Resubmissions

15-03-2022 08:05

220315-jy3feaahdk 10

15-03-2022 07:24

220315-h8lpzaghf8 10

Analysis

  • max time kernel
    1696s
  • max time network
    1776s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15-03-2022 08:05

General

  • Target

    Restr.exe

  • Size

    252KB

  • MD5

    16959900ff34c0ba60fe2a4d9f1242c5

  • SHA1

    888148f1b31355192e26ea4fc97c91f4c4defe9e

  • SHA256

    0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f

  • SHA512

    a2b7a74fdc6525c5b8ecafc66706136e1e3996e28ebb3b1d8e236b120e59f8c4e85165f385365d706a8391ae2a5f30530a086c7820e26d1a6cd2f19a44da5d54

Score
10/10

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300994

rsa_pubkey.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Program crash 1 IoCs
  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:656
      • C:\Users\Admin\AppData\Local\Temp\Restr.exe
        "C:\Users\Admin\AppData\Local\Temp\Restr.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 964
          3⤵
          • Program crash
          PID:3316
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\system32\forfiles.exe
          forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3268
          • C:\Windows\system32\cmd.exe
            /k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA==
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3884
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3896
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2864
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q2nnynnq\q2nnynnq.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:212
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC14A.tmp" "c:\Users\Admin\AppData\Local\Temp\q2nnynnq\CSCB276EDCFA1D54AF48A876186B9A9B79.TMP"
                  7⤵
                    PID:204
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gx2uheqz\gx2uheqz.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3596
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC215.tmp" "c:\Users\Admin\AppData\Local\Temp\gx2uheqz\CSCE43D2439906A4DEB84F6BE8B83451D.TMP"
                    7⤵
                      PID:1380
          • C:\Windows\system32\cmd.exe
            cmd /C "net session" >> C:\Users\Admin\AppData\Local\Temp\5B1B.bin0
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5016
            • C:\Windows\system32\net.exe
              net session
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3344
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                4⤵
                  PID:1704
            • C:\Windows\system32\cmd.exe
              cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\5B1B.bin0 > C:\Users\Admin\AppData\Local\Temp\5B1B.bin & del C:\Users\Admin\AppData\Local\Temp\5B1B.bin0"
              2⤵
                PID:1144
              • C:\Windows\system32\cmd.exe
                cmd /C "systeminfo.exe" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3084
                • C:\Windows\system32\systeminfo.exe
                  systeminfo.exe
                  3⤵
                  • Gathers system information
                  PID:5076
              • C:\Windows\system32\cmd.exe
                cmd /C "echo -------- 1" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                2⤵
                  PID:796
                • C:\Windows\system32\cmd.exe
                  cmd /C "net view" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4912
                  • C:\Windows\system32\net.exe
                    net view
                    3⤵
                    • Discovers systems in the same network
                    PID:4768
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- 2" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                  2⤵
                    PID:5108
                  • C:\Windows\system32\cmd.exe
                    cmd /C "nslookup 127.0.0.1" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1808
                    • C:\Windows\system32\nslookup.exe
                      nslookup 127.0.0.1
                      3⤵
                        PID:3824
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- 3" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                      2⤵
                        PID:5112
                      • C:\Windows\system32\cmd.exe
                        cmd /C "whoami /all" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2968
                        • C:\Windows\system32\whoami.exe
                          whoami /all
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4132
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- 4" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                        2⤵
                          PID:852
                        • C:\Windows\system32\cmd.exe
                          cmd /C "net localgroup administrators" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                          2⤵
                            PID:2588
                            • C:\Windows\system32\net.exe
                              net localgroup administrators
                              3⤵
                                PID:4336
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 localgroup administrators
                                  4⤵
                                    PID:376
                              • C:\Windows\system32\cmd.exe
                                cmd /C "echo -------- 5" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                2⤵
                                  PID:3840
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                  2⤵
                                    PID:548
                                    • C:\Windows\system32\net.exe
                                      net group "domain computers" /domain
                                      3⤵
                                        PID:3492
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 group "domain computers" /domain
                                          4⤵
                                            PID:3156
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "echo -------- 6" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                        2⤵
                                          PID:4576
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "tasklist.exe /SVC" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                          2⤵
                                            PID:1528
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist.exe /SVC
                                              3⤵
                                              • Enumerates processes with tasklist
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1436
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "echo -------- 7" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                            2⤵
                                              PID:2052
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C "driverquery.exe" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                              2⤵
                                                PID:3484
                                                • C:\Windows\system32\driverquery.exe
                                                  driverquery.exe
                                                  3⤵
                                                    PID:3396
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- 8" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                  2⤵
                                                    PID:1276
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                    2⤵
                                                      PID:3912
                                                      • C:\Windows\system32\reg.exe
                                                        reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                                        3⤵
                                                          PID:764
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "echo -------- 9" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                        2⤵
                                                          PID:3804
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "wmic computersystem get domain |more" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                          2⤵
                                                            PID:2296
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic computersystem get domain
                                                              3⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:504
                                                            • C:\Windows\system32\more.com
                                                              more
                                                              3⤵
                                                                PID:4068
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\8482.bin0 > C:\Users\Admin\AppData\Local\Temp\8482.bin & del C:\Users\Admin\AppData\Local\Temp\8482.bin0"
                                                              2⤵
                                                                PID:4160
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\268A.bin0
                                                                2⤵
                                                                  PID:1132
                                                                  • C:\Windows\system32\net.exe
                                                                    net group "domain computers" /domain
                                                                    3⤵
                                                                      PID:396
                                                                      • C:\Windows\system32\net1.exe
                                                                        C:\Windows\system32\net1 group "domain computers" /domain
                                                                        4⤵
                                                                          PID:1356
                                                                    • C:\Windows\syswow64\svchost.exe
                                                                      C:\Windows\syswow64\svchost.exe
                                                                      2⤵
                                                                        PID:808
                                                                    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                                      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                                      1⤵
                                                                        PID:2192
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                        1⤵
                                                                        • Modifies Internet Explorer settings
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2420
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17410 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2728
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82950 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1748
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82954 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4592
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17412 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3596
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82960 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2180
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82964 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4732
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82968 /prefetch:2
                                                                          2⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1564
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82972 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2320
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82976 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4184
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82980 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2012
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82984 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3344
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4376 -ip 4376
                                                                        1⤵
                                                                          PID:2580

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

                                                                          MD5

                                                                          54e9306f95f32e50ccd58af19753d929

                                                                          SHA1

                                                                          eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

                                                                          SHA256

                                                                          45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

                                                                          SHA512

                                                                          8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

                                                                          MD5

                                                                          707b3dbca770b75e95ad28432f3382be

                                                                          SHA1

                                                                          fd1a606c1b3485980b3feb269c77a6ec997164ff

                                                                          SHA256

                                                                          92dabf8d30c3914a107c6301d9f7306bbb5585b1e9067288428a816d86df18ea

                                                                          SHA512

                                                                          763a26a15a4ebcd224ab58c21cc8e956184b06114b853b411e81b9fe8d438df53ae73b4af6fe073dc7c4fff040068d843836536d57567954e841ce0b196fcf79

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                          MD5

                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                          SHA1

                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                          SHA256

                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                          SHA512

                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ves0881\imagestore.dat

                                                                          MD5

                                                                          363ab12b18b904149383cd18a3cebdb5

                                                                          SHA1

                                                                          1f1cd7407638f2f2b349aee61fe1de162ed3ea4f

                                                                          SHA256

                                                                          0ff90d9f35c1cc3ece0e6bfdbe3408f86551d8f94b13462eb81c008e71c732ad

                                                                          SHA512

                                                                          479113739f9dd4662ba5c14a0cb69b5623f5840794b7ea346e022a80f9d7f069dd0bb3e406e27273e3101019e022e9e75997c4a494ec0fc77ea04cfc436aed04

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K6H59MEI\favicon[2].ico

                                                                          MD5

                                                                          a976d227e5d1dcf62f5f7e623211dd1b

                                                                          SHA1

                                                                          a2a9dc1abdd3d888484678663928cb024c359ee6

                                                                          SHA256

                                                                          66332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271

                                                                          SHA512

                                                                          6754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          MD5

                                                                          a6c9d692ed2826ecb12c09356e69cc09

                                                                          SHA1

                                                                          def728a6138cf083d8a7c61337f3c9dade41a37f

                                                                          SHA256

                                                                          a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

                                                                          SHA512

                                                                          2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          MD5

                                                                          9856eec246073417aba7c4e517d16d0b

                                                                          SHA1

                                                                          ce495a8b86044e11eaf50cc89a92116cc9b13724

                                                                          SHA256

                                                                          0ed72f3f9a4847fc67fe0d6dc44d1773b8a652aaaf84352440b44da59a66d7f8

                                                                          SHA512

                                                                          8227671cae6eb7e5d2f77e82656c9099efb0e59b9478a7884216e83bc2be8c11ae2cbdea1c9137da263825c3a8357321fc5c931841020596cdd82ca42489f16e

                                                                        • C:\Users\Admin\AppData\Local\Temp\5B1B.bin0

                                                                          MD5

                                                                          768165e0abf16bf3056836d5431a7296

                                                                          SHA1

                                                                          9fb3196be60e49bfc319ebd9e0b103954d711e34

                                                                          SHA256

                                                                          b44c505b721e93e2a596577018cc65b993cd632b9fe7620a4b3db54031afff5d

                                                                          SHA512

                                                                          1250ec40ba20f39a5b9a3aafd45c63cb6f1bf48b89acce1f885470c936fb48a803081943c68458ba1adce92d5fe79d3e45682285f56ecb29884d41974269992d

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          278c1ace6d180ce0d2c2ecd222ee2aa3

                                                                          SHA1

                                                                          da06f35689d597518c4a8a3cc743e125b9dcc866

                                                                          SHA256

                                                                          ebe0cf8abf15361f6b10742f63a04171a28e43fdd3863eb5f398986d41c60187

                                                                          SHA512

                                                                          472f2a7bbb180e70ae3420199b33b879ead1ba712f6f40193342007bc614e368eddaad3e71ed21ba640cb44c0ced4e6e78d05af898ff2f68a52a77e7f974eb95

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          278c1ace6d180ce0d2c2ecd222ee2aa3

                                                                          SHA1

                                                                          da06f35689d597518c4a8a3cc743e125b9dcc866

                                                                          SHA256

                                                                          ebe0cf8abf15361f6b10742f63a04171a28e43fdd3863eb5f398986d41c60187

                                                                          SHA512

                                                                          472f2a7bbb180e70ae3420199b33b879ead1ba712f6f40193342007bc614e368eddaad3e71ed21ba640cb44c0ced4e6e78d05af898ff2f68a52a77e7f974eb95

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          02a55310a7541dd55a0a4fefdf02c0a1

                                                                          SHA1

                                                                          4a963314d795178e25a81d31a15b8169a48bf14d

                                                                          SHA256

                                                                          4dcb1fdb6827966ceeba7f49cb95c8fe1739edd08ca99dbf2cc407a1c270c179

                                                                          SHA512

                                                                          9c899419162e3cce20992fd458b2790bfcfc59537ac01f2f0f710d835d4ef45d6f1da77f3458f9a24f1227217260e027040f3d52ff06b6583c230a4a4fd0757d

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          f860816dfd8ae9dceca75f9ca6a4e913

                                                                          SHA1

                                                                          7cda655a02b443b14e1fdcf5c7071b9354c252f0

                                                                          SHA256

                                                                          837f9b578ce4d348c8f753a774a50bb39f13321b538ab4ffd3d1787ede9eadac

                                                                          SHA512

                                                                          ea074551c24b78a55e8519c0fb8cde7a2b7b441a7faa010114ff0ad53ccde45d386d6c3d2af63c2804b822754a395d2d2b564dbab40b929aa0e834a28c9e5002

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          16fee889e9e7685190429ab2e731bde0

                                                                          SHA1

                                                                          979dcad14fb7bd4e0d63b8bb3731acc501b1dc29

                                                                          SHA256

                                                                          905230421593eb9319596ef16cdbb80d50eb79c1bb26103d062131a5517c52e2

                                                                          SHA512

                                                                          480abc09c3393929cf40e9dec9be2b72fd00eec1c94ae0c0823c7584e2e528356ef041002f052c239c3927a30f3a248842b4d3bc5862b4147b1f971839abb08b

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          2493cc05c90edd0145e0f5d738b017aa

                                                                          SHA1

                                                                          31e8fde9ca901f49de3d262cc50f68431015cd20

                                                                          SHA256

                                                                          aa14ee992ebf44b5776a835b06a9435a597d1a1aaab44d46f63004f5e12bae7b

                                                                          SHA512

                                                                          eba2f3f107abda1acd30370b087bc754e898771f20d525e54b12d0bb47571d0e702a60b243cc00c74d96862d6106ac31398a93b78633e0b3a8f9fb26f8f38011

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          2493cc05c90edd0145e0f5d738b017aa

                                                                          SHA1

                                                                          31e8fde9ca901f49de3d262cc50f68431015cd20

                                                                          SHA256

                                                                          aa14ee992ebf44b5776a835b06a9435a597d1a1aaab44d46f63004f5e12bae7b

                                                                          SHA512

                                                                          eba2f3f107abda1acd30370b087bc754e898771f20d525e54b12d0bb47571d0e702a60b243cc00c74d96862d6106ac31398a93b78633e0b3a8f9fb26f8f38011

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          eadd82d5d5519fecf1de63eb0a063859

                                                                          SHA1

                                                                          8c02cfac9a483fdfbe10ec50fc7a8598bbe70fff

                                                                          SHA256

                                                                          bf007b20b023ca78164e716fb82697e602f7e42553cd949ad84371188539cf86

                                                                          SHA512

                                                                          4e987c987bfe2c80ceed9b52cb809347b76d4e9d2689d5655096ab01b50be5f74eb2a2697664532a845791fd51883f78032286abb9d3b201938c0de16f7d7e89

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          eadd82d5d5519fecf1de63eb0a063859

                                                                          SHA1

                                                                          8c02cfac9a483fdfbe10ec50fc7a8598bbe70fff

                                                                          SHA256

                                                                          bf007b20b023ca78164e716fb82697e602f7e42553cd949ad84371188539cf86

                                                                          SHA512

                                                                          4e987c987bfe2c80ceed9b52cb809347b76d4e9d2689d5655096ab01b50be5f74eb2a2697664532a845791fd51883f78032286abb9d3b201938c0de16f7d7e89

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          19a396949e1bd0cc78bfa8e1daa9dbd0

                                                                          SHA1

                                                                          ac61be12b20cbf3b95c6d7350aa70b8576fe01e1

                                                                          SHA256

                                                                          9cbc92a86083425f38fb92bf31f7ffb3f2e0793b5e17b48503a1f8caf194fc88

                                                                          SHA512

                                                                          f52a701ecdf12aca4e7100e454d383ae944bb8ff5c468e89d109fd53c502936a67b5504b14dd993017e977b3a0c5c097890339ab13669513112525552cfcabf4

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          0580c99b54cdbdf84f17b1786194755e

                                                                          SHA1

                                                                          153fd31cc9776d4cca634685eb5afd29e2df8b7a

                                                                          SHA256

                                                                          e53616c5e459b5b7499ce14dbff3cb1b167cec8a626bf79f521a3bdcdcb92a29

                                                                          SHA512

                                                                          c7beeac631cd4f2a614a6c1715d55e8c6e62d2898150c81a45b901a41e339b9cf374b1dbde70c5f7687b7d56083f8ebcd83424bf167a8380e029a1062508c053

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          505aeab455b7a1e0816887731baa9178

                                                                          SHA1

                                                                          5a1ece96843c5c54536e266c807110e73eda7357

                                                                          SHA256

                                                                          ddf6ef9bdd541942b8feb004e91f4a071a1e38b96a1014390fff8f408b6bbce7

                                                                          SHA512

                                                                          bc3c62972c1e63089c1dfd3d9ed3a88182d614f91d6509b1f42898a81e82f6ab8277732503e8931fa052af09bde8728ea502c70e6d35fcdb4fabb83c51e22f9e

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          505aeab455b7a1e0816887731baa9178

                                                                          SHA1

                                                                          5a1ece96843c5c54536e266c807110e73eda7357

                                                                          SHA256

                                                                          ddf6ef9bdd541942b8feb004e91f4a071a1e38b96a1014390fff8f408b6bbce7

                                                                          SHA512

                                                                          bc3c62972c1e63089c1dfd3d9ed3a88182d614f91d6509b1f42898a81e82f6ab8277732503e8931fa052af09bde8728ea502c70e6d35fcdb4fabb83c51e22f9e

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          8ebe49ed4828f6eeb44d05cb0313bd88

                                                                          SHA1

                                                                          25b95af9c5ee9fc39fdfdc4aa0e837238338b42b

                                                                          SHA256

                                                                          d44a99d5220c1bebe4430e78a3f3442d00256423d5fee98a3bd91559a510f944

                                                                          SHA512

                                                                          4e7c4e4c6cbae0975a8e76aa19f58ff65b519275b0566f6971b3c93494f00f9bb3b10722d6fd7b3afab2d2858d275f8d83b66eefc5bef4a2d51bc0f191ac226b

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          8ebe49ed4828f6eeb44d05cb0313bd88

                                                                          SHA1

                                                                          25b95af9c5ee9fc39fdfdc4aa0e837238338b42b

                                                                          SHA256

                                                                          d44a99d5220c1bebe4430e78a3f3442d00256423d5fee98a3bd91559a510f944

                                                                          SHA512

                                                                          4e7c4e4c6cbae0975a8e76aa19f58ff65b519275b0566f6971b3c93494f00f9bb3b10722d6fd7b3afab2d2858d275f8d83b66eefc5bef4a2d51bc0f191ac226b

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          1f6df24136b3f7b01a597b0fa206cbe5

                                                                          SHA1

                                                                          c8b7f4d4157759d86c3c47ccc2791e9ab71e3452

                                                                          SHA256

                                                                          2bc8072642804e5672657ca34bd65b428e2e935bd3dfecb4d35e4d66b5e2d372

                                                                          SHA512

                                                                          cf77dcde1d07fd11d02213a576a57d5783fb20f18d095c989029c5d448e685db49b68026c8bde994d4afe80e111677cf5f035ab26b0bea2a8e883bdc9d8fb651

                                                                        • C:\Users\Admin\AppData\Local\Temp\8482.bin0

                                                                          MD5

                                                                          2ad5de9643df750e3a9d210cf9123401

                                                                          SHA1

                                                                          65d7233e73fafe9902c5ad753c9ca3171aee9f94

                                                                          SHA256

                                                                          c7cfd09982b750b6e306ccfcdb23e25f42032120ee4566ab5730e1799e88fdc6

                                                                          SHA512

                                                                          e1d98d995c2419a33c9339cc17277d1fb7cb449ebeecefda1b5049643dec398da0401467a548d646abe2954d521ea541d3d0bc7f26f6569ff782af6e46fd943f

                                                                        • C:\Users\Admin\AppData\Local\Temp\RESC14A.tmp

                                                                          MD5

                                                                          48de94df16a77e4e136e9882a689d026

                                                                          SHA1

                                                                          f13197b76805f60338c34f1507901b7656652c97

                                                                          SHA256

                                                                          7e11f9903cb6fbee08d2d6c7cc99abbd5834895c4d2443c86068ce1329d0c6b5

                                                                          SHA512

                                                                          8dd6a862620234e8b7605da60d7153690ea42c53ecb0ff155883599c1061bb8f47b83f0f5769e3efd355a1bb2b3d10a33c7865104ca1e7d819bc0b974ac83a15

                                                                        • C:\Users\Admin\AppData\Local\Temp\RESC215.tmp

                                                                          MD5

                                                                          fa22191790bee14e8d085ff6dd276419

                                                                          SHA1

                                                                          ec3347b4a1bf6733986457e2cb1e3eadd803bbd2

                                                                          SHA256

                                                                          471ecfcd24672f79cfe5207b15931c53234035c1adce3b9ba334b453cc417a25

                                                                          SHA512

                                                                          72a5f4a3a205d1604f20fe3b86ad699c2c0f075c1c90b0dd44f71824a87322b64ffb74ae3287ca6a4e8a076641bc076c6c41aab472010743e5a40f30cf948125

                                                                        • C:\Users\Admin\AppData\Local\Temp\gx2uheqz\gx2uheqz.dll

                                                                          MD5

                                                                          23b40ff16d1b736242a25b224c3ae6b7

                                                                          SHA1

                                                                          1de9269190588a723cdfc2a94a54e4ec69002516

                                                                          SHA256

                                                                          f8769687f100387d3c8c031e973e432ea68d1f57d94bdc5ffa00e69dbbc809d3

                                                                          SHA512

                                                                          480d08774c023bcfee40d4d05be44aa804a0c152b0d8678f1c634cf6c250b66f9a0544fc495d51dd84433099f91e03ca85649ff1f1dfbfd0807c8cd396aaf6c3

                                                                        • C:\Users\Admin\AppData\Local\Temp\q2nnynnq\q2nnynnq.dll

                                                                          MD5

                                                                          2901d06232efaf1ec0d929b642ce90da

                                                                          SHA1

                                                                          6378b3e97b56e0a0001971108ec21780742d6a18

                                                                          SHA256

                                                                          c5d9ad171654a1e7ec987e42ec773a0821f72f7d531b3a04e5fd585d865f8056

                                                                          SHA512

                                                                          6867eb666caa89ce4dc19435b5256f0b9ee5f9346c0e3d3de0c9b94cb72fdd2d8574545e1558753871615c366d6252473142a342080bc8610397eab3faebdc23

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\gx2uheqz\CSCE43D2439906A4DEB84F6BE8B83451D.TMP

                                                                          MD5

                                                                          5f9b2e2a76dc742f124237ed870c7eff

                                                                          SHA1

                                                                          3395557dd68e19e45003503affd10c040fe63422

                                                                          SHA256

                                                                          9cfa324774567beed80bb948451d4c8cdf86a9bc81b782a24c3df6da8702e12f

                                                                          SHA512

                                                                          0c73aa766542027522fecd596be84945eb2cede903fee7080a5c8fa29b0dee0553eb7472775c3ab4f0a0d380fb32f355afd45bc5e62eeaae1fe96ad98d3ae610

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\gx2uheqz\gx2uheqz.0.cs

                                                                          MD5

                                                                          697f16b8c6892082559d8a17db343865

                                                                          SHA1

                                                                          246d6ba1419478be7915e78b61525da894321fb9

                                                                          SHA256

                                                                          518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f

                                                                          SHA512

                                                                          801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\gx2uheqz\gx2uheqz.cmdline

                                                                          MD5

                                                                          bddf4ce8e4cdccfa7a2f9338cbd0f673

                                                                          SHA1

                                                                          99b7d9e67ff382eb8449ca1a138dae0160bb221f

                                                                          SHA256

                                                                          3349366b42d0d3583f000644dd98f3c12ba66f58a3249e7dcdf10944048dcad4

                                                                          SHA512

                                                                          eb6bc8c9cddf13c8dab7a03b4042581aa0496e7c012e3d3596556c94ecd096779595c88b56df82b5f67dcafd10282ee9a6a9d61d7ff3fae59f1ea7cca0a2bd0c

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\q2nnynnq\CSCB276EDCFA1D54AF48A876186B9A9B79.TMP

                                                                          MD5

                                                                          c25eda9b7a6c36f1e45517f5ae447370

                                                                          SHA1

                                                                          106227f3e6176afbcca86632ed9c6372639a5b63

                                                                          SHA256

                                                                          bdd9373edfc1d546f053dafc00d73c423a994ecc051b46a8b22ba345fbd6edc0

                                                                          SHA512

                                                                          811412f6f6bb918945c79f3f3defef9e4c1abe2efb761a0b462fb8071a6960ffcc4783f7b93a67eefc2ef6d2d0f90452fa035bc9db51f8750f435811fab0af4f

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\q2nnynnq\q2nnynnq.0.cs

                                                                          MD5

                                                                          7fceb996f934e8bda687cdd2bd46a9a7

                                                                          SHA1

                                                                          81e1edbcca6438daaccc3845fa0e3b1a6cff17a6

                                                                          SHA256

                                                                          fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e

                                                                          SHA512

                                                                          6aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\q2nnynnq\q2nnynnq.cmdline

                                                                          MD5

                                                                          9c644120c46a4b3d6b0a4fca6b11b28d

                                                                          SHA1

                                                                          c29929e67d5856c0d844a174b6c185299c84876d

                                                                          SHA256

                                                                          52245374ba820b7241465c7952ae45ea06df99e1110a6df44f666863e4ca7bea

                                                                          SHA512

                                                                          fad8e69fc65b6c05ead56202036cec12b88bc32446756e2d997777dd4f5c707b8d760176524a50d4ce964271aeac17af17a360404b2c293fe1130fb08817a2ab

                                                                        • memory/656-168-0x00000000010F0000-0x0000000001105000-memory.dmp

                                                                          Filesize

                                                                          84KB

                                                                        • memory/656-169-0x00000000010D0000-0x00000000010E5000-memory.dmp

                                                                          Filesize

                                                                          84KB

                                                                        • memory/2864-154-0x00007FFF88360000-0x00007FFF88E21000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/3884-146-0x000001EA31680000-0x000001EA31690000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/3884-144-0x000001EA332D0000-0x000001EA332F2000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                        • memory/3884-145-0x00007FFF88360000-0x00007FFF88E21000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/3884-165-0x000001EA4B7A0000-0x000001EA4B7B3000-memory.dmp

                                                                          Filesize

                                                                          76KB

                                                                        • memory/3884-147-0x000001EA31680000-0x000001EA31690000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/3884-148-0x000001EA31680000-0x000001EA31690000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/3896-151-0x000002644EAD3000-0x000002644EAD5000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/3896-150-0x00007FFF88360000-0x00007FFF88E21000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/3896-149-0x000002644EAD0000-0x000002644EAD2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/4376-167-0x00000000001C0000-0x00000000001CE000-memory.dmp

                                                                          Filesize

                                                                          56KB

                                                                        • memory/4376-130-0x00000000004AE000-0x00000000004BA000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                        • memory/4376-134-0x0000000000D40000-0x0000000000D50000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4376-133-0x0000000001000000-0x000000000106F000-memory.dmp

                                                                          Filesize

                                                                          444KB

                                                                        • memory/4376-132-0x00000000005B0000-0x00000000005BC000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                        • memory/4376-131-0x00000000004AE000-0x00000000004BA000-memory.dmp

                                                                          Filesize

                                                                          48KB