d1a4049ba690a122863c55c4c7b35e18fdd25225dcb1f5e0a08a7c9f8ddb77be

Analysis

max time kernel
65s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
12-01-2021 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

atiflash_293.sfx.exe
Size

6.5MB
MD5

6e1b3fc0daa62b5de4bdbc7d694c0e15
SHA1

3c6e62e21f2b58461c4b888f55ee2c1a5712003a
SHA256

d1a4049ba690a122863c55c4c7b35e18fdd25225dcb1f5e0a08a7c9f8ddb77be
SHA512

9f9171ed2c22e63c72fd980d6960b0c0876a2f0bc41dc3b8c6a99b679f2947de6fdd73e070bd7bb2de59af5040644e058bdb575c58ac535861b7810d6422aecb

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

amdvbflashWin.exeamdvbflashWin.exeamdvbflashWin.exeKerenl.exe

pid process

1792 amdvbflashWin.exe
1184 amdvbflashWin.exe
1272 amdvbflashWin.exe
1640 Kerenl.exe

pid	process
1792	amdvbflashWin.exe
1184	amdvbflashWin.exe
1272	amdvbflashWin.exe
1640	Kerenl.exe

Loads dropped DLL 21 IoCs

Processes:

atiflash_293.sfx.exeamdvbflashWin.exeamdvbflashWin.exeamdvbflashWin.exeKerenl.exe

pid	process
1696	atiflash_293.sfx.exe
1696	atiflash_293.sfx.exe
1696	atiflash_293.sfx.exe
1696	atiflash_293.sfx.exe
1792	amdvbflashWin.exe
1184	amdvbflashWin.exe
1184	amdvbflashWin.exe
1184	amdvbflashWin.exe
1272	amdvbflashWin.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe
1640	Kerenl.exe

JavaScript code in executable 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\NVIDIA\amdvbflashWin.exe	js
C:\Users\Admin\AppData\Roaming\NVIDIA\amdvbflashWin.exe	js

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

amdvbflashWin.exeKerenl.exenotepad.exe

pid	process
1184	amdvbflashWin.exe
1184	amdvbflashWin.exe
1640	Kerenl.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe

Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

472
472
472
472

pid	process
472
472
472
472

Suspicious behavior: MapViewOfSection 37 IoCs

Processes:

notepad.exe

pid	process
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe
324	notepad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

amdvbflashWin.exe

pid process

1184 amdvbflashWin.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

amdvbflashWin.exe

pid process

1272 amdvbflashWin.exe

pid	process
1272	amdvbflashWin.exe

Suspicious use of WriteProcessMemory 464 IoCs

Processes:

atiflash_293.sfx.exeamdvbflashWin.exeamdvbflashWin.exeKerenl.exenotepad.exe

description	pid	process	target process
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1696 wrote to memory of 1792	1696	atiflash_293.sfx.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1792 wrote to memory of 1184	1792	amdvbflashWin.exe	amdvbflashWin.exe
PID 1184 wrote to memory of 1272	1184	amdvbflashWin.exe	amdvbflashWin.exe
PID 1184 wrote to memory of 1272	1184	amdvbflashWin.exe	amdvbflashWin.exe
PID 1184 wrote to memory of 1272	1184	amdvbflashWin.exe	amdvbflashWin.exe
PID 1184 wrote to memory of 1272	1184	amdvbflashWin.exe	amdvbflashWin.exe
PID 1184 wrote to memory of 1640	1184	amdvbflashWin.exe	Kerenl.exe
PID 1184 wrote to memory of 1640	1184	amdvbflashWin.exe	Kerenl.exe
PID 1184 wrote to memory of 1640	1184	amdvbflashWin.exe	Kerenl.exe
PID 1184 wrote to memory of 1640	1184	amdvbflashWin.exe	Kerenl.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 1640 wrote to memory of 324	1640	Kerenl.exe	notepad.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe
PID 324 wrote to memory of 1708	324	notepad.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\atiflash_293.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\atiflash_293.sfx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe" /VERYSILENT
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1184

C:\Users\Admin\AppData\Roaming\NVIDIA\amdvbflashWin.exe
"C:\Users\Admin\AppData\Roaming\NVIDIA\amdvbflashWin.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Users\Admin\AppData\Roaming\NVIDIA\Kerenl.exe
"C:\Users\Admin\AppData\Roaming\NVIDIA\Kerenl.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
6⤵
PID:1708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
6⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
6⤵
PID:1064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
6⤵
PID:1396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
6⤵
PID:268

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1688

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1780

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1680

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1512

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:904

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1216

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:436

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:756

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:2008

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:2016

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:812

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1340

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1492

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:624

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1056

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:672

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1016

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:920

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:932

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1496

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:468

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1096

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1908

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1836

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1592

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1320

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1636

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:740

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1656

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:940

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:2012

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
6⤵
PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin-0.bin
MD5
5426d8965b0dd46c835ba751f2f58dcf

SHA1
7ac787c879a2cae71773ebad6936c262b3914853

SHA256
a051b7f13594aae453983106be99876c8427108f27d925532d78cf0f133721ee

SHA512
63153636072c8eccfd4fd4ebefe46a7b89f602bfe3cbcac7103f6b34f74ccfb2170d73021ec70c358c2b638a5e34a7cd877204554cbcd69c167a87e9f91867ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin-1.bin
MD5
1b8b4c572c25d4aa50e319537d09956a

SHA1
726bdce8f68847717c087e45c1a0864aeb3c3d9b

SHA256
7c860ff9640586b124c5746eed282242cf412b47dc7b50770a0fbc2afa14c646

SHA512
1f879cc166e77e669675b12a874a141f7b65e44fc9e667973678ac9245ba5d38f426b19143618421a1890e0e1e1688034f8febacc163e9e2f67f69623947b54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\ATIWinflashenu.dll
MD5
9ad4a476b03ad2f9034ac1b30f006a4f

SHA1
cc96accc636eb105dd4d6ed459780a3065b36734

SHA256
9b5f694c4381ac3c4c2dd1f5a7241a4318f9d2a57ef60db1fbf36fd50b7242cc

SHA512
688b61633ae7cb56b1a8aa3c200628004020161ea643bbd9661de2f34dbfe1a5ee4a8997417e5448260b41f051a7bb71f68db1cf975e4ac56915edcef8b81658

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\BORLNDMM.DLL
MD5
d329682a25bb2433bc05d170b8e3e9b0

SHA1
76e3a2004e5ba7f5126fac9922336f38e928d733

SHA256
b3cc3f8b65b37a807843e07c3848eba3b86f6e2d0b67c6d7cb14e9660a881618

SHA512
432f454d32622b352badabe71546e522949a83dfefdcd12dcd6992d9e57d10d13de305dc67c8993d6e90c28cabdc9d6b20829c844efe8e175cb80f51bcd407d3

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\CC3260MT.DLL
MD5
0df3473346769c1c732222c2664e65fe

SHA1
b65e69d2b06ef1ef895fd600ec929c54b9cd8da6

SHA256
4b5eadc340492faa57df3571c7471f0528832f1e7c822191adb53d9e6be7662d

SHA512
e1e059fe8e8396c8c0f93b00ccff626a1850d4f5e750ce6405023e8d7acebbeff3f9e52f7fafa229bf050435964ad6d12f5de85dbbe0e207e83e2307e9e1c284

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\Kerenl.exe
MD5
89cb0854f8c4f08e1bb894065a4063dc

SHA1
bef1b63cf478155fd07d78e6e1d64c11b1963b4d

SHA256
e2c896f6addd6e7b87f6c86e9cbf91ad828ee425cde30134aad2d6d5b8e8875e

SHA512
391b0a34ae756ef6d40b69d77dda3ad0adcc14b10cedab4a6567050dd37fe8fc2f375c4c38603cf1d9c784b77df62672462b7f1c4bd52a03ee3502b9c6ccb01b

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\amdvbflashWin.exe
MD5
0c9bbd178196c451beb69302294c9330

SHA1
28c12558a93fdb6a5da086ec72b9e049f545982d

SHA256
d7e0e886486181692ee2ee0930dd5974456c1c7470e89ebc392ffe040574a328

SHA512
ba3ce393c5a1d4e8aa60ee8debd3edb1016317c707cc54f083fc41125957f4971e720de784ea961f2375eccd976c46fc9ecdc97209a5b0c4e016e6d658bbfd07

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\bcbsmp60.bpl
MD5
90cb3d45db064bf0ef9298209694c1df

SHA1
3832f08ac6a80ef1e68db155e41e6654e9e185c9

SHA256
51fe769cf939981a7f7f018865c2ed7c6dfbd5a6b1d58ff90c5c6728d582ffc9

SHA512
d3d33bc6a16484b6486e59eabb7276e655ee2a3b16c1e4a82532d09395c010702b8136b205e0abe8bd22379655367e382d37255e808eb391a9cf3b98bfab666c

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\bdertl60.bpl
MD5
b87ef5f1ed15cfdedadab33fa7ed3beb

SHA1
a80521bd90beb801cd0536789e6661a7dc3b8d07

SHA256
b56d3e643fb1eef7018aa120ddab53ae0402ef997e1441a1ad7ff4ce25f79658

SHA512
fdd5aeef55e17a83bc3d62496b72bc9c668f4b4c7991d48c5935f6a006cf78a395dc12c0fa611891b5dfcfcb1574b95eaf375451584bb99d4cfa8228cfda4acb

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\dbrtl60.bpl
MD5
49e1cadd50625349cebb60ea4119fbf2

SHA1
09c1d5d78a6b44ff306652bc3613285b6ae32aa7

SHA256
95aaa2bccc46106c2d2275dc22651cc8f13b728d15afcc26d8469371c1bb18d5

SHA512
1afd847d130d1775089eda162a15b12abfc217703a15a43da84fbbd69dd8d835913326e48862e6515e366ea87f3d5ab609c406f8e9ff32702513c0bf58699876

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\dss60.bpl
MD5
71101555cc2ab52f3fc1c0a6accf248a

SHA1
09620e314d64c8da3bfadf0ab688961a6a2c750a

SHA256
0c1a45d1fff0cc1e4d6ec7111a0e87922b94fe5c5fdb81d542079ea0019e7068

SHA512
669d52fa2bd27d1fc2e83fbc74e0228540a8eb1e188ddccaaa4008dd8f1d7566e93afedcc07653726151dce374accc7418b344ce45835262f147d0f5bb3de1de

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\qrpt60.bpl
MD5
84c086e8c65cdaf1e716d6e9e4dc68bf

SHA1
72eddcc5335a725f530ab11936cf541e960f1c19

SHA256
dc6449a610a96e4454a3f4e02c20d0098a3a5a30cab602d0d5fbdb1d3c579636

SHA512
e6b59817aea6ba3ce7f5d11df19f36f42e84e4a4337f7e49c5692d0e4692f269a60aab8b4dbf552fe611314ee075c04efa0ebdcc7bf7d024b84e12cd28a90f3c

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\rtl60.bpl
MD5
184791b38f78382c1f6e33f476f9dd59

SHA1
a1aacf6f773ff3baebcbd54764b1be66fcece7aa

SHA256
55b7332af0e402a1a08d25214a9d5a1bacd52a19ac15fb7f1f7b8fb6957b39ed

SHA512
4bdb0ae4474741d59ed5fa12d7e0cf18bf4fef89ae2b9babf737423ea42dca1bc0a0b053922766e7a7182eda38591a8a4a51ac9209db4248dd18dd120e90986d

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\tee60.bpl
MD5
3d7ce1782c91ecf030baa746ec8b718a

SHA1
99d9c602e590b4d10254e8c8c4daaea5f0bb90eb

SHA256
39d0739da046509b322f2f750e23a4d71084f6b88fdcdd71851a40c23ccf023b

SHA512
0a89698b75d4dcc2385a9f567e721d903c80c38010ac779bdd5b1bed4e0e8ac60ceac9c3888f9e979386ebe2f166e683afdfdf1468ad6a9968b701149ec0496b

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\vcl60.bpl
MD5
9b619356853521b3f888ef2a830037fb

SHA1
3a0235763d5e3de490fd125aca0785eae08bceb1

SHA256
ca904861fccf5f8b6cb44c33f77f391e4388d3693fe62a6f91fed4084061bd07

SHA512
f31f7e98f3aec42e0cb33be91a811f64e11680e7c69183e580b176cf3446456740f528e15aee5deb887a444f4f7c8468583f7e6405e6a5da5057b0c503e58db4

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\vcldb60.bpl
MD5
2cbb26919edeea3f628b2e56ea23c9c8

SHA1
3cf0a84c913bc11ff8405fe4c3202ab14798fbbe

SHA256
3f0a4f6f50acb7ea227808faec072f9a5c4bed0747ca8d7025e56d1f370c0b4f

SHA512
5dd9afe5ad7d4b3dff39cebaabc18a1c7254e0c63bb1482b07c716746fa8dad1583adebf5703face84f7718408f9f550f862444926fdcb33716004c1775454d5

Download Submit
C:\Users\Admin\AppData\Roaming\NVIDIA\vclx60.bpl
MD5
aad6f4b96f96dd5e52f7b4989e5c5103

SHA1
082d57c34f22ada75827539d2ca8873ec4d10dff

SHA256
741b8250412fe40fd3124de2814a506af94f65017e6c90ae2af27a9b54d81052

SHA512
0bba5bc67e1f9cd798ef8ee274be03ba1be36fd560fece8553764060baffb301ddf259ee9baeb2ad57f3e25fa75be8765ddd01fd9b40fd3177924bd68bc6d645

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\amdvbflashWin.exe
MD5
187edfd98a26377024b724f3c1f390f1

SHA1
9aa8dbf729c540340158f43ecb9201089035e06c

SHA256
988311607bf9604798705c44a5094d2b273842e66c69ba06ca0e37854741724e

SHA512
1dbfd619467734834b08cb9380f0933c9eccb7a0beab6bcd0d2c59464da3eb7e8b150c4bff825799d4e430b585960cb9d6a8a25b60826b4a00797a41d35ba50c

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\ATIWinflashenu.dll
MD5
9ad4a476b03ad2f9034ac1b30f006a4f

SHA1
cc96accc636eb105dd4d6ed459780a3065b36734

SHA256
9b5f694c4381ac3c4c2dd1f5a7241a4318f9d2a57ef60db1fbf36fd50b7242cc

SHA512
688b61633ae7cb56b1a8aa3c200628004020161ea643bbd9661de2f34dbfe1a5ee4a8997417e5448260b41f051a7bb71f68db1cf975e4ac56915edcef8b81658

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\Kerenl.exe
MD5
89cb0854f8c4f08e1bb894065a4063dc

SHA1
bef1b63cf478155fd07d78e6e1d64c11b1963b4d

SHA256
e2c896f6addd6e7b87f6c86e9cbf91ad828ee425cde30134aad2d6d5b8e8875e

SHA512
391b0a34ae756ef6d40b69d77dda3ad0adcc14b10cedab4a6567050dd37fe8fc2f375c4c38603cf1d9c784b77df62672462b7f1c4bd52a03ee3502b9c6ccb01b

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\Kerenl.exe
MD5
89cb0854f8c4f08e1bb894065a4063dc

SHA1
bef1b63cf478155fd07d78e6e1d64c11b1963b4d

SHA256
e2c896f6addd6e7b87f6c86e9cbf91ad828ee425cde30134aad2d6d5b8e8875e

SHA512
391b0a34ae756ef6d40b69d77dda3ad0adcc14b10cedab4a6567050dd37fe8fc2f375c4c38603cf1d9c784b77df62672462b7f1c4bd52a03ee3502b9c6ccb01b

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\amdvbflashWin.exe
MD5
0c9bbd178196c451beb69302294c9330

SHA1
28c12558a93fdb6a5da086ec72b9e049f545982d

SHA256
d7e0e886486181692ee2ee0930dd5974456c1c7470e89ebc392ffe040574a328

SHA512
ba3ce393c5a1d4e8aa60ee8debd3edb1016317c707cc54f083fc41125957f4971e720de784ea961f2375eccd976c46fc9ecdc97209a5b0c4e016e6d658bbfd07

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\bcbsmp60.bpl
MD5
90cb3d45db064bf0ef9298209694c1df

SHA1
3832f08ac6a80ef1e68db155e41e6654e9e185c9

SHA256
51fe769cf939981a7f7f018865c2ed7c6dfbd5a6b1d58ff90c5c6728d582ffc9

SHA512
d3d33bc6a16484b6486e59eabb7276e655ee2a3b16c1e4a82532d09395c010702b8136b205e0abe8bd22379655367e382d37255e808eb391a9cf3b98bfab666c

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\bdertl60.bpl
MD5
b87ef5f1ed15cfdedadab33fa7ed3beb

SHA1
a80521bd90beb801cd0536789e6661a7dc3b8d07

SHA256
b56d3e643fb1eef7018aa120ddab53ae0402ef997e1441a1ad7ff4ce25f79658

SHA512
fdd5aeef55e17a83bc3d62496b72bc9c668f4b4c7991d48c5935f6a006cf78a395dc12c0fa611891b5dfcfcb1574b95eaf375451584bb99d4cfa8228cfda4acb

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\borlndmm.dll
MD5
d329682a25bb2433bc05d170b8e3e9b0

SHA1
76e3a2004e5ba7f5126fac9922336f38e928d733

SHA256
b3cc3f8b65b37a807843e07c3848eba3b86f6e2d0b67c6d7cb14e9660a881618

SHA512
432f454d32622b352badabe71546e522949a83dfefdcd12dcd6992d9e57d10d13de305dc67c8993d6e90c28cabdc9d6b20829c844efe8e175cb80f51bcd407d3

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\cc3260mt.dll
MD5
0df3473346769c1c732222c2664e65fe

SHA1
b65e69d2b06ef1ef895fd600ec929c54b9cd8da6

SHA256
4b5eadc340492faa57df3571c7471f0528832f1e7c822191adb53d9e6be7662d

SHA512
e1e059fe8e8396c8c0f93b00ccff626a1850d4f5e750ce6405023e8d7acebbeff3f9e52f7fafa229bf050435964ad6d12f5de85dbbe0e207e83e2307e9e1c284

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\dbrtl60.bpl
MD5
49e1cadd50625349cebb60ea4119fbf2

SHA1
09c1d5d78a6b44ff306652bc3613285b6ae32aa7

SHA256
95aaa2bccc46106c2d2275dc22651cc8f13b728d15afcc26d8469371c1bb18d5

SHA512
1afd847d130d1775089eda162a15b12abfc217703a15a43da84fbbd69dd8d835913326e48862e6515e366ea87f3d5ab609c406f8e9ff32702513c0bf58699876

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\dss60.bpl
MD5
71101555cc2ab52f3fc1c0a6accf248a

SHA1
09620e314d64c8da3bfadf0ab688961a6a2c750a

SHA256
0c1a45d1fff0cc1e4d6ec7111a0e87922b94fe5c5fdb81d542079ea0019e7068

SHA512
669d52fa2bd27d1fc2e83fbc74e0228540a8eb1e188ddccaaa4008dd8f1d7566e93afedcc07653726151dce374accc7418b344ce45835262f147d0f5bb3de1de

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\qrpt60.bpl
MD5
84c086e8c65cdaf1e716d6e9e4dc68bf

SHA1
72eddcc5335a725f530ab11936cf541e960f1c19

SHA256
dc6449a610a96e4454a3f4e02c20d0098a3a5a30cab602d0d5fbdb1d3c579636

SHA512
e6b59817aea6ba3ce7f5d11df19f36f42e84e4a4337f7e49c5692d0e4692f269a60aab8b4dbf552fe611314ee075c04efa0ebdcc7bf7d024b84e12cd28a90f3c

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\rtl60.bpl
MD5
184791b38f78382c1f6e33f476f9dd59

SHA1
a1aacf6f773ff3baebcbd54764b1be66fcece7aa

SHA256
55b7332af0e402a1a08d25214a9d5a1bacd52a19ac15fb7f1f7b8fb6957b39ed

SHA512
4bdb0ae4474741d59ed5fa12d7e0cf18bf4fef89ae2b9babf737423ea42dca1bc0a0b053922766e7a7182eda38591a8a4a51ac9209db4248dd18dd120e90986d

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\tee60.bpl
MD5
3d7ce1782c91ecf030baa746ec8b718a

SHA1
99d9c602e590b4d10254e8c8c4daaea5f0bb90eb

SHA256
39d0739da046509b322f2f750e23a4d71084f6b88fdcdd71851a40c23ccf023b

SHA512
0a89698b75d4dcc2385a9f567e721d903c80c38010ac779bdd5b1bed4e0e8ac60ceac9c3888f9e979386ebe2f166e683afdfdf1468ad6a9968b701149ec0496b

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\vcl60.bpl
MD5
9b619356853521b3f888ef2a830037fb

SHA1
3a0235763d5e3de490fd125aca0785eae08bceb1

SHA256
ca904861fccf5f8b6cb44c33f77f391e4388d3693fe62a6f91fed4084061bd07

SHA512
f31f7e98f3aec42e0cb33be91a811f64e11680e7c69183e580b176cf3446456740f528e15aee5deb887a444f4f7c8468583f7e6405e6a5da5057b0c503e58db4

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\vcldb60.bpl
MD5
2cbb26919edeea3f628b2e56ea23c9c8

SHA1
3cf0a84c913bc11ff8405fe4c3202ab14798fbbe

SHA256
3f0a4f6f50acb7ea227808faec072f9a5c4bed0747ca8d7025e56d1f370c0b4f

SHA512
5dd9afe5ad7d4b3dff39cebaabc18a1c7254e0c63bb1482b07c716746fa8dad1583adebf5703face84f7718408f9f550f862444926fdcb33716004c1775454d5

Download Submit
\Users\Admin\AppData\Roaming\NVIDIA\vclx60.bpl
MD5
aad6f4b96f96dd5e52f7b4989e5c5103

SHA1
082d57c34f22ada75827539d2ca8873ec4d10dff

SHA256
741b8250412fe40fd3124de2814a506af94f65017e6c90ae2af27a9b54d81052

SHA512
0bba5bc67e1f9cd798ef8ee274be03ba1be36fd560fece8553764060baffb301ddf259ee9baeb2ad57f3e25fa75be8765ddd01fd9b40fd3177924bd68bc6d645

Download Submit
memory/300-48-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp

Filesize
2.5MB

Download
memory/324-47-0x0000000000000000-mapping.dmp

Download
memory/1184-11-0x0000000000000000-mapping.dmp

Download
memory/1272-15-0x0000000000000000-mapping.dmp

Download
memory/1640-19-0x0000000000000000-mapping.dmp

Download
memory/1792-6-0x0000000000000000-mapping.dmp

Download