXE 1 IoCs

pid	Process
3736	wininit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Pictures\sysmon.exe	HaX.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Pictures\121e5b5079f7c0	HaX.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\Idle.exe	HaX.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\6ccacd8608530f	HaX.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Pictures\sysmon.exe	HaX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2972	schtasks.exe
3188	schtasks.exe
2120	schtasks.exe
996	schtasks.exe
4924	schtasks.exe
3724	schtasks.exe
5044	schtasks.exe
2248	schtasks.exe
2276	schtasks.exe
3216	schtasks.exe
2076	schtasks.exe
3644	schtasks.exe
2264	schtasks.exe
1580	schtasks.exe
960	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Local Settings	HaX.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Local Settings	taskmgr.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3808	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe
3696	HaX.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
404	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	HaX.exe
Token: SeDebugPrivilege	404	taskmgr.exe
Token: SeSystemProfilePrivilege	404	taskmgr.exe
Token: SeCreateGlobalPrivilege	404	taskmgr.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	3736	wininit.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	wininit.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 968	3696	HaX.exe	105
PID 3696 wrote to memory of 968	3696	HaX.exe	105
PID 3696 wrote to memory of 3800	3696	HaX.exe	106
PID 3696 wrote to memory of 3800	3696	HaX.exe	106
PID 3696 wrote to memory of 1828	3696	HaX.exe	107
PID 3696 wrote to memory of 1828	3696	HaX.exe	107
PID 3696 wrote to memory of 4180	3696	HaX.exe	108
PID 3696 wrote to memory of 4180	3696	HaX.exe	108
PID 3696 wrote to memory of 4032	3696	HaX.exe	109
PID 3696 wrote to memory of 4032	3696	HaX.exe	109
PID 3696 wrote to memory of 2540	3696	HaX.exe	115
PID 3696 wrote to memory of 2540	3696	HaX.exe	115
PID 2540 wrote to memory of 712	2540	cmd.exe	117
PID 2540 wrote to memory of 712	2540	cmd.exe	117
PID 2540 wrote to memory of 3808	2540	cmd.exe	118
PID 2540 wrote to memory of 3808	2540	cmd.exe	118
PID 2540 wrote to memory of 3736	2540	cmd.exe	119
PID 2540 wrote to memory of 3736	2540	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HaX.exe
"C:\Users\Admin\AppData\Local\Temp\HaX.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Pictures\sysmon.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\Idle.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\wininit.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zCVqMwp7ij.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:712
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:3808
- - C:\Users\Default\My Documents\wininit.exe
    "C:\Users\Default\My Documents\wininit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3736

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\NetworkService\Pictures\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Pictures\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\Pictures\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default\My Documents\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\My Documents\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\Registry.exe

Filesize
4.0MB

MD5
9e8723e4e16c1a654758bb2669f3f99b

SHA1
c56ea25690a9b810e037df0a680f5c2c32d8adc5

SHA256
55d850cefccfa5340b1835c6a3f9ffb48d35c2210be93e3d6d8806feb69a155f

SHA512
76a7bc0ea314fcf653887605972e4f1ba695938410e6efe65ed9f2798b2b448b321a74624ee8ffc01f89494023728649b744d37f07b574e0b6d5db70013e906b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qf5wfyeh.aaa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCVqMwp7ij.bat

Filesize
169B

MD5
b6294b56c16152a701301cc4ff1262d4

SHA1
c019dc3dae9e1c26c15b21af380f086cada29704

SHA256
537735035575545dbda307fd8b4af185a05f03937832cd520e39234103c88032

SHA512
a75a3d3f80379d41aff74f7f217332f239cc8d75e099699c388f9866a2a1ac6b0d6f507717e389892dd5c893265a2861bfaaee9a9f0318a9416302ea6a194131

Download Submit
C:\Users\Default\Documents\wininit.exe

Filesize
3.9MB

MD5
6e0db32832d898660cf4fef416642889

SHA1
72c6617c862422f4e9ed23b9299930abd324c673

SHA256
fc2da6584ec94876c79fe915e4590d36e95f20f5b1e341ab44b0073b49b5e8b5

SHA512
d9e301416f18a5f0138d7d819321bb2ce5cca17f0d3272913311e380003ab312614a1e48027812b419abbf0a38c91722d34267a969909cd3d551d54153a2835d

Download Submit
C:\Users\Default\My Documents\wininit.exe

Filesize
3.6MB

MD5
f534f29b17c91363bfa7f9ae3130725e

SHA1
892b34597b179605c0fbaac68d0030a698918663

SHA256
87978f6630cc14b03f2e2ca3feb0a1f7d4eba31cd914025d3ce8164d375e4986

SHA512
7364093775a0b12335921ab9e8a4928167ae431b2b1ebaa0fd9bfcb8fe5a97c734856a62913ea8686882ed90dbc3c5420a10c810052fbdb3ad8b795415e05775

Download Submit
memory/404-66-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-76-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-65-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-64-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-74-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-73-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-75-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-77-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-79-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/404-78-0x000001772D950000-0x000001772D951000-memory.dmp

Filesize
4KB

Download
memory/968-114-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/968-158-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/1828-81-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/1828-83-0x000001AFD2540000-0x000001AFD2550000-memory.dmp

Filesize
64KB

Download
memory/1828-82-0x000001AFD2540000-0x000001AFD2550000-memory.dmp

Filesize
64KB

Download
memory/1828-92-0x000001AFBA300000-0x000001AFBA322000-memory.dmp

Filesize
136KB

Download
memory/1828-143-0x000001AFD2540000-0x000001AFD2550000-memory.dmp

Filesize
64KB

Download
memory/1828-150-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/3696-30-0x00007FFC14FC0000-0x00007FFC14FC1000-memory.dmp

Filesize
4KB

Download
memory/3696-18-0x00000000017A0000-0x00000000017B0000-memory.dmp

Filesize
64KB

Download
memory/3696-38-0x00007FFC15060000-0x00007FFC1511E000-memory.dmp

Filesize
760KB

Download
memory/3696-41-0x00007FFC14F90000-0x00007FFC14F91000-memory.dmp

Filesize
4KB

Download
memory/3696-42-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/3696-40-0x0000000003100000-0x0000000003110000-memory.dmp

Filesize
64KB

Download
memory/3696-45-0x000000001BFA0000-0x000000001BFFA000-memory.dmp

Filesize
360KB

Download
memory/3696-43-0x00007FFC14F80000-0x00007FFC14F81000-memory.dmp

Filesize
4KB

Download
memory/3696-47-0x0000000003110000-0x0000000003120000-memory.dmp

Filesize
64KB

Download
memory/3696-48-0x00007FFC14F70000-0x00007FFC14F71000-memory.dmp

Filesize
4KB

Download
memory/3696-50-0x0000000003120000-0x000000000312C000-memory.dmp

Filesize
48KB

Download
memory/3696-51-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/3696-52-0x00007FFC14F60000-0x00007FFC14F61000-memory.dmp

Filesize
4KB

Download
memory/3696-36-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/3696-35-0x00007FFC14FA0000-0x00007FFC14FA1000-memory.dmp

Filesize
4KB

Download
memory/3696-34-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/3696-33-0x0000000003240000-0x0000000003252000-memory.dmp

Filesize
72KB

Download
memory/3696-31-0x00007FFC14FB0000-0x00007FFC14FB1000-memory.dmp

Filesize
4KB

Download
memory/3696-28-0x00000000030F0000-0x00000000030FC000-memory.dmp

Filesize
48KB

Download
memory/3696-29-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/3696-0-0x0000000000B70000-0x0000000000F74000-memory.dmp

Filesize
4.0MB

Download
memory/3696-26-0x00000000030A0000-0x00000000030AE000-memory.dmp

Filesize
56KB

Download
memory/3696-23-0x0000000003090000-0x000000000309E000-memory.dmp

Filesize
56KB

Download
memory/3696-24-0x00007FFC14FD0000-0x00007FFC14FD1000-memory.dmp

Filesize
4KB

Download
memory/3696-20-0x00000000030D0000-0x00000000030E8000-memory.dmp

Filesize
96KB

Download
memory/3696-1-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/3696-21-0x00007FFC14FE0000-0x00007FFC14FE1000-memory.dmp

Filesize
4KB

Download
memory/3696-37-0x000000001C470000-0x000000001C998000-memory.dmp

Filesize
5.2MB

Download
memory/3696-2-0x000000001BC50000-0x000000001BDEE000-memory.dmp

Filesize
1.6MB

Download
memory/3696-3-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/3696-88-0x00007FFC15060000-0x00007FFC1511E000-memory.dmp

Filesize
760KB

Download
memory/3696-90-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/3696-6-0x00007FFC15060000-0x00007FFC1511E000-memory.dmp

Filesize
760KB

Download
memory/3696-5-0x0000000003060000-0x0000000003086000-memory.dmp

Filesize
152KB

Download
memory/3696-16-0x00007FFC14FF0000-0x00007FFC14FF1000-memory.dmp

Filesize
4KB

Download
memory/3696-7-0x00007FFC15020000-0x00007FFC15021000-memory.dmp

Filesize
4KB

Download
memory/3696-15-0x000000001BEF0000-0x000000001BF40000-memory.dmp

Filesize
320KB

Download
memory/3696-10-0x00007FFC15010000-0x00007FFC15011000-memory.dmp

Filesize
4KB

Download
memory/3696-9-0x0000000001740000-0x000000000174E000-memory.dmp

Filesize
56KB

Download
memory/3696-14-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/3696-13-0x00007FFC15000000-0x00007FFC15001000-memory.dmp

Filesize
4KB

Download
memory/3696-12-0x00000000030B0000-0x00000000030CC000-memory.dmp

Filesize
112KB

Download
memory/3736-166-0x00007FFC15060000-0x00007FFC1511E000-memory.dmp

Filesize
760KB

Download
memory/3736-164-0x000000001BFF0000-0x000000001C000000-memory.dmp

Filesize
64KB

Download
memory/3736-163-0x00007FFBF8C60000-0x00007FFBF9721000-memory.dmp

Filesize
10.8MB

Download
memory/3800-85-0x000001DC6CB00000-0x000001DC6CB10000-memory.dmp

Filesize
64KB

Download
memory/3800-93-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/3800-153-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/3800-84-0x000001DC6CB00000-0x000001DC6CB10000-memory.dmp

Filesize
64KB

Download
memory/4032-149-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/4032-86-0x000001E1A6190000-0x000001E1A61A0000-memory.dmp

Filesize
64KB

Download
memory/4032-112-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/4180-159-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/4180-89-0x00007FFBF8F90000-0x00007FFBF9A51000-memory.dmp

Filesize
10.8MB

Download
memory/4180-91-0x00000228A3CD0000-0x00000228A3CE0000-memory.dmp

Filesize
64KB

Download
memory/4180-113-0x00000228A3CD0000-0x00000228A3CE0000-memory.dmp

Filesize
64KB

Download